What Is Law No. 27 of 2022 on Personal Data Protection?
The current official BPK legal record identifies Law No. 27 of 2022 as effective from 17 October 2022 and in force. It also records Constitutional Court Decision 151/PUU-XXII/2024's conditional change to Article 53(1)(b). Article 74 of the official Indonesian text provides a maximum two-year adjustment period for compliance. The official Indonesian text reaches specified activity outside Indonesia when it has legal effects in Indonesia or for Indonesian data subjects abroad, and it excludes individual personal or household processing. The law enumerates information, correction, access/copy, termination or deletion/destruction, consent-withdrawal, automated-decision-objection, restriction, and portability rights. It states 3 x 24-hour controller deadlines for correction, access, consent-withdrawal termination, and restriction/limitation requests, while Article 15 lists exceptions for specified public-interest and sectoral purposes. Current official materials do not support treating the general implementing regulation or an independent data-protection authority as finalized: a 2025 update described drafts under harmonization, a 20 August 2026 Komdigi release states implementing regulations are still being developed, and a 22 July 2026 release states the authority and a presidential regulation are still being finalized. A separate PP No. 17 of 2025 is a child-protection regulation, not the general implementing regulation.
At a glance
- Full name
- Law No. 27 of 2022 on Personal Data Protection
- Short code
- UU PDP
- Jurisdiction
- Indonesia
- Enacted
- 2022
- Last major update
- Effective 17 October 2022; Constitutional Court Decision 151/PUU-XXII/2024 conditionally changed Article 53(1)(b); implementing regulation and independent authority still under development in mid-2026
- Regulator
- Ministry of Communication and Digital Affairs (Komdigi); a dedicated independent authority remains under development
- Private right of action
- Limited
- Statutory citation
- Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi
Scope, who UU PDP covers
Protected data
Data subject rights
Information about processing
Correction, with a 3 x 24-hour controller response deadline
Access/copy, with a 3 x 24-hour controller response deadline
Termination of processing and deletion/destruction, with a 3 x 24-hour controller response deadline for consent-withdrawal termination
Consent withdrawal
Objection to automated-decision-making
Restriction/limitation of processing, with a 3 x 24-hour controller response deadline
Portability
Notable features
Indonesia presents a genuine gap between statutory enactment and operational readiness: the law itself has been in force since October 2022 with firm 3 x 24-hour response deadlines for several rights, but in a 20 August 2026 Komdigi release, the general implementing regulation was still being developed, and a 22 July 2026 release confirmed the contemplated independent authority and presidential regulation were still being finalized — this gap must not be described as resolved.
Enforcement & penalties
Penalties: Not yet independently confirmed pending finalization of implementing regulations in the 7 September 2026 review; Law No. 27 of 2022 contemplates administrative sanctions and criminal penalties, but the detailed schedule should be verified once implementing regulations are finalized.
Private right of action: The law contemplates a complaint and enforcement structure, but current official materials confirm that the general implementing regulation and an independent data-protection authority were still being finalized in mid-2026, so complaint infrastructure and broker-specific route evidence remain unresolved.
Relevance to data brokers
No jurisdiction-specific data-broker or public-record route evidence has been confirmed, and this remains unresolved pending finalization of the implementing regulation and independent authority. Indonesian statutory and regulatory text remains controlling over any English reference translation.
Generate requests in under 60 seconds
Generate removal requests for 1,034 US/global profiles, $9
FAQ
Is Indonesia's data-protection law fully implemented?+
The law itself (Law No. 27 of 2022) has been in force since 17 October 2022. But in official Komdigi releases from mid-2026, the general implementing regulation and an independent data-protection authority were still being developed and finalized — so operational implementation is not yet complete.
How fast must a controller respond to a correction or access request in Indonesia?+
The law states a 3 x 24-hour (three-times-24-hour) controller response deadline for correction, access, consent-withdrawal termination, and restriction/limitation requests, subject to Article 15's exceptions for specified public-interest and sectoral purposes.
Official sources & citations
Other international privacy regimes
UU PDP sits in a global ecosystem of data-protection laws. Compare with other jurisdictions that shape cross-border data flows: