Articles 20-46 of UU PDP impose comprehensive obligations on Personal Data Controllers. Article 20: Personal Data Controller shall be accountable for personal data processing carried out by the Controller and demonstrate compliance with UU PDP. Article 21: Personal Data Controller shall conduct personal data processing in accordance with the purposes notified + lawful basis + consent obtained. Article 22: Personal Data Controller shall ensure accuracy + completeness + clarity of personal data processed + correct inaccuracies upon Data Subject request + or where becomes aware. Article 23: Personal Data Controller shall ensure personal data security through reasonable + appropriate technical + organisational + and physical security measures including data security policies + encryption + access controls + audit logging + secure development + incident response capability. Article 24: Personal Data Controller shall demonstrate compliance through documentation including (a) Records of Processing Activities (ROPA); (b) Data Protection Impact Assessment (DPIA) for high-risk processing; (c) audit reports; (d) training records; (e) DPO contact info. Article 35: Personal Data Controller shall implement Privacy by Design and Default + integration of personal data protection into system design + product development + business processes from the outset. Articles 36-37 Data Protection Officer (DPO): Controller and Processor shall appoint a DPO (Pejabat Pelindung Data Pribadi) where (a) the Controller processes personal data for public services purposes; (b) the core activities require regular and systematic monitoring of personal data on a large scale; (c) the core activities include large-scale processing of Specific Personal Data (sensitive) + criminal data. DPO Requirements: independent + reports to highest management level + protected from dismissal/penalty for performing duties + contact info published + Bahasa Indonesia capability + sufficient knowledge of personal data protection + sufficient resources + may be staff member or external. Article 38 Indonesian Representative: foreign Personal Data Controllers + Processors processing personal data of Indonesian residents shall appoint a Personal Data Protection Representative based in Indonesia (similar to GDPR Art 27). Article 45 DPIA: Personal Data Controllers shall conduct DPIA where processing presents heightened risk including (a) large-scale Specific Personal Data; (b) systematic monitoring of public areas; (c) automated decision-making with legal effects; (d) processing of children data; (e) cross-border transfer. Article 46 ROPA: comprehensive Records of Processing Activities including categories + purpose + lawful basis + recipients + retention + TOMs + cross-border + DPIA outcomes. Coordinates with GDPR Arts 24 + 25 + 30 + 35 + 37-39 + India DPDP Sec 8 + 10 + Singapore PDPA + ISO 27701 PIMS + NIST Privacy Framework. Indonesia PDP Art 20-46 Controller Obligations applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.