Law note · Indonesia

Law on Personal Data Protection, enforcement and private right to sue

cite Law No. 27 of 2022 on Personal Data Protection, Articles 12, 57-58 stage IN FORCE in force since 2022-10-17 kind Enforcement supervision binds private bodies reviewed 2026-08-29

What it requires

An app processing the personal data of an individual in Indonesia risks an administrative fine of up to 2 percent of annual revenue for a violation, and an individual whose data is misused has a statutory right to sue for compensation, though both the fine-imposition and compensation-claim procedures await a Government Regulation that had not yet issued as of this research.

When LexLint raises it

crawls_web
trains_models
generates_content
deploys_chatbot
automated_outreach
high_risk_decisions
processes_voice
processes_biometrics

Private right of action: Yes

What we found

Article 12(1) gives a Personal Data Subject the right to sue and receive compensation for a violation, with the detailed procedure delegated to a Government Regulation not yet issued as of this research.

Article 57 subjects a violating controller to administrative sanctions, including written warning, temporary suspension of processing, deletion or destruction of data, and an administrative fine of up to 2 percent of annual revenue or income, with the fine-imposition procedure likewise delegated to a pending Government Regulation.

Enforcement authority sits with the not-yet-formally-established supervisory institution under Chapter IX, whose confirmed duties include compliance oversight, imposing sanctions, cross-border cooperation with peer regulators, and receiving complaints.

Primary source

government (.go.id) legal-documentation network mirror

← Back to the example · Lint your app →