The PDP Law — Personal Data Protection
Indonesia's Personal Data Protection Law: what it governs, what your obligations are, and how to assess vendors against it.
TL;DR
- Law No. 27 of 2022 (the PDP Law) governs data subject rights, the obligations of data controllers and processors, and sanctions for personal data breaches in Indonesia.
- Non-compliant organisations face administrative sanctions — the Audit Data Privacy guide describes exposure of up to 2% of annual revenue.
- Breach response and evidence readiness are central to PDP compliance.
Summary
Law No. 27 of 2022 on Personal Data Protection (the PDP Law) governs data subject rights, the obligations of data controllers and processors, and sanctions for personal data breaches in Indonesia.
What is the framework?
The PDP Law provides a comprehensive legal framework for personal data protection: lawful processing bases, data subject rights, security obligations, and breach provisions. It applies to organizations processing the personal data of Indonesian citizens, including through vendors.
Together with Government Regulation 71/2019 and Ministerial Regulation 20/2016 on personal data protection in electronic systems, the PDP Law forms layered security and reporting obligations your organization must meet — including when data is handled by third parties.
What does it require?
These obligations apply throughout the processing chain — including when personal data is handled by your vendors or partners.
- Have a lawful basis for every processing of personal data
- Implement security measures to protect personal data
- Announce personal data breaches within 3x24 hours
- Fulfil data subject rights (access, correction, deletion, and more)
- Apply data minimization and retention limits
What does it mean for vendor risk?
The PDP Law makes vendor risk assessment a compliance need, not just a best practice: data controllers are responsible for ensuring their processors meet equivalent protection standards. Contract clauses, periodic assessments, and vendor oversight evidence matter during audits and incident handling.
Assessing vendors against privacy controls — system security, breach history, compliance certifications — helps reduce the risk of sanctions and claims from data subjects.
How can CyberRank help?
CyberRank helps translate PDP Law obligations into concrete assessment and monitoring actions.
- Privacy compliance analysis and PDP compliance indicators in assessments
- Data leak detection (darknet and open sources) supporting 3x24-hour response
- Vendor assessments covering privacy and security
- Monitoring documentation for compliance audits
References
Frequently asked questions
Related links
Get your free security rating
Run a free CyberRank security rating for any organisation and see the same vendor risk signals our customers use.
Get your free security rating