Cross-Border Data Transfer in Indonesia 2023

In practice, however, the coordination requirement with the MOCI is rarely implemented because it relies heavily on the ESP’s awareness of the requirement and its willingness to comply.

Under the PDP Law, “Data Controller” is defined as any person, public entity, or international organisation acting individually or jointly in determining the objectives and exercising control over the processing of personal data. “Data Processor” is defined as any person, public entity, or international organisation acting individually or jointly to process personal data on behalf of the Data Controller.

Under the PDP Law, “Data Controller” is defined as any person, public entity, or international organisation acting individually or jointly in determining the objectives and exercising control over the processing of personal data. “Data Processor” is defined as any person, public entity, or international organisation acting individually or jointly to process personal data on behalf of the Data Controller.

The PDP Law defines “transfer” as the displacement, delivery, and/or duplication of personal data both electronically and non-electronically from the Data Controller to another party.

Article 56 of the PDP Law allows Data Controllers to transfer personal data to other Data Controllers and/or Data Processors outside the jurisdiction of the Republic of Indonesia. In conducting a cross-border personal data transfer, the Data Controller is obligated to ensure any of the following:

1. the jurisdiction where the recipient is located must have an equivalent or higher data protection standard than the PDP Law;
2. there is adequate and binding personal data protection; or
3. the valid consent of the data subject for the transfer has been obtained.

A Data Processor is also allowed to transfer personal data to another Data Processor (onward transfer), provided that such transfer is approved by the Data Controller. If the Data Controller fails to fulfill one of the above obligations under Article 56 of the PDP Law, it may be subject to administrative sanctions, including written warning, temporary suspension of personal data processing activities, deletion or destruction of personal data, and/ or administrative fines.

Further provisions on these requirements are expected to be regulated in an implementing regulation, i.e. a Government Regulation. Until such implementing regulation is enacted, there are unanswered questions on the fulfillment of the obligations under Article 56 of the PDP Law and the procedure to demonstrate such compliance.

Comparison With The GDPR

The requirements for cross-border data transfer under the PDP Law are similar to the requirements under the GDPR. Under the GDPR, cross-border data transfer may be allowed if the jurisdiction in which the recipient is located is deemed to provide an adequate level of data protection based on the adequacy decision; the data exporter puts in place appropriate safeguards; or a derogation or exemption applies.

The EU Commissioner provides a list of countries that are considered to have adequate protection, which means that data transfers to these countries will not require any specific authorisation. If the recipient country is not included in the list, EU member states must ensure that the recipient country has in place appropriate safeguards, which will also be subject to each state’s authorisation of a Data Protection Authority (DPA). This includes the existence of binding agreements between public authorities. In the absence of the first two requirements, i.e. adequacy decision and appropriate safeguards, certain derogations, including by way of the consent of the data subject, may be used as the basis to conduct the cross-border data transfer.

Closing Remarks