Conventus Law

Conventus Law

by

The introduction of Law No. 27 of 2022 regarding Personal Data Protection (“PDP Law”) on October 17, 2022, marked a significant step toward strengthening data protection in Indonesia. Among other actions, the PDP Law calls for the creation of a new data protection body, the Personal Data Protection Agency (“PDP Agency”), which will be an independent body directly accountable to the president.

The PDP Agency will have substantial authority to enforce and implement personal data protection regulations. Its responsibilities will include developing policies and strategies, facilitating alternative dispute resolution processes, issuing directives, handling complaints, conducting investigations, summoning individuals or entities, and requesting information or documents related to alleged data protection violations.

Establishment of the PDP Agency

The establishment of the PDP Agency will be formalized through a presidential regulation, with further procedural details outlined in a government regulation, as stipulated by the PDP Law. This is expected to occur by October 2024. The Ministry of Communications and Informatics (“MOCI”) is in the process of setting up the PDP Agency. The MOCI has allocated funds from the 2024 State Budget for the establishment of the PDP Agency and is currently proposing an initiative permit (Izin Prakarsa) to the President.

Responsibilities and Authorities of the PDP Agency

The PDP Agency will be responsible for formulating and stipulating policies and strategies for personal data protection, which will serve as guidelines for personal data subjects, controllers, and processors. Additionally, it will supervise the implementation of personal data protection, enforce administrative law against violations of the PDP Law, and facilitate out-of-court dispute resolution.

The full scope of the PDP Agency’s authority includes:

  • Formulating and establishing policies in the field of personal data protection.
  • Supervising the compliance of personal data controllers.
  • Imposing administrative sanctions for violations of personal data protection by controllers and processors.
  • Assisting law enforcement in handling allegations of criminal acts related to personal data.
  • Cooperating with international personal data protection institutions to resolve cross-border violations.
  • Assessing compliance with personal data transfer requirements outside Indonesia.
  • Issuing directives as a follow-up to the supervision of data controllers and processors.
  • Publishing the results of supervision in accordance with laws and regulations.
  • Receiving complaints and reports regarding alleged breaches of personal data protection.
  • Examining and investigating complaints, reports, and supervision results.
  • Summoning individuals and entities in connection with alleged violations.
  • Requesting explanations, data, information, and documents from relevant parties.
  • Summoning experts for investigations related to alleged violations.
  • Examining electronic systems and facilities used by data controllers and processors, including accessing data and appointing third parties.
  • Requesting legal assistance from prosecutors to settle personal data protection disputes.

Impact on Companies in Indonesia

Once established, the PDP Agency is expected to provide greater legal certainty for stakeholders, including businesses. The agency will address personal data protection issues and enforce compliance with the PDP Law and clarify the implementation of the PDP Law by issuing regulations. Personal data controllers and processors must align their practices with the PDP Law by October 17, 2024, ensuring compliance at all stages of data processing, from collection to deletion, which must be recorded.

In case of data protection failures, concerned parties will be able to report to the PDP Agency, which will have the authority to summon individuals or entities and request relevant information and data. This includes the authority to investigate electronic systems and facilities used by data controllers or processors and to access data related to alleged violations.

Non-compliance with the PDP Law can result in sanctions imposed by the PDP Agency, including written warnings, temporary suspension of data processing activities, deletion or destruction of data, and administrative fines up to 2% of a company’s annual income.

With the increasing reliance on online platforms in Indonesia, which are vulnerable to data breaches, the establishment of the PDP Agency is eagerly anticipated. Businesses are expected to receive more guidance on compliance with the PDP Law, and the agency’s enforcement is expected to enhance data protection for individuals. (5 June 2024)

WRITTEN BY

For further information, please contact:

Winnie Yamashita Rolindrawan – SSEK,
winnierolindrawan@ssek.com

Winnie Yamashita Rolindrawan - SSEK. Winnie Yamashita Rolindrawan holds a Bachelor of Laws in economic law from the University of Indonesia and a Master of Science in communications management. She also earned an LL.M. and a Business Law Certificate from UC Berkeley.

Winnie Yamashita Rolindrawan received her Bachelor of Laws in economic law from the University of Indonesia in 2002. In 2007, she earned her Master of Science from the Faculty of Social and Political Sciences at the same university, majoring in communications management. In 2016, Winnie received her Master of Laws (LL.M.) from the University of California, Berkeley, School of Law, where she also earned a Business Law Certificate from the Berkeley Center for Law and Business.

Winnie joined SSEK in 2007 and has represented major domestic firms and multinational companies in a variety of transactions. She has worked on numerous projects involving M&A, financial services and fintech, data privacy, pharmaceuticals and healthcare, corporate and commercial matters, foreign investment, e-commerce, and real estate and property (particularly hotels).

Her projects in the fintech sector include acting as Indonesian counsel to Didi Chuxing in the acquisition of a substantial stake in Grab Inc., a transaction valued at over US$1 billion, and acting as lead Indonesian counsel to Mastercard as the lead investor in the series B funding round of Digiasia, an Indonesian fintech startup. Winnie advises clients on all aspects of fintech and payment systems (including e-money, remittances, payment gateways and switching), from obtaining the relevant licenses to cross-border fintech M&A transactions and navigating complex regulatory, legal and commercial challenges to ensure compliance with the relevant fintech and payment system regulations of Indonesia’s Financial Services Authority (OJK) and Central Bank (Bank Indonesia).

In the healthcare sector, Winnie has represented pharmaceutical companies, including manufacturers and distributors, in providing practical solutions for their day-to-day operations, corporate and commercial contracts, and specific regulatory issues.

Prior to joining SSEK, Winnie worked at another prominent corporate law firm in Jakarta, where she was involved in various capital market transactions including IPOs, bond issues and rights issues. She helped handle several debt restructuring projects involving the Indonesian Bank Restructuring Agency (IBRA), an independent government agency established in response to the Indonesian financial crisis.

Winnie was also an associate procurement expert for an Asian Development Bank-Indonesian Ministry of National Development Planning (Bappenas) project, where she developed and drafted model national procurement documents.

Winnie is a licensed attorney and a member of the Indonesian Advocates Association (Peradi). She participated in the 2014 Academy of American and International Law, sponsored by the Southwestern Institute for International and Comparative Law in Dallas, Texas.

Having spent her childhood in Hamburg, Germany, she speaks German in addition to English and her native Indonesian.

Register for your monthly Asia legal updates from Conventus Law

Error: Contact form not found.

RELATED ARTICLES