Does Indonesia's PDP Law require explicit consent?

Where consent is the basis it must be valid, explicit, informed and clearly recorded.

When does Indonesia's PDP Law fully apply?

The law was enacted in 2022 with a transition period running through 2024 for organizations to comply.

Indonesia

PDP Law

Personal Data Protection Law (Law 27 of 2022)

简要说明

Indonesia's PDP Law is a GDPR-inspired consent regime. Processing based on consent requires valid, explicit and informed consent recorded clearly, with stricter handling for specific categories of personal data.

地区

Indonesia

生效状态

Enacted 2022, transition through 2024

分类

亚洲与非洲

适用对象

Public and private data controllers and processors that process personal data of individuals in Indonesia, including those abroad with effects on people in Indonesia.

处罚

Administrative fines up to 2% of annual revenue, plus criminal penalties and corporate fines for unlawful collection or disclosure.

主要义务

Obtain valid, explicit and recorded consent where it is the basis
Provide clear notice of purpose and retention
Honor access, correction, erasure and objection rights
Appoint a data protection officer for certain processing
Notify breaches to the authority and affected individuals within the required time