Written by Dr Priskila Pratita Penasthika, Assistant Professor, School of Legislation, Universitas Indonesia
INTRODUCTION
The Indonesian Private Knowledge Safety Legislation, Legislation Quantity 27 of 2022 (Indonesian PDP Legislation), got here into impact on 17 October 2022. Earlier than its enactment, information safety guidelines in Indonesia have been fragmented throughout completely different sector-specific legal guidelines and rules. The Indonesian PDP Legislation goals to unify these legal guidelines and rules, offering larger readability and guaranteeing constant private information safety throughout all sectors within the nation. The Indonesian PDP Legislation units out normative provisions on private information safety; nevertheless, detailed, sensible guidelines have but to be specified within the implementing rules. As of now, the drafting of those implementing rules continues to be underway.
Lots of the elementary components of the Indonesian PDP Legislation, together with definitions of lined information and entities, lawful grounds, processing obligations, accountability measures, and relationships between information controllers and processors, are modelled after the European Union’s Common Knowledge Safety Regulation (GDPR). Nonetheless, a number of key provisions are tailor-made particularly to the Indonesian context. For example, the Indonesian PDP Legislation has broad extraterritorial attain, which shall apply to entities insofar as their private information processing actions have authorized implications inside Indonesia or pertain to an Indonesian nationwide information topic outdoors Indonesian jurisdiction.
To this point, there have been 5 choices by the Constitutional Court docket of the Republic of Indonesia (Mahkamah Konstitusi Republik Indonesia) in regards to the Indonesian Private Knowledge Safety Legislation. Briefly, the Indonesian Constitutional Court docket features as considered one of Indonesia’s apex judicial authorities, alongside the Supreme Court docket. Its major jurisdiction includes the constitutional evaluate of enacted legal guidelines (undang-undang) in Indonesia to evaluate their conformity with the 1945 Indonesian Structure (as lastly amended in 2002), thereby safeguarding the constitutional rights therein. Its choices are closing, legally binding, and possess rapid authorized impact upon issuance, with no provisions for enchantment or annulment by some other institutional physique.
This piece will give attention to the latest ruling by the Constitutional Court docket issued on 19 January 2026 relating to the Indonesian PDP Legislation, particularly Case Quantity 137/PUU-XXIII/2025, because it pertains to issues inside personal worldwide legislation.
FACTS
The Petitioner primarily requests a constitutional evaluate of Article 56 of the Indonesian PDP Legislation, which specifies the necessities for cross-border private information transfers. Article 56 delineates a tiered set of stipulations for such transfers. A private information controller answerable for transmitting private information overseas (information exporter) should confirm that the recipient nation affords an sufficient or larger degree of non-public information safety than that offered by the Indonesian PDP Legislation. If this requirement will not be met, the info exporter should be sure that enough and binding information protections are in place within the recipient nation. If neither situation is glad, the info exporter is obliged to acquire consent from the info topic previous to transferring private information overseas. Moreover, the forthcoming implementing rules are anticipated to offer additional particulars on the particular necessities for cross-border information transfers.
The petition was initiated with the briefing announcement issued by the White Home on 22 July 2025 in regards to the Framework for Negotiating a Reciprocal Commerce Settlement between Indonesia and america of America (Indonesia-USA Reciprocal Commerce Settlement Negotiation Framework). As a part of this framework, Indonesia has dedicated to establishing authorized certainty relating to the flexibility to switch private information outdoors its borders to america.
The Petitioner argued that the Indonesia-USA Reciprocal Commerce Settlement Negotiation Framework has led to a key interpretation of Article 56 of the Indonesian PDP Legislation in regards to the switch of residents’ private information past Indonesian borders. The Petitioner maintained that, beneath a strict interpretive method, the PDP Legislation permits information controllers to evaluate the adequacy requirement independently, with out parliamentary oversight. This might doubtlessly weaken democratic accountability and expose private information weak to misuse. Moreover, the Petitioner emphasised that such commitments ought to require approval from the Home of Representatives, as they straight influence nationwide sovereignty and the safety of residents.
The inspiration of the Petitioner’s petition relies on Article 28G, paragraph (1) of the 1945 Indonesian Structure, which protects residents’ rights to their dignity, household, honour, and property, in addition to the suitable to be free from threats to their elementary rights. Moreover, the Petitioner referred to Article 11 of the 1945 Indonesian Structure, which confers authority on the Home of Representatives and the President to conclude worldwide agreements.
Due to this fact, the Petitioner requests that the Constitutional Court docket interpret the provisions of Article 56 of the Indonesian PDP Legislation to imply that transferring private information to jurisdictions resembling america ought to happen provided that there may be a global settlement accredited by the Indonesian Home of Representatives. Furthermore, transfers to nations thought-about to lack sufficient private information safety requirements ought to happen solely with the consent of the info topics, after informing them of the dangers concerned within the cross-border transfers of their private information.
CONSTITUTIONAL COURT DECISION
The Constitutional Court docket rejected the entire Petitioner’s petition and arguments. In accordance with the Court docket, the cross-border switch of non-public information constitutes a part of the executive and technical measures carried out by the chief department, slightly than an settlement between nations that creates rights and obligations within the domains of politics, defence, or sovereignty. Based mostly on this reasoning, the Court docket affirmed that there isn’t any constitutional obligation to contain the Indonesian Home of Representatives in any cross-border information switch course of, together with in figuring out the adequacy resolution relating to such a private information switch.
Relating to the adequacy resolution, the Court docket held that the non-public information controller (information exporter) shall undertake technical verification procedures to establish whether or not the recipient nation of the non-public information switch maintains information safety requirements which are sufficient and even larger than these offered within the Indonesian PDP Legislation. Moreover, the Court docket identified that cross-border private information transfers don’t rely solely on the non-public information controller to make sure adequacy or larger safety requirements within the recipient nation. As an alternative, it additionally necessitates the existence and lively involvement of the Private Knowledge Safety Authority (PDPA), as prescribed in Articles 58-61 of the Indonesian PDP Legislation. The PDPA is tasked with overseeing, evaluating, and implementing technical coverage measures to make sure compliance with necessities for cross-border private information transfers. However, you will need to word that such authority has but to be established.
REMARKS
Regardless of the Constitutional Court docket’s rejection of the petition, Case Quantity 137/PUU-XXIII/2025 brings to mild persistent issues relating to the Indonesian PDP Legislation, significantly its provisions on cross-border private information transfers. These points name for additional dialogue and spotlight the urgent must move the implementing rules and set up the PDPA.
First, clarification is required relating to the social gathering answerable for conducting cross-border transfers of non-public information. Article 56 of the Indonesian PDP Legislation solely employs the time period ‘private information controller’ (pengendali information pribadi) within the context of cross-border information transfers, which appears to suggest that solely private information controllers are authorised to hold out such transfers.
Second, it’s essential to delineate which nations are recognised as having sufficient or larger ranges of non-public information safety. On this context, Article 60(f) of the Indonesian PDP Legislation supplies that the PDPA is empowered to evaluate whether or not the necessities for cross-border private information transfers are glad. The numerous function of the PDPA in cross-border private information switch can be emphasised by the Constitutional Court docket Judges in Case Quantity 137/PUU-XXIII/2025. For the reason that PDPA has not but been established or designated thus far, this example underscores the pressing must arrange or appoint such an authority.
Third, the forthcoming implementing rules of the Indonesian PDP Legislation are anticipated to make clear points surrounding cross-border private information transfers, together with the incorporation of whitelists and blacklists of particular jurisdictions, standardised contractual language, and particular information processing actions resembling pseudonymisation and encryption. It is usually presumed that the non-public information controller and the forthcoming PDPA shall be required to report back to the Indonesian Ministry of Communication and Digital relating to cross-border transfers of non-public information.
Fourth, as set out on the outset of this piece, the Indonesian PDP Legislation has an intensive extraterritorial scope. Within the occasion of a private information breach involving cross-border switch of non-public information, any people, companies, public entities, and worldwide organisations—no matter their origin or residence—whether or not functioning as private information controllers or processors, could also be thought-about potential defendants for violations that have an effect on the rights of an Indonesian information topic. Referring to Article 2 of the Indonesian PDP Legislation, this applicability is contingent upon the incidence of their misconduct (1) throughout the jurisdiction of Indonesia or (2) outdoors of Indonesia, offered that such misconduct leads to authorized penalties (a) throughout the Indonesian jurisdiction or (b) impacting an Indonesian private information topic outdoors of Indonesian territory.
The following concern issues the courtroom’s jurisdiction. As no cross-border information safety litigation has occurred in Indonesia thus far, the courtroom’s place on this matter stays indeterminate. However, Indonesian courts are infamous for his or her indifference and insularity when addressing foreign-related points. Moreover, Indonesian civil procedural legislation doesn’t specify provisions relating to parallel litigation. Consequently, in case of parallel proceedings regarding a cross-border information switch dispute, it’s seemingly that the Indonesian courtroom would train jurisdiction and proceed with the authorized continuing in Indonesia, however the existence of an ongoing authorized continuing involving the identical dispute and events in a overseas courtroom.
If proceedings are performed in a overseas courtroom, the complexities of the problems might enhance. Indonesia maintains a stringent stance {that a} overseas judgment will not be enforceable except it pertains to damages arising from marine salvage. Any overseas, apart from these on damages ensuing from marine salvage, should endure re-examination by an Indonesian courtroom. In mild of this stance, it’s obvious that Indonesian courts wouldn’t recognise or implement overseas judgments regarding cross-border private information switch disputes and would require such disputes to be relitigated earlier than an Indonesian courtroom.
Sensible challenges additionally embrace the complexities of seizing property or digital proof positioned in overseas jurisdictions, on condition that Indonesia has not but acceded to the HCCH 1970 Proof Conference.
Additional particulars in regards to the Indonesian PDP Legislation and its personal worldwide legislation features can be found in Priskila Pratita Penasthika, “Chapter 12 – Indonesia” in Adrian Mak, Ching Him Ho, and Anselmo Reyes (eds.), Privateness and Private Knowledge Safety Legislation in Asia (Hart Publishing, 12 December 2024).
