Law note · Indonesia

Law on Personal Data Protection, biometric data definition

cite Law No. 27 of 2022 on Personal Data Protection, Article 4(2)(b) and its official elucidation stage IN FORCE in force since 2022-10-17 kind Biometric privacy binds private bodies reviewed 2026-08-29

What it requires

An app that derives a faceprint, voiceprint, or other biometric identifier from an individual in Indonesia must treat it as specific personal data under Article 4 and obtain the stricter consent Article 21 requires for that category.

When LexLint raises it

processes_biometrics
processes_voice
trains_models
crawls_web

Excludes recording-derived identifiers: No

What we found

Article 4 distinguishes specific personal data (the sensitive category) from general personal data, listing biometric data among health data, genetic data, criminal records, children's data, and personal financial data. The official elucidation to Article 4(2)(b) defines biometric data as data relating to a person's physical, physiological, or behavioral characteristics enabling unique identification, naming a facial image expressly as an example alongside fingerprint, retinal, and DNA data.

A direct search for suara (voice) in the elucidation returned zero hits, so voiceprint coverage rests on the general definitional language rather than an express example. As specific personal data, biometric data processing requires stricter consent under Article 21 and related provisions.

Primary source

government (.go.id) legal-documentation network mirror

← Back to the example · Lint your app →