Every company processes personal data.

Employees provide identification and payroll information. Customers submit names, phone numbers, email addresses, delivery addresses, and transaction details. Website visitors may provide account information. Vendors exchange contact details. Mobile applications may collect user and device information.

For many businesses, personal data has become an essential part of daily operations.

But personal data is not simply an IT asset.

In Indonesia, protecting personal data is also a legal compliance, contractual, governance, and corporate risk management responsibility.

The central legal framework is Law No. 27 of 2022 on Personal Data Protection (Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi or “UU PDP”). The law regulates personal data processing, data-subject rights, the obligations of Pengendali Data Pribadi and Prosesor Data Pribadi, data transfers, administrative sanctions, and other matters relating to personal data protection.

This means that companies cannot treat data protection as a matter exclusively for the IT department.

A company may have strong cybersecurity tools and still have weaknesses in its legal compliance framework.

The critical question is: Does the company have a legally appropriate system for collecting, using, storing, sharing, protecting, retaining, and deleting personal data?

This article explains the key personal-data protection obligations businesses should understand and the legal risks that may arise when personal data is improperly handled or exposed.

Why Is Personal Data Protection a Legal Issue for Companies?

Personal data protection is a legal issue because companies that process personal data may have statutory obligations under the UU PDP.

These obligations can involve:

• establishing an appropriate legal basis for processing;
• providing information to data subjects;
• respecting data-subject rights;
• maintaining data security;
• controlling access to personal data;
• managing third-party processors;
• establishing retention practices;
• handling data transfers;
• documenting compliance; and
• responding to personal-data breaches.

Consider a simple example.

An e-commerce company collects customer names, telephone numbers, email addresses, delivery addresses, and transaction information.

The company stores this information using a third-party cloud-based SaaS provider.

One day, the company discovers that unauthorized parties have accessed the database.

The company might immediately argue: The SaaS provider was hacked, so the provider is responsible.

That conclusion cannot simply be assumed.

The company must examine its legal role, the role of the SaaS provider, the contractual relationship between them, the nature of the affected data, the circumstances of the incident, and the applicable notification and remediation obligations.

Under the UU PDP, a Pengendali Data Pribadi generally determines the purposes and exercises control over personal-data processing, while a Prosesor Data Pribadi processes personal data on behalf of the controller.

This distinction is particularly important for companies using:

• cloud services;
• SaaS platforms;
• CRM systems;
• payroll providers;
• marketing platforms;
• payment providers;
• analytics services; and
• outsourced IT services.

What Is Personal Data Under Indonesian Law?

The UU PDP broadly distinguishes between general personal data and specific personal data.

General personal data includes information such as:

• full name;
• gender;
• nationality;
• religion;
• marital status; and
• personal data combined with other information that can identify an individual.

Specific personal data includes categories such as:

• health information;
• biometric data;
• genetic data;
• criminal records;
• children’s data;
• personal financial data; and
• other categories determined by applicable laws.

The distinction matters because some categories of personal data present greater risks and require careful handling.

For a company, the first step should therefore be straightforward: Identify what personal data the business actually processes.

Without a proper data inventory, a company may not know what it needs to protect, why it processes the data, who can access it, or how long it should retain it.

What Are the Main Personal Data Protection Obligations for Companies?

Companies acting as Pengendali Data Pribadi have significant responsibilities under the UU PDP.

One of the most important is establishing a lawful basis for processing personal data.

The UU PDP recognizes several legal bases, including:

1. valid explicit consent;
2. performance of a contract or steps taken at the request of the data subject before entering into a contract;
3. compliance with a legal obligation;
4. protection of vital interests;
5. performance of a task in the public interest or exercise of lawful authority; and
6. certain legitimate interests, subject to the requirements of the law.

Therefore, consent is not the only legal basis for processing personal data.

Companies should not automatically assume that every processing activity requires a consent checkbox.

The appropriate legal basis depends on the purpose and circumstances of the processing.

At the same time, where consent is relied upon, the company must ensure that the consent satisfies the requirements of the UU PDP.

Personal Data Protection Areas Companies Should Review

Employee Personal Data

Employees are one of the most important sources of personal data for almost every organization.

An HR department may process:

• identification information;
• home addresses;
• telephone numbers;
• email addresses;
• bank-account information;
• tax information;
• employment history;
• attendance information;
• performance records;
• health-related information; and
• emergency-contact information.

Companies should know why each category is collected and processed.

They should also determine:

• who can access the information;
• how access is controlled;
• how long the information is retained;
• which vendors receive the information;
• where it is stored; and
• when it should be deleted or destroyed.

Employee data should not automatically be treated as unrestricted internal information.

For example, there may be no legitimate operational reason for every employee to access payroll records or sensitive HR information.

Customer Personal Data

Customer data is often one of the most significant categories of personal information for consumer-facing companies.

Depending on the business model, this may include:

• names;
• telephone numbers;
• email addresses;
• delivery addresses;
• identification information;
• account information;
• purchase history;
• customer preferences;
• complaints;
• location information; and
• financial information.

A company should distinguish between the purpose for which information was originally collected and any later use.

For example, a customer may provide a telephone number to facilitate delivery.

That does not automatically mean the company can use the same number for every possible marketing activity.

The company should assess the applicable legal basis, purpose, transparency requirements, and other relevant obligations before using personal data for additional purposes.

Vendor and Business Partner Data

Companies sometimes focus heavily on customer data and overlook information relating to vendors and business partners.

Businesses may process personal data belonging to:

• supplier representatives;
• consultants;
• contractors;
• vendor employees;
• business owners;
• delivery personnel; and
• professional advisers.

The fact that someone interacts with the company in a professional capacity does not automatically mean that information about them falls outside the scope of personal data.

Companies should therefore include vendor and business-partner information in their overall data inventory and compliance framework.

Website and Application Data

Digital businesses should also examine the personal data collected through their websites and applications.

This may include:

• registration information;
• account details;
• IP addresses;
• device information;
• location information;
• cookie-related information;
• usage information;
• transaction records; and
• customer-support information.

The company should be able to answer four basic questions:

What data do we collect?

Why do we collect it?

How do we use it?

Who receives it?

These questions become particularly important where a website or application uses third-party services such as analytics tools, advertising platforms, payment systems, cloud infrastructure, authentication services, or CRM platforms.

Is Consent Always Required?

No.

Under the UU PDP, consent is one possible legal basis for processing personal data, but it is not the only one.

Where consent is used, however, it must meet the requirements for valid explicit consent.

Companies should consider:

• what purpose the consent covers;
• what information is provided to the data subject;
• how consent is obtained;
• whether the company can demonstrate that consent was obtained;
• whether consent can be withdrawn; and
• what happens after withdrawal.

A privacy checkbox alone does not automatically create a compliant privacy framework.

Companies should also avoid collecting excessive consent simply because it appears convenient.

The legal basis should correspond to the actual purpose and circumstances of processing.

What Happens When a Company Uses a SaaS or Cloud Provider?

This is one of the most important issues in modern data protection compliance.

Consider this hypothetical situation:

A company operates an online platform and stores customer data using a SaaS provider.

The SaaS provider experiences a cybersecurity incident and unauthorized parties gain access to the database.

Who is legally responsible?

The answer depends on the actual relationship and roles of the parties.

If the company determines the purposes of processing and the SaaS provider processes personal data on the company’s behalf, the company may act as the Pengendali Data Pribadi, while the SaaS provider may act as the Prosesor Data Pribadi.

The company should therefore not assume that outsourcing data processing automatically transfers all legal responsibilities to the vendor.

Contracts with processors should address relevant matters such as:

• processing instructions;
• confidentiality;
• security obligations;
• access controls;
• subcontractors and sub-processors;
• incident notification;
• cooperation during investigations;
• deletion or return of data;
• audit rights;
• retention; and
• applicable data-transfer arrangements.

This is why data protection should be incorporated into technology contracts and vendor-management processes.

How Long Can Companies Keep Personal Data?

Companies should not retain personal data indefinitely without considering the purpose and applicable legal requirements.

A useful compliance question is: Why are we still keeping this information?

The UU PDP establishes obligations concerning the termination of processing, deletion, and destruction of personal data under specified circumstances.

Companies should therefore develop practical retention policies covering:

• employee records;
• inactive customer accounts;
• old marketing databases;
• transaction records;
• archived documents;
• system backups; and
• data stored by third-party providers.

Retention policies should be coordinated between legal, compliance, HR, IT, and relevant business teams.

Data Security Is Also a Legal Obligation

Data security is not merely a technical best practice.

The UU PDP requires a Pengendali Data Pribadi to protect and ensure the security of personal data by implementing appropriate technical and operational measures.

The company’s technical controls should therefore support its legal obligations.

Depending on the nature and risk of the processing, appropriate measures may include:

• access controls;
• authentication;
• encryption;
• logging;
• backup controls;
• vulnerability management;
• monitoring;
• incident-response procedures;
• employee awareness;
• vendor security assessments; and
• periodic security reviews.

The precise security measures should be appropriate to the organization’s circumstances and the risks associated with its processing activities.

What Are the Legal Risks of a Data Breach?

A data breach can create multiple forms of legal and business exposure.

Regulatory Risk

The UU PDP provides administrative sanctions for certain violations.

Depending on the circumstances, sanctions may include:

• written warnings;
• temporary suspension of personal-data processing;
• deletion or destruction of personal data; and
• administrative fines.

The UU PDP provides for administrative fines of up to 2% of annual revenue or annual receipts related to the relevant violation, subject to the statutory framework.

The actual consequences depend on the specific violation and applicable enforcement process.

Civil and Compensation Risk

The UU PDP establishes rights for data subjects and provides mechanisms relating to compensation and dispute resolution.

Consequently, a company should not view a data breach solely as a regulatory problem.

Depending on the circumstances, the company may also need to consider potential claims from affected individuals or other parties.

Contractual Risk

A data breach may also result in a breach of contract.

For example, a company may have contractually promised a customer or business partner that it would:

• implement specified security measures;
• maintain confidentiality;
• restrict data usage;
• notify the counterparty of security incidents; or
• comply with specific privacy requirements.

A breach can therefore trigger contractual consequences in addition to obligations under the UU PDP.

Operational and Commercial Risk

A serious incident may require the company to:

• suspend affected systems;
• investigate unauthorized access;
• preserve evidence;
• engage forensic specialists;
• notify relevant parties;
• communicate with customers;
• respond to regulators;
• restore systems; and
• implement additional security controls.

This can create substantial operational disruption.

It is therefore more accurate to view data protection as part of corporate risk management, rather than simply an IT function.

What Should a Company Do When a Data Breach Occurs?

The first priority should be to contain the incident while establishing what actually happened.

Under Article 46 of the UU PDP, where a kegagalan Pelindungan Data Pribadi occurs, the Pengendali Data Pribadi must provide written notification no later than 3 × 24 hours to the data subject and the relevant institution.

The notification must include information concerning, among other matters:

• the personal data affected;
• when and how the incident occurred; and
• the company’s response and recovery measures.

Certain circumstances may also trigger public-notification requirements.

A practical incident-response process should therefore include the following steps.

1. Contain the Incident

Limit further unauthorized access while preserving evidence.

2. Establish the Facts

Determine:

• which systems were affected;
• when the incident occurred;
• what personal data was affected;
• how the incident occurred; and
• whether unauthorized access is continuing.

3. Identify the Legal Roles

Determine whether the company is acting as Pengendali Data Pribadi, Prosesor Data Pribadi, or has another relevant role.

4. Assess Notification Obligations

Legal and compliance teams should assess the applicable notification requirements and statutory deadlines.

5. Document the Response

Record:

• decisions;
• evidence;
• communications;
• mitigation measures;
• investigation findings; and
• remediation steps.

6. Remediate

Address the underlying vulnerability and determine whether changes are required to contracts, policies, systems, controls, or governance.

The response should ideally involve management, legal, IT/security, HR, communications, compliance, and relevant vendors.

Personal Data Protection Compliance Checklist

Companies can use the following checklist as a starting point for a data-protection compliance review.

Governance

• Identify all personal-data processing activities.
• Determine whether the company acts as Pengendali Data Pribadi or Prosesor Data Pribadi.
• Assign internal responsibility for data protection.
• Establish appropriate policies and procedures.
• Maintain evidence of compliance.

Legal Basis

• Identify the legal basis for every significant processing activity.
• Review consent mechanisms where consent is relied upon.
• Define processing purposes clearly.
• Provide appropriate information to data subjects.

Data Inventory

• Identify employee data.
• Identify customer data.
• Identify vendor data.
• Identify website and application data.
• Identify sensitive or specific personal data.
• Map where personal data is stored.

Third Parties

• Identify all vendors processing personal data.
• Review SaaS and cloud agreements.
• Identify processors and sub-processors.
• Establish appropriate contractual data-protection obligations.
• Review incident-notification provisions.
• Review international data-transfer arrangements where applicable.

Security

• Implement appropriate technical and operational safeguards.
• Control access to personal data.
• Maintain appropriate security logs.
• Review backup and recovery processes.
• Conduct periodic security assessments.

Retention

• Establish retention periods.
• Delete or destroy data when legally appropriate.
• Review archived and backup data.
• Document deletion and destruction procedures.

Incident Response

• Establish a written data-breach response procedure.
• Define internal escalation procedures.
• Identify legal and technical response teams.
• Maintain an incident log.
• Establish a notification process.
• Periodically test the incident-response process.

When Should a Company Engage Legal Counsel?

A company should consider obtaining legal advice when personal-data processing is central to its business or when the company faces complex privacy and regulatory issues.

This may include:

• e-commerce companies;
• technology companies;
• SaaS businesses;
• fintech businesses;
• healthcare businesses;
• HR technology platforms;
• digital marketing companies;
• companies processing significant volumes of customer data;
• businesses processing specific personal data;
• companies transferring data internationally; and
• organizations relying heavily on third-party processors.

Legal counsel can help translate privacy requirements into a practical corporate compliance framework.

This may involve reviewing:

• privacy policies;
• consent mechanisms;
• employee documentation;
• vendor agreements;
• Data Processing Agreements;
• SaaS contracts;
• data-transfer arrangements;
• data-retention policies;
• incident-response procedures;
• internal data-protection policies; and
• corporate governance arrangements.

The UU PDP also requires certain Pengendali Data Pribadi and Prosesor Data Pribadi to appoint a person or officer responsible for the data-protection function where specified statutory criteria are met.

Companies should therefore assess their specific circumstances rather than assuming that every business automatically needs or does not need such an appointment.

Is Indonesia’s Data Protection Framework Still Developing?

Yes.

The UU PDP is already in force, but companies should continue monitoring its implementing regulations and institutional framework.

This is important because compliance should not be treated as a one-time project.

Policies, contracts, internal procedures, vendor arrangements, and incident-response mechanisms should be periodically reviewed as the Indonesian data-protection framework develops.

Companies should also consider sector-specific regulations that may impose additional requirements depending on the nature of their business.

Conclusion

Personal data protection is no longer simply an IT or cybersecurity issue. It is a legal compliance and corporate risk-management responsibility.

Every company should understand:

• what personal data it processes;
• why it processes the data;
• what legal basis applies;
• who can access it;
• where it is stored;
• which third parties receive it;
• how long it is retained; and
• what happens if the data is compromised.

A comprehensive personal data protection company framework should therefore combine legal, technical, operational, contractual, and governance measures.

The most important areas include:

• data mapping;
• lawful processing;
• transparency;
• consent where applicable;
• vendor management;
• security controls;
• data retention;
• data-subject rights;
• incident response; and
• compliance documentation.

A data breach should not be the first time a company starts thinking about privacy compliance.

The most effective approach is to establish the legal and operational framework before an incident occurs.

For businesses operating in Indonesia, proper data protection compliance can help reduce legal uncertainty, strengthen corporate governance, and improve the organization’s ability to respond when personal data is compromised.

Need Help With Data Protection Compliance?

Kairos Advocates assists businesses with Data Protection & Legal Compliance, including privacy compliance assessments, privacy policies, data-processing arrangements, vendor and SaaS agreements, internal policies, data-breach response, and other legal matters arising under the UU PDP.

Contact Kairos Advocates to assess your company’s personal-data protection framework and identify potential legal compliance risks before they become costly problems.