What Indonesian data protection and electronic-systems rules ask of the code you ship: UU PDP, PSE registration, Dukcapil identity checks, BPJS integrations, a security baseline and AI features. Each claim points to the regulation or official page it comes from, and the two that rest on news reporting say so.
By Matthews WongResearched on
Key takeaway
Indonesia's Personal Data Protection Law, UU 27/2022, ended its two-year adjustment period on 17 October 2024. For software that means a lawful basis for every purpose, provable consent, 3 x 24-hour deadlines for access, correction and breach notice, PSE registration through OSS, and Dukcapil identity checks only under a signed cooperation agreement.
Law 27 of 2022 applies to anyone processing personal data in Indonesia, and to processing abroad that has legal effect in Indonesia or concerns Indonesian citizens overseas (Article 2). Processing is defined broadly, from collection and analysis to transfer and deletion (Article 16). Every purpose needs one of the six bases in Article 20, and consent must be written or recorded, with the controller able to show proof of it (Articles 22 and 24).
The deadlines are short and measured in hours. Giving a subject access to their data and its processing trail, correcting inaccurate data, stopping processing after consent is withdrawn and restricting processing each carry a 3 x 24-hour limit (Articles 32, 30, 40 and 41). A personal data protection failure must be reported in writing within 3 x 24 hours to the affected subjects and to the supervisory agency (Article 46). Controllers must record all processing (Article 31), assess the impact of high-risk processing (Article 34), and appoint a data protection officer when any one of the Article 53 criteria applies. Administrative fines are capped at 2% of annual revenue or receipts (Article 57).
The two-year adjustment period in Article 74 ran from promulgation on 17 October 2022 and ended on 17 October 2024. Administrative sanctions under Article 57 are imposed by the supervisory agency that Article 58 leaves to the President to establish. As of the research date, the sources checked here do not confirm that this agency has been formed; Hukumonline's reporting in October 2026 describes it as not yet operating.
Hukumonline reports that PP 33/2026, the implementing regulation for Law 27 of 2022, was enacted on 16 July 2026 and takes effect on 16 January 2027. On the research date its text was not yet listed on peraturan.go.id or JDIH BPK, so this page relies on the law itself and treats the regulation's details as unconfirmed.
PP 71/2019 requires every electronic system operator to register before users start using the system (Article 6). Permenkominfo 5/2020 sets out who counts as a private-scope operator (PSE Lingkup Privat): platforms for commerce, financial transactions, paid digital content, communications, search and content, and personal data processing tied to electronic transactions. Registration goes through OSS, and the form asks for the personal data processed and where the system and data are managed, processed and stored. Foreign operators serving Indonesian users must register too.
An unregistered system can have its access blocked (Article 7 of the regulation). A private-scope operator may keep systems and data inside or outside Indonesia, provided ministries and law enforcement can still supervise and reach them (PP 71/2019, Article 21); public-scope operators must keep them in Indonesia unless the storage technology is unavailable at home (Article 20).
The regulation describes no public Dukcapil endpoint. Permendagri 102/2019, amended by Permendagri 17/2023, grants access per user — Indonesian legal entities included — after a request to the Director General, a memorandum of understanding and a cooperation agreement. Web-service access runs over a closed network the user provides; companies with majority foreign ownership get only a match or no-match answer; and data received through the web service may be stored only after the data owner's consent is verified with NIK and biometrics. The 2023 amendment added a certified information-security standard, banned passing population data to third parties, and deleted the shared-platform (Platform Bersama) provisions.
For BPJS Ketenagakerjaan, the documented employer channels are SIPP Online and the Electronic Payment System (EPS): contribution codes come from EPS, SIPP Online or the Payment Reminder System and are paid through partner banks or virtual accounts. BPJS Kesehatan runs a Trust Mark programme that assesses partners integrating with its information systems against legal, technical and security requirements. Health data and biometrics are specific personal data under Article 4 of UU PDP, which puts both integrations on the Article 34 impact-assessment list.
PP 71/2019 requires an audit trail of all electronic system activity (Article 22), security procedures against disruption and attack, and a first-opportunity report to law enforcement and the relevant ministry when a third party causes a serious failure (Article 24). BSSN Regulation 8/2020 turns that into an information security management system: operators self-assess their system as strategic, high or low, report the result to BSSN, and apply SNI ISO/IEC 27001 or BSSN standards according to that category.
UU PDP adds the duty to set security in proportion to the nature and risk of the data (Article 35) and to prevent unauthorised access (Article 39), and applies both duties to processors as well (Article 52). In engineering terms that means encryption in transit and at rest, tenant isolation enforced in the database rather than in application code, append-only audit logs that can answer an access request, least-privilege roles, and a vendor register, because a processor needs the controller's written approval before engaging another processor (Article 51).
UU PDP has no chapter on AI, but four articles carry most of the weight. Analysis and transfer are processing (Article 16), so sending a record to a model provider needs a basis for that purpose. Automated decisions with legal or significant effect, and the use of new technology, are on the impact-assessment list (Article 34), and data subjects may object to decisions based solely on automated processing, including profiling (Article 10).
Inference abroad falls under Article 56: the recipient's country must offer equal or higher protection; failing that, adequate and binding safeguards; failing both, the subject's consent. The Constitutional Court rejected a challenge to that article in full on 19 January 2026 (Decision 137/PUU-XXIII/2025). The communications ministry's Circular 9/2023 on AI ethics asks AI operators to ensure personal data protection under the regulations and to set internal policies on data and AI ethics.
| Obligation (article) | What the law says | Engineering control | Covered in |
|---|---|---|---|
| Lawful basis (Art. 20) | Each purpose needs one of six bases, from explicit consent to legitimate interests. | Record the basis per purpose in the processing register; a new purpose ships only once it has one. | UU PDP checklist for AI features |
| Consent and withdrawal (Arts. 22, 24, 40) | Consent is written or recorded and must be provable; processing stops within 3 x 24 hours of a withdrawal. | Append-only consent ledger (notice version, purpose, timestamp, channel) and a revocation event every consumer handles. | WhatsApp Business API guide |
| Access and correction (Arts. 30, 32) | Data and its processing trail are provided, and errors fixed, within 3 x 24 hours. | Per-subject export built from the audit log rather than hand-assembled queries. | ERP audit trail guide |
| Record of processing (Art. 31) | The controller records all processing activities. | Processing register kept in the repository and changed in the same pull request as the code. | UU PDP checklist for AI features |
| Security (Arts. 35, 39) | Security matches the nature and risk of the data, and unauthorised access is prevented. | Encryption in transit and at rest, database-enforced tenant isolation, least-privilege roles. | Postgres RLS guides |
| Breach notice (Art. 46) | Written notice within 3 x 24 hours to subjects and the agency: what was exposed, when and how, and the response. | Incident runbook with a notice template holding those three fields, and a deadline the on-call engineer can see. | UU PDP developer guide |
| Deletion (Arts. 43 to 45) | Delete when the purpose is met, consent is withdrawn or the subject asks, then tell the subject. | Retention jobs plus a deletion fan-out that reaches logs, caches, vendors and vector stores. | UU PDP checklist for AI features |
| Impact assessment (Art. 34) | Required for high-risk processing, including automated decisions, specific data, large scale and new technology. | An impact-assessment gate in design review for biometric, health and AI features. | NIK and Dukcapil e-KYC guide |
| Processors (Art. 51) | Processors act on the controller's instructions and need written approval before engaging another processor. | Vendor register with a data processing agreement for each vendor and sub-processor. | UU PDP developer guide |
| Transfer abroad (Art. 56) | Equal or higher protection in the recipient's country; failing that, binding safeguards; failing both, consent. | Data-flow inventory per vendor and region, including where model inference actually runs. | UU PDP checklist for AI features |
The dated changes a developer had to act on, oldest first, each linked to its official source.
Every electronic system operator must register before users start using the system, keep an audit trail and run security procedures; private-scope operators may store data abroad if supervision stays effective.
Source:JDIH BPK: PP No. 71 Tahun 2019 tentang Penyelenggaraan Sistem dan Transaksi ElektronikDefines which platforms register through OSS, puts the personal data processed and its storage location on the form, and sets takedown windows of 1 x 24 hours, or 4 hours for urgent requests.
Source:JDIH Komdigi: Permenkominfo No. 5 Tahun 2020 tentang Penyelenggara Sistem Elektronik Lingkup PrivatPermenkominfo 10/2021 tied the deadline to six months after risk-based OSS licensing took effect; the ministry set it at 20 July 2022, with access blocking for unregistered systems.
Source:Antara (news): Kominfo minta platform digital segera mendaftarEnacted and promulgated the same day, starting a two-year period for controllers, processors and other parties to bring their processing into line (Article 74).
Source:JDIH BPK: UU No. 27 Tahun 2022 tentang Pelindungan Data PribadiUsers of population data must hold a certified information-security standard and may not pass the data to third parties; the shared-platform provisions are deleted.
Source:JDIH BPK: Permendagri No. 17 Tahun 2023, amending Permendagri 102/2019 on access to population dataTwo years after promulgation, the Article 74 deadline for bringing personal data processing into line with the law passes.
Source:JDIH BPK: UU No. 27 Tahun 2022 tentang Pelindungan Data PribadiPerpres 174/2024 establishes the Ministry of Communication and Digital Affairs and revokes the Kominfo regulation; personal data protection is named in its remit, and the PSE portal and legal database now sit on komdigi.go.id.
Source:JDIH BPK: Perpres No. 174 Tahun 2024 tentang Kementerian Komunikasi dan DigitalDecision 151/PUU-XXII/2024 reads the Article 53 criteria as alternatives, so meeting any one of them obliges a controller or processor to appoint a data protection officer.
Source:Mahkamah Konstitusi: Putusan Nomor 151/PUU-XXII/2024Decision 137/PUU-XXIII/2025 rejects the petition against Article 56 in full, leaving its tiered test for transfers abroad unchanged.
Source:Mahkamah Konstitusi: Putusan Nomor 137/PUU-XXIII/2025Hukumonline reports it takes effect on 16 January 2027. The text was not yet on peraturan.go.id or JDIH BPK when this page was researched, so its details are unconfirmed here.
Source:Hukumonline (news): Pelindungan data pribadi dalam penegakan hukum di bawah PP 33/2026Each one is a hands-on write-up of a problem I worked through. Start with the one that matches where you are.
Short answers, consistent with the sources on this page as of the research date.
Primary sources checked on the research date. Follow them for the current version.
The other hubs, the reference pages and the calculators in this section.