🇮🇩Law No. 27 of 2022 on Personal Data Protection
Law No. 27 of 2022 on Personal Data Protection
The Law provides national rules for processing grounds, consent, data-subject rights, security, accountability, processors, privacy officers, impact assessments, breach notification and transfers.
Core controller and processor duties
Grounds and transparency: Article 20 lists consent, contract, legal obligation, vital interests, public task and legitimate interests. Articles 21-24 prescribe information and consent requirements.
Rights and lifecycle: Articles 5-16 provide information, access, correction, deletion, withdrawal, objection and portability-related rights. Articles 40-45 govern stopping, restricting, ending, deleting and destroying data.
Risk and security: Article 34 requires an impact assessment for listed high-risk processing. Articles 35-39 require technical and operational safeguards, confidentiality, supervision and prevention of unlawful access.
Incidents: Article 46 requires written notice to affected data subjects and the institution no later than 3 x 24 hours, with the exposed data, timing and circumstances, and response and recovery measures.
Processors, officers and transfers: Articles 51-54 regulate instructions, sub-processors and privacy-officer triggers. Article 56 uses an equivalence, binding-protection and consent hierarchy for overseas transfers.
Article 58 requires an institution designated by the President. Official July 2026 material said the implementing presidential regulation and independent authority were still being finalised, so procedures dependent on that institution require a current-status check.