11/26/2019 Data Protection in Indonesia

EMAIL US: ssek@ssek.com
(/blog) (/id/blog) sub
(mailto:ssek@ssek.com)

(/index.php)

HOME (/) 
INDONESIA LAW BLOG (/BLOG?
SEARCH=DX_LIST_SSEK_BLOG&TASK=SEARCH) 
SSEK BLOG (/COMPONENT/CONTENT/CATEGORY/40-SSEK-
BLOG?ITEMID=343)
 DATA PROTECTION IN INDONESIA

INDONESIA LAW BLOG

LEGAL UPDATES

https://www.ssek.com/blog/data-protection-in-indonesia-2 1/6
11/26/2019 Data Protection in Indonesia

Data Protection in Indonesia

 05 December 2017 Legal Updates

By Denny Rahmansyah (/attorneys/partners/denny-rahmansyah) and Saprita Tahir

(/attorneys/associates/saprita-tahir)

Article 28(G) of the 1945 Constitution is considered as the basis for more speci c data privacy
legislation in Indonesia. Article 28(G) provides that every person has the right to: (i) protection
of their personal selves, families, respect, dignity and possessions under their control; and (ii)
security and protection from threat of fear for doing, or not doing, something which
constitutes a human right.

Provisions on the protection of personal data can be found in Law No. 11 of 2008 regarding
Electronic Information and Transactions, as amended by Law No. 19 of 2016 (the Electronic
Information Law). The procedural guidelines for the Electronic Information Law are contained
in Government Regulation No 82 of 2012 regarding the Implementation of Electronic Systems
and Transactions (Government Regulation 82).

However, none of these regulations provide a comprehensive set of provisions for the
protection of personal data in Indonesia, but rather simply provide the general idea of personal
data protection without speci c guidelines. On December 1, 2016, the Minister of
Communication and Informatics (MOCI) issued a regulation speci cally for the protection of
personal data that is contained in an electronic system, namely MOCI Regulation No. 20 of 2016

https://www.ssek.com/blog/data-protection-in-indonesia-2 2/6
11/26/2019 Data Protection in Indonesia

regarding Personal Data Protection in Electronic Systems (MOCI Regulation 20). MOCI
Regulation 20 is an implementing regulation for the Electronic Information Law and
Government Regulation 82.

The House of Representatives is now in the process of discussing a draft law on Personal Data
Protection (PDP Draft Law). The enactment of the PDP Draft Law would give rise to the rst
comprehensive law in Indonesia that speci cally deals with the protection of personal data.

Sectoral Laws on Data Privacy in Indonesia

There are several laws in a number of speci c areas that indirectly deal with data privacy in
Indonesia. These include:

Employment. There is no speci c stipulation under Indonesian employment laws on the

protection of personal data of employees. It would normally be considered suf cient for

employers in Indonesia to regulate the protection of the personal data of their employees by

way of unilateral employee consents, employment agreements, company regulations or

collective labor agreements. The basis to make these agreements and/or consents depends on

the freedom of contract principle under Article 1338 of the Indonesian Civil Code. These

agreements and/or consents authorize the collection, retention, disclosure and use of

employees' personal data or other con dential information.

Health sector. Article 57 of Law No 36 of 2009 regarding Health stipulates in principle that

every person is entitled to the con dentiality of their personal health information that has been

provided to, or collected by, health care providers.

Financial sector. Financial services providers are prohibited by Article 31 of Financial Services

Authority (Otoritas Jasa Keuangan or OJK) Regulation No. 1/POJK.07/2013 regarding Financial

Consumer Protection from disclosing customer data and/or information to third parties, unless

they receive written consent from the customer or are required to by lawful authority. If a

nancial services provider obtains personal data and/or information of a person and/or a group

of persons from a third party, it is required to have written con rmation from the third party

that the person or group has agreed to the disclosure. Additionally, the protection of

consumers' personal data and/or information in relation to the payment transaction process

conducted by payment system service providers is provided under Article 25 of Bank Indonesia

Regulation No. 18/40/PBI/2016 regarding the Provision of Payment Transaction Processing.

Telecommunications sector. Article 40 of Law No 36 of 1999 regarding Telecommunications

(the Telecommunications Law) prohibits the "tapping" of information transmitted through

telecommunications networks. Telecommunications services operators must keep any

https://www.ssek.com/blog/data-protection-in-indonesia-2 3/6
11/26/2019 Data Protection in Indonesia

information transmitted, and/or received, by a telecommunications service subscriber, through

a telecommunications network and/or telecommunications services provided by the relevant

operator, con dential (Article 42, Telecommunications Law).

This publication is intended for informational purposes only and does not constitute legal
advice. Any reliance on the material contained herein is at the user’s own risk. You should
contact a lawyer in your jurisdiction if you require legal advice. All SSEK publications are
copyrighted and may not be reproduced without the express written consent of SSEK.

Search article..

CATEGORIES

FIRM NEWS LEGAL UPDATES

(HTTPS://WWW.SSEK.COM/EN/BLOG? (HTTPS://WWW.SSEK.COM/EN/BLOG?
DX_BLOG_CATEGORY=42&TASK=SEARCH) DX_BLOG_CATEGORY=43&TASK=SEARCH)

LEGAL ALERTS ATTORNEY IN FOCUS

(HTTPS://WWW.SSEK.COM/EN/BLOG? (HTTPS://WWW.SSEK.COM/EN/BLOG?
DX_BLOG_CATEGORY=44&TASK=SEARCH) DX_BLOG_CATEGORY=45&TASK=SEARCH)

EVENTS
(HTTPS://WWW.SSEK.COM/EN/BLOG?
DX_BLOG_CATEGORY=41&TASK=SEARCH)

POPULAR ARTICLES

Virtual Currency Is Here, So How Is Indonesia

Going to Regulate It? (/blog/virtual-currency-is-
here-so-how-is-indonesia-going-to-regulate-it)
 28 February 2018
Legal Updates

SSEK Named Labor and Employment Law Firm

of Year at ALB Indonesia Law Awards
(/blog/ssek-named-labor-and-employment-law-
 30 October 2017
Events, Firm News

SSEK Adviser to Feature at IBA Investing in Asia

Conference (/blog/ssek-adviser-to-feature-at-iba-
investing-in-asia-conference)
 26 October 2017
Events, Firm News

Data Protection in Indonesia (/blog/data-

protection-in-indonesia-2)
https://www.ssek.com/blog/data-protection-in-indonesia-2 4/6
11/26/2019 Data Protection in Indonesia

 05 December 2017
Legal Updates

ARCHIVES

2019 2018 2017

(https://www.ssek.com/blog?(https://www.ssek.com/blog?(https://www.ssek.com/blog?

dx_blog_generic=2019) dx_blog_generic=2018) dx_blog_generic=2017)

2016 2015 2014

(https://www.ssek.com/blog?(https://www.ssek.com/blog?(https://www.ssek.com/blog?

dx_blog_generic=2016) dx_blog_generic=2015) dx_blog_generic=2014)

2013 2012

(https://www.ssek.com/blog?(https://www.ssek.com/blog?

dx_blog_generic=2013) dx_blog_generic=2012)

Back to blog (https://www.ssek.com/blog)

Subscribe to our newsletter

Sign up for the SSEK newsletter to stay up to date with the latest legal developments in

Indonesia, upcoming events you might be interested in and rm news

Email Address

First Name
https://www.ssek.com/blog/data-protection-in-indonesia-2 5/6
11/26/2019 Data Protection in Indonesia
First Name

Last Name

Company

SUBSCRIBE →

About Us (/our- Contact Us Sitemap

rm/our-history) (/contact-us) (/sitemap)
Connect With Us :  
Copyright 2018 SSEK. All rights reserved.

https://www.ssek.com/blog/data-protection-in-indonesia-2 6/6