Indonesia’s PDP Law for E-commerce: A Practical Guide for Online Sellers

A consumer just finished checking out on an online store. Two days later, their phone is flooded with promotional messages from a company they never contacted.

They don’t remember ever agreeing to let a third party use their personal data. Yet somehow, their phone number and email address had already changed hands without their knowledge.

Cases like this are far from rare in online retail. IBM’s Cost of a Data Breach 2026 report recorded a new global record for the average cost of a data breach: US$4.99 million per incident.

Customer personal data is also the type of information stolen most often, appearing in 52% of all incidents recorded in that report. This shows that customer data is no longer just administrative record-keeping — it’s a prime target for cybercrime.

For e-commerce businesses in Indonesia, this kind of risk can no longer simply be handed off to the IT team. Indonesia’s PDP Law (Personal Data Protection Law) for e-commerce is now a binding legal framework for every platform, from major marketplaces down to small online shops, in how they manage customer data.

This article focuses specifically on how the PDP Law applies in an e-commerce context — starting from basic definitions, business obligations, consumer rights, and sanctions, through to practical steps you can take right away.

What Is the PDP Law?

Before discussing how it applies to e-commerce, it’s important to understand what the PDP Law actually is. Many business owners have only heard the name without knowing what it actually covers.

PDP Law is short for Law Number 27 of 2022 on Personal Data Protection. It was passed on 17 October 2022 and is Indonesia’s first legal umbrella specifically regulating personal data protection in one comprehensive regulation.

It’s worth noting that the PDP Law included a two-year transition period from the date it was passed, ending on 17 October 2024. Since that date, all provisions — including administrative and criminal sanctions — can be fully enforced against violators, even though a number of implementing regulations (government regulations and presidential regulations) are still being drafted by the government. This means some technical provisions, such as the standard format for reporting incidents to the supervisory authority, may still change, so e-commerce businesses are advised to regularly monitor developments in these implementing regulations.

Before the PDP Law, rules on personal data were scattered across various sectoral regulations — the ITE Law, Minister of Communication and Information Regulation No. 20 of 2016, and Government Regulation No. 80 of 2019 on Trade Through Electronic Systems — each covering only a small part of data protection.

The PDP Law brings all of this together into one clearer, more binding legal framework. It regulates who may collect personal data, how that data must be processed, and what sanctions await in case of violations.

There are three main parties regulated under the PDP Law. First, the data subject — the individual whose data is collected, such as a customer shopping at an online store.

Second, the data controller — the party that determines the purpose and means of processing data, such as the e-commerce company itself. Third, the data processor — the party that processes data on the controller’s instructions, such as a cloud service provider or digital payment vendor.

Personal data under the PDP Law is also divided into two categories. General personal data includes name, gender, nationality, and data that, when combined, can identify a person.

Specific personal data includes health data, biometric data, genetic data, personal financial data, and children’s data. This second category receives stricter protection because the risk to the data subject is far greater if misused.

Why Is the PDP Law So Relevant for E-commerce Businesses?

Not every type of business collects personal data as extensively or as frequently as e-commerce platforms do. This is exactly why the PDP Law deserves special attention from online sellers, rather than being treated as an optional add-on.

High Volume and Sensitivity of Data

Every e-commerce transaction involves data such as full name, shipping address, phone number, purchase history, and payment information. The larger the business, the more sensitive data it holds.

For example, a marketplace with millions of monthly transactions automatically stores millions of address and card records. If even one point of breach is found, the impact can spread to many customers at once, very quickly.

Consumer Trust as a Deciding Factor

Consumers are increasingly selective about where they shop online based on how securely a platform manages their data. The State of Digital Trust 2026 survey by Usercentrics, covering 11,000 consumers across seven global markets, found that 52% of consumers are willing to pay more — an average premium of 7% — to brands that show strong transparency and data protection.

For example, if two online stores sell similar products at nearly the same price, consumers tend to choose the one with a clear privacy policy and security certification, even if it’s slightly more expensive.

Obligations as a Data Controller

The PDP Law states that anyone running a business — including individuals selling from home through e-commerce — can be categorized as a personal data controller. This status carries direct legal consequences, since a data controller is fully responsible for how customer data is processed.

In other words, a small business selling through a marketplace is bound by the same obligations as a large company. Being a small operation doesn’t automatically exempt anyone from these duties.

Obligations of E-commerce Businesses Under the PDP Law

After understanding why the PDP Law matters so much for e-commerce, the next step is knowing the concrete obligations that must be met. Here are the key obligations e-commerce businesses need to pay attention to.

1. Obtain Valid Consent from Consumers

Collecting personal data must be based on the explicit consent of its owner. Consumers need to know what data is being collected and for what purpose.

For example, when a consumer registers a new account, the sign-up form should include a consent checkbox separate from the general terms and conditions — not buried in a long block of text customers rarely read.

2. Maintain Technical and Organizational Data Security

Businesses are required to apply adequate security measures to prevent unauthorized access, leaks, or misuse of data, from encrypting transaction data and limiting internal access, to regularly monitoring system activity. As an illustration, an e-commerce IT team should limit access to the customer database to only the staff who truly need it, because access that’s too loose only widens the gap for internal data misuse.

Mapping personal data is usually the starting point before this kind of access control can be applied precisely, as explained in more detail in the Record of Processing Activities (ROPA) guide.

3. Report Data Breach Incidents

If a data breach occurs, the PDP Law requires the data controller to report it to the relevant authority and the affected data subjects within 3×24 hours of discovery, and any delay in reporting can result in harsher sanctions later. For example, if a store’s payment system is hacked on a Monday, the company must send an official notification to affected customers by Thursday morning the same week, including what data was affected and what mitigation steps have been taken.

4. Restrict Cross-Border Data Transfers

Many e-commerce platforms use cloud services or foreign vendors to store data. The PDP Law states that cross-border data transfers may only take place if the destination country has an equal or better level of data protection.

For example, before using a cloud server located outside Indonesia, a company’s legal team needs to confirm that the provider meets the required data protection standards.

Consumer Rights as Data Subjects When Shopping Online

The PDP Law doesn’t only burden businesses with obligations, it also gives consumers a number of rights they can use at any time. Understanding these rights matters so e-commerce businesses are ready to respond to customer requests properly, while also having a clear workflow as discussed in the practical privacy compliance guide, rather than something merely promised in a privacy policy without any real mechanism.

• Right to know and access data. Consumers have the right to know what data about them is stored and to request a copy. For example, a customer can request the history of personal data stored in their marketplace account.
• Right to correct data. Consumers can update data that is incorrect or no longer relevant — for example, changing a shipping address after moving house.
• Right to delete data. Consumers can request deletion of their data once the purpose of collecting it no longer applies — for example, a customer closing their account can ask for their data to be permanently deleted.
• Right to withdraw consent. Consumers can withdraw previously given consent at any time — for example, unsubscribing from promotional notifications they had previously agreed to.
• Right to file a lawsuit. If a violation causes harm, consumers have the right to take legal action against the data controller — for example, a customer whose leaked data was used for fraud can pursue a civil lawsuit.

Sanctions for E-commerce Businesses That Violate the PDP Law

Violating the PDP Law is not a minor matter and can seriously affect a business’s continuity. Below is an overview of the sanctions, from lightest to most severe.

Administrative sanctions are usually imposed first, before a case escalates to criminal proceedings. However, in cases of deliberate violations affecting many data subjects at once, criminal sanctions can be applied directly, skipping the administrative stage.

Practical Steps to Prepare Your E-commerce Business for the PDP Law

Understanding the rules isn’t enough without concrete action. Here are practical steps e-commerce businesses can start taking now, alongside broader risk-governance considerations.

• Conduct data mapping. Identify what personal data is collected, stored, and shared with third parties — for example, build a full inventory from account registration data to stored payment data.
• Update your privacy policy. Make sure it’s written in plain language and clearly states the purpose of data collection — for example, replace dense legal wording with a short explanation an ordinary customer can understand.
• Apply encryption and access controls. Protect sensitive data with encryption and limit who can access it — for example, enable two-factor authentication for admin accounts managing customer data.
• Set up an incident response system. Create a standard procedure for responding quickly to data breaches within the PDP Law’s required timeframe — for example, designate a dedicated team responsible for coordinating notifications to customers and authorities when an incident occurs.
• Train employees regularly. Provide training on how to handle customer data safely — for example, hold a short quarterly training on recognizing phishing emails targeting internal data.

Consumer trust in a platform’s security has also been shown to directly influence purchase decisions. The State of Ecommerce Trust 2026 report by TrustedSite found that 82% of online shoppers say they trust stores displaying a verified third-party trust badge more than those that don’t display one at all.

Conclusion

The PDP Law for e-commerce isn’t just a legal formality that can be put off. It directly shapes how online businesses collect, store, and manage customer data every day.

From obtaining consent, to securing data, to fulfilling consumer rights — all of these elements work together to build the foundation of customer trust. Keep in mind that implementation won’t happen overnight, since a number of implementing regulations are still being drafted by the government, so e-commerce businesses need to stay flexible and adjust their internal policies as technical regulations are rolled out gradually.

FAQ