International Data Transfer: Mandatory Rules Under the PDP Law

Imagine a retail company in Jakarta that just signed a contract with a cloud service provider in Singapore to store customer data. Without realizing it, this simple step already falls under the category of transferring personal data abroad, and if the procedure is done incorrectly, the company could face administrative sanctions.

This issue turns out to be far from a purely local matter. That much is clear from the European Commission and Brazil, which on January 28, 2026 officially adopted a mutual adequacy decision described as the largest free and secure data flow area in the world. Research from Cisco’s 2026 Data and Privacy Benchmark Study even found that 85 percent of global organizations consider data localization rules to add cost, complexity, and risk to cross-border service delivery.

In Indonesia, this entire matter is specifically regulated through the international data transfer provisions of the Personal Data Protection Law (UU PDP). These provisions are a mandatory reference for every company, whether a large corporation or a startup, that sends personal data to a party located outside the territory of the Republic of Indonesia.

What Is International Data Transfer Under the PDP Law?

International data transfer, in simple terms, is the activity of sending, storing, or granting access to personal data to a party located outside Indonesian territory. It can take a physical form, such as sending a hard disk containing customer records, or an electronic form, such as uploading data to a cloud server in another country.

Under the PDP Law, the official term is “transfer of personal data outside the territory of the Unitary State of the Republic of Indonesia,” as regulated in Article 56. This provision does not only target multinational corporations, but also applies to small businesses that use foreign-based third-party services, such as email marketing tools or international payment gateways.

Many business owners mistakenly assume that personal data transfer only occurs when data is actively moved from one server to another. In fact, simply granting remote access to an IT support team located in another country, without moving a single byte of data, is still categorized as a personal data transfer under the framework of the PDP Law.

As a concrete example, a fintech startup in Bandung that uses a customer service vendor in the Philippines to handle complaints through a cloud-based ticketing system has automatically carried out a cross-border personal data transfer. The moment staff in the Philippines can access customers’ national ID numbers and transaction history, the obligations under Article 56 of the PDP Law immediately apply, regardless of the company’s original intent.

Legal Basis and Mechanism for Transferring Personal Data Abroad

Article 56 of the PDP Law does not prohibit international data transfer outright. Instead, this provision provides three pathways that companies can take, depending on the conditions of the destination country and the compliance documents the company has in place.

1. The Destination Country Has an Equivalent or Higher Level of Data Protection

The first pathway applies if the country where the data recipient is located already has personal data protection regulations that are equivalent to or stricter than the PDP Law. This equivalency status is determined by the Indonesian government, not unilaterally by the company carrying out the transfer.

As an illustration, the legal argument for transferring data to a European Union member state is relatively stronger because the region has long implemented the strict General Data Protection Regulation. Even so, companies are still required to wait for an official determination from Indonesian authorities before claiming that “equivalent” status applies to their case.

2. Adequate and Binding Data Protection

If the equivalency status of the destination country has not yet been established, companies can take the second pathway: ensuring there is adequate and legally binding data protection between the controller and the data recipient. This can take the form of standard contractual clauses or binding corporate rules signed by both parties.

For example, a logistics company sending customer data to a processing warehouse in Vietnam can draw up a data processing agreement that explicitly requires its Vietnamese partner to maintain security standards equivalent to the PDP Law. Such a document becomes important proof of compliance if a supervisory authority ever conducts an inspection.

3. Consent of the Data Subject

The third pathway is the last resort if the two previous pathways cannot be fulfilled: obtaining explicit consent from the personal data subject. This consent must be specific and stand-alone, not merely a generic checkbox on an application’s terms and conditions page.

For example, a health app wanting to share a user’s medical record data with a research laboratory in Japan is required to explain the purpose of the transfer in detail. After that, the app must request separate, specific consent for that activity, rather than bundling it with account registration consent.

Obligations of Data Controllers When Conducting Cross-Border Transfers

Beyond choosing one of the three pathways above, personal data controllers also bear a number of additional obligations that are often overlooked in daily practice. Negligence regarding these obligations can result in sanctions, even if the legal transfer pathway chosen was correct.

• Recording every data transfer activity, including its purpose, data categories, and the recipient’s identity. For example, recording that customer address and phone number data was sent to a package delivery service provider in Malaysia for logistics purposes.
• Conducting a personal data protection impact assessment before any large-scale transfer takes place. For example, before moving an entire customer database to a regional data center in Australia, the compliance team prepares a breach risk assessment beforehand.
• Ensuring the data recipient implements adequate technical security standards, such as encryption. For example, requiring an overseas cloud vendor to implement end-to-end encryption before customer data is uploaded to their servers.
• Providing a mechanism for data subjects to object or withdraw consent. For example, providing a “withdraw consent” button in an app that automatically stops data transfers to foreign partners once activated.
• Reporting data protection failure incidents to authorities and data subjects if a transfer results in a data breach. For example, promptly notifying customers and the supervisory body if a partner’s server abroad is hacked.

Risks and Challenges Companies Commonly Face

In practice, compliance with the rules on transferring personal data abroad does not always run smoothly. The following challenges are among the most frequently encountered by legal and IT teams at companies in Indonesia.

• Uncertainty over the equivalency status of destination countries. Not all countries yet have an official determination from Indonesian authorities, so companies often get stuck in a gray area when choosing a compliance pathway. For example, a company partnering with a vendor in a developing country must take the binding contract route because that country’s equivalency status is not yet clear.
• Foreign vendors refusing to sign standard contractual clauses. Many foreign vendors consider these additional clauses burdensome to their operations, especially smaller-scale vendors. For example, an overseas analytics service provider may prefer to lose an Indonesian client rather than change its global standard contract.
• Low awareness that foreign-based cloud services already constitute a data transfer. Marketing or operations teams often use software-as-a-service tools without coordinating with the legal team. For example, an HR team signs up for a US-based recruitment application without realizing that candidate data ends up stored on servers abroad.
• Additional costs for auditing foreign vendor security that were not budgeted from the start. This audit process takes time and resources, especially when it involves multiple vendors at once. Smaller companies often delay audits due to budget constraints, even though the risk of sanctions continues regardless.
• Regulatory changes in the destination country that can suddenly alter compliance status. A country once considered adequate may revise its laws, meaning its equivalency status needs to be reviewed again. Companies that fail to monitor these developments risk only discovering their non-compliance after an incident has already occurred.

Practical Steps to Maintain International Data Transfer Compliance

Facing these various challenges, companies can actually build a structured compliance system rather than simply reacting each time a problem arises. The following steps can serve as an initial reference.

1. Map out all data flows going abroad. Identify which vendors, partners, and platforms receive or access personal data from outside Indonesia. For example, creating a complete list ranging from email providers and payment gateways to HR applications hosted on foreign servers.
2. Determine the most suitable legal pathway from the three options under Article 56. Match the choice to the destination country’s status and the company’s ability to negotiate contract terms with vendors. For example, choosing the standard contractual clause pathway for large vendors already accustomed to such requests.
3. Draft and formally sign a data transfer agreement. Ensure the document includes security obligations, limits on data use, and an incident reporting mechanism. For example, adding a clause requiring notification within 3×24 hours in the event of a security incident on the vendor’s side.
4. Conduct regular audits of foreign vendors. These audits help ensure that the security commitments written into the contract are actually being carried out in practice. For example, requesting an annual security certification report from a cloud service provider as part of the contract evaluation.
5. Train internal teams on documentation and reporting obligations. Marketing, IT, and HR teams need to know when their activities fall under the category of personal data transfer. For example, holding a brief training session before the operations team starts using new foreign-based software.

Conclusion

International data transfer is not merely a technical matter of sending files. The provisions of Article 56 of the PDP Law require companies to understand the three available legal pathways, while also fulfilling the accompanying obligations of recording, risk assessment, and reporting.

Failing to understand these rules risks not only administrative sanctions but can also damage customer trust when their data changes hands without adequate protection. On the other hand, companies that have organized their data transfer compliance from the outset actually gain a competitive advantage, as business partners and investors increasingly scrutinize data governance before entering into partnerships.

FAQ