Law note · Indonesia

Law on Personal Data Protection, breach notification

cite Law No. 27 of 2022 on Personal Data Protection, Article 46 stage IN FORCE in force since 2022-10-17 kind Breach notification binds private bodies reviewed 2026-08-29

What it requires

An app that suffers a failure of personal data protection affecting an individual in Indonesia must give written notification within 72 hours to the affected individual and to the supervisory institution, describing the data disclosed and the remedial measures taken.

When LexLint raises it

processes_biometrics
processes_voice
crawls_web

What we found

Article 46(1) requires a Personal Data Controller to give written notification no later than 3 times 24 hours (72 hours) to the personal data subject and to the supervisory institution on a failure of personal data protection. The notification must at minimum describe the data disclosed, when and how it was disclosed, and the controller's handling and recovery efforts; in certain cases the controller must also notify the public.

Primary source

government (.go.id) legal-documentation network mirror

← Back to the example · Lint your app →