Who Must Comply with Indonesia’s PDP Law? Criteria and Exemptions

The short answer to who must comply with Indonesia’s Personal Data Protection Law (UU PDP) is every person, public body, and international organization that processes personal data in Indonesia. If your business keeps customer phone numbers in a spreadsheet or a point-of-sale app, you are already within the law’s scope, regardless of your revenue or headcount.

The law, formally Law No. 27 of 2022, gave organizations a two-year transition period that ended on October 17, 2024 (Article 74), so all its obligations are now binding. Its implementing regulation, Government Regulation No. 33 of 2026 (PP 33/2026), was signed on July 16, 2026, and takes effect on January 16, 2027.

This article covers who must comply with Indonesia’s PDP Law, the roles of controllers and processors, who is exempt, data protection officers, and how to confirm your business’s position.

Who Must Comply with Indonesia’s PDP Law

Under Article 2 paragraph (1), the PDP Law applies to every person, public body, and international organization that processes personal data within Indonesia. Article 19 confirms that all three can act as either a personal data controller or a personal data processor.

“Every person” covers individuals and corporations, meaning organized groups of people and/or assets, whether or not they are legal entities. Examples include limited liability companies (PT), limited partnerships (CV), cooperatives (koperasi), and foundations (yayasan).

Personal Data Controllers

A personal data controller determines the purpose of processing personal data and controls that processing (Article 1 of the PDP Law). An online store that keeps customer data and a clinic that records patient data are examples.

Controllers must have a lawful basis for processing (Article 20) and keep records of processing activities (Article 31). They must also secure the data (Article 35) and, if a data protection failure occurs, notify data subjects and the PDP agency (Lembaga PDP) within 72 hours (Article 46).

Personal Data Processors

A personal data processor processes data on behalf of a controller (Article 1 of the PDP Law). Cloud providers and payroll vendors are examples.

Processors must process data according to the controller’s instructions (Article 51), and certain controller obligations also apply to processors, such as recording activities and securing data (Article 52). A processor that engages another processor (a subprocessor), such as a data center provider hired by an app vendor, needs the controller’s written approval (Article 51).

One company can hold both roles at once. A marketing agency, for example, is a processor when it manages its clients’ customer contacts and a controller for its own employee and prospect data.

Outsourcing data management to a vendor does not shift responsibility, because Article 51 of the PDP Law keeps the controller responsible for processing done by a processor. Responsibility passes to the processor if it processes data outside the instructions and purposes set by the controller.

Public Bodies and International Organizations

Public bodies include executive, legislative, and judicial institutions and other state bodies funded wholly or partly by the state or regional budget (APBN or APBD). Ministries and regional government agencies (dinas) are included.

Non-governmental organizations are also included if they are funded wholly or partly by the state budget, regional budgets, public donations, or foreign sources. An international organization is one recognized as a subject of international law and authorized to make international agreements.

Individuals Covered by the PDP Law

Individuals must comply with the PDP Law when they process personal data outside personal or household activities.

An individual online store owner who keeps buyers’ addresses is a controller, while a freelancer who manages a client’s customer contacts is a processor.

Articles 2 and 19 do not tie the obligations to revenue or headcount. What matters is the act of processing personal data, meaning obtaining, storing, analyzing, or disclosing data about an identifiable person (Articles 1 and 16).

Read also: Vendor Risk Management (VRM): The Critical Defense Against Supply Chain Attacks

Who Is Exempt from the PDP Law?

Article 2 paragraph (2) of the PDP Law exempts only individuals who process personal data for personal or household activities.

Processing for Personal or Household Activities

Personal or household activities generally cover processing data for your own or your family’s needs. Saving a friend’s number on your phone and managing a family photo album are examples.

Limits of the Exemption in the PDP Law

Saving customers’ phone numbers for sales is a business activity, so it generally falls outside this exemption. Corporations are not covered either, because the article mentions only individuals.

The official explanatory note (Penjelasan) to Article 2 says only “cukup jelas” (“sufficiently clear”) and does not define the limits of personal or household activities. For that reason, treat any processing tied to a business or a job as processing regulated by the PDP Law.

Article 15 of the PDP Law is not a scope exemption, because it only limits certain rights of data subjects, such as the right to withdraw consent. Those limits apply to interests such as law enforcement and scientific research, and they do not free controllers from their other obligations.

Who Must Appoint a Data Protection Officer?

Controllers and processors must appoint a data protection officer (DPO or PPDP) if they meet any of the three triggers in Article 53 paragraph (1) of the PDP Law:

• Processing is carried out for public services.
• The controller’s core activities require regular and systematic monitoring of personal data on a large scale.
• The controller’s core activities consist of large-scale processing of specific personal data (such as health, biometric, or personal financial data) and/or data related to criminal offenses.

Constitutional Court Decision No. 151/PUU-XXII/2024 of July 30, 2025 ruled that the word “and” in Article 53 paragraph (1) letter b must be read as “and/or.” As a result, one trigger is now enough, whereas before all three had to be met at once.

A large hospital that processes medical records generally meets the third trigger, while a regional civil registry agency meets the first because it serves the public. The PDP Law’s explanatory note does not define “large scale” or “core activities,” so companies should document the reasoning behind their assessment.

How to Check Where Your Business Stands Under the PDP Law

You can confirm where your business stands in five steps, starting with mapping the personal data you process:

1. List the personal data you collect from customers and employees and where it is stored, such as a spreadsheet or a point-of-sale app.
2. Determine your role in each activity, as a controller if you decide the purpose and means, or as a processor if you act on a client’s instructions.
3. Review the vendors that touch this data, including whether their contracts require them to process data on your instructions and to ask for your approval before involving another processor.
4. Match your core activities against the three DPO triggers in Article 53, then appoint an officer if even one trigger is met.
5. Document the results in a record of processing activities (RoPA), because Article 31 of the PDP Law requires controllers to record all processing activities.

Start with specific data such as health or personal financial data, because Article 34 of the PDP Law requires an impact assessment for high-risk processing, which includes specific data.

Controllers and processors that breach certain obligations face administrative sanctions under Article 57, including fines of up to 2 percent of annual income or revenue linked to the violation. If a corporation commits a personal data crime, Article 70 of the PDP Law allows criminal penalties for its management, controlling holders, order givers, beneficial owners, and/or the corporation.

Read also: How to Comply with Indonesia’s UU PDP: Do It Before It’s Too Late

Conclusion

Every party that processes personal data, whether as a controller or a processor, must comply with the PDP Law, regardless of the size or type of its business. The scope exemption in Article 2 covers only individuals who process data for personal or household activities.

Your first step is to map your personal data and determine your role before PP 33/2026 takes effect on January 16, 2027. After that, review your vendor contracts and match your core activities against the DPO appointment triggers.

FAQ