Indonesia PDP Law
Indonesia PDP Controller Obligations (Art 20-46)

Indonesia PDP Law IDPdp-Controller-DPO-ROPA-DPIA-PrivacyByDesign-Art20to46-Accuracy-Accountability: Indonesia PDP Articles 20-46 + Controller Obligations + DPO Appointment + ROPA + DPIA + Privacy by Design + Accuracy + Accountability + Risk Assessment + Documentation

Articles 20-46 of UU PDP impose comprehensive obligations on Personal Data Controllers. Article 20: Personal Data Controller shall be accountable for personal data processing carried out by the Controller and demonstrate compliance with UU PDP. Article 21: Personal Data Controller shall conduct personal data processing in accordance with the purposes notified + lawful basis + consent obtained. Article 22: Personal Data Controller shall ensure accuracy + completeness + clarity of personal data processed + correct inaccuracies upon Data Subject request + or where becomes aware. Article 23: Personal Data Controller shall ensure personal data security through reasonable + appropriate technical + organisational + and physical security measures including data security policies + encryption + access controls + audit logging + secure development + incident response capability. Article 24: Personal Data Controller shall demonstrate compliance through documentation including (a) Records of Processing Activities (ROPA); (b) Data Protection Impact Assessment (DPIA) for high-risk processing; (c) audit reports; (d) training records; (e) DPO contact info. Article 35: Personal Data Controller shall implement Privacy by Design and Default + integration of personal data protection into system design + product development + business processes from the outset. Articles 36-37 Data Protection Officer (DPO): Controller and Processor shall appoint a DPO (Pejabat Pelindung Data Pribadi) where (a) the Controller processes personal data for public services purposes; (b) the core activities require regular and systematic monitoring of personal data on a large scale; (c) the core activities include large-scale processing of Specific Personal Data (sensitive) + criminal data. DPO Requirements: independent + reports to highest management level + protected from dismissal/penalty for performing duties + contact info published + Bahasa Indonesia capability + sufficient knowledge of personal data protection + sufficient resources + may be staff member or external. Article 38 Indonesian Representative: foreign Personal Data Controllers + Processors processing personal data of Indonesian residents shall appoint a Personal Data Protection Representative based in Indonesia (similar to GDPR Art 27). Article 45 DPIA: Personal Data Controllers shall conduct DPIA where processing presents heightened risk including (a) large-scale Specific Personal Data; (b) systematic monitoring of public areas; (c) automated decision-making with legal effects; (d) processing of children data; (e) cross-border transfer. Article 46 ROPA: comprehensive Records of Processing Activities including categories + purpose + lawful basis + recipients + retention + TOMs + cross-border + DPIA outcomes. Coordinates with GDPR Arts 24 + 25 + 30 + 35 + 37-39 + India DPDP Sec 8 + 10 + Singapore PDPA + ISO 27701 PIMS + NIST Privacy Framework. Indonesia PDP Art 20-46 Controller Obligations applies.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 155 controls across 56 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 8 controls

  • CH-FADP-19 Transparency and proactive information
  • CH-FADP-21 Data protection impact assessments
  • CH-FADP-22 Privacy by design and default
  • CH-FADP-23 Data processing agreements
  • CH-FADP-24 Cross-border transfer safeguards
  • FADP-16 FDPIC Independence and Functions
  • FADP-7 Data Protection Impact Assessment (Articles 9-10)
  • FADP-9 Data Protection Advisor (Articles 14-15)

Iowa Consumer Data Protection Act · 5 controls

Bahrain PDPL · 4 controls

Indiana Consumer Data Protection Act · 4 controls

  • INCDPA-Controller-PrivacyNotice-PurposeLimitation-DataMinimisation-Transparency-LawfulBasis Indiana CDPA Controller Obligations - Privacy Notice + Purpose Limitation + Data Minimisation + Transparency + Lawful Basis + Reasonable + Adequate + Relevant + Limited to What is Necessary
  • INCDPA-Processor-Contracts-DPA-Subprocessor-Audit-Confidentiality-EndOfContract Indiana CDPA Processor Contracts - Data Processing Agreement (DPA) + Required Provisions + Subprocessor Approval + Confidentiality + End of Contract Deletion + Audit Rights + Assistance
  • INCDPA-Security-ReasonablePractices-Breach-Notification-Records-Encryption-Pseudonymisation Indiana CDPA Security + Reasonable Practices + Breach Notification + Indiana Breach Notification Law (IC 24-4.9) + Records + Encryption + Pseudonymisation + De-Identification
  • INCDPA-SensitiveData-Children-Consent-COPPA-DataProtectionAssessment-DPIA Indiana CDPA Sensitive Data + Consent for Sensitive Categories + Children Under 13 + COPPA Coordination + Data Protection Assessment (DPA) + High-Risk Processing

Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018) · 3 controls

  • AT-DSG-10 Section 29 - Liability and right to compensation / civil jurisdiction
  • AT-DSG-12 Section 62 - Administrative penalties
  • AT-DSG-7 Section 18 - Establishment of the Data Protection Authority

BSI IT-Grundschutz · 3 controls

  • BSI-13 Risk assessment procedures
  • BSI-15 Security categorization
  • BSI-17 Continuous monitoring strategy

Barbados Data Protection Act 2019 · 3 controls

  • BB-DPA-1 Section 1 - Short Title
  • BB-DPA-20 Sections 50-60 - Registration and Responsibilities
  • BB-DPA-4 Section 4 - Principles Relating to Processing

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 3 controls

  • UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10)
  • UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21)
  • UAE-PDPL-FreeZones Coordination with DIFC, ADGM and sectoral data protection regimes

GDPR · 3 controls

IEEE 7000 · 3 controls

  • IEEE7000-EthicalRisk-Identification-Analysis-Treatment-ValidationOutcomes IEEE 7000 Clauses 8 + 8.1 + 8.2 - Ethical Risk Identification + Analysis + Treatment + Validation of Ethical Outcomes + AI Safety + Robustness + Adversarial Protection
  • IEEE7000-Operations-Lifecycle-OngoingMonitoring-Incident-Decommissioning IEEE 7000 - Operations + Lifecycle + Ongoing AI Risk Monitoring + Data Provenance + Retention + Privacy + Safe Deployment + Decommissioning + Disposal
  • IEEE7000-Values-Elicitation-Prioritisation-IEEE7000Family-Bias-Privacy-Transparency IEEE 7000 Clauses 6 + 6.1 - Ethical Values Elicitation + Prioritisation + IEEE 7000 Family Integration (Bias + Privacy + Transparency + Wellbeing)

ISO/IEC 27011:2024 · 3 controls

  • 27011-5.2 Information Security Roles in Telecoms
  • 27011-6.3 Awareness and Training
  • 27011-8.6 Data protection and backup

ISO/IEC 29134:2023 · 3 controls

  • 29134-1 Scope
  • 29134-3 Terms and definitions
  • 29134-9.1 PIA report structure

Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018) · 3 controls

Nevada Gaming Control Board Cybersecurity Requirements · 3 controls

  • NGCB-1 Regulation 5.260 Scope, Applicability, and Licensee Categories
  • NGCB-5 Technical Security Controls - Access + Network + Encryption + Vulnerability + Logging
  • NGCB-8 Annual Independent Cybersecurity Assessment + Reporting + Board Oversight

Privacy Act 1988 (Australia) · 3 controls

  • AUPRV-1 APP 1 Open and Transparent Management + Privacy Management Framework
  • AUPRV-6 Sensitive Information, PIA, Privacy by Design, Children
  • AUPRV-8 OAIC Cooperation, Vendor Management, Training, Complaints, Enforcement

API 1164 · 2 controls

  • API1164-07 Remote Access
  • API1164-24 Vulnerability assessment for critical systems

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 2 controls

  • AWWA-1.2 Risk Assessment
  • AWWA-3.4 Encryption and Data Protection

Albania Law No. 124/2024 on Personal Data Protection · 2 controls

  • AL-DPA-14 Direct Marketing
  • AL-DPA-7 Right of Access

Azerbaijan Law on Personal Data (2010) · 2 controls

  • AZ-DPA-15 Article 17 - Dispute resolution
  • AZ-DPA-6 Article 6 - State regulation in personal data protection

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition) · 2 controls

  • DIQ-2 Data Quality Management
  • DIQ-3 Metadata Management

Ecuador Ley Orgánica de Protección de Datos Personales (LOPDP) · 2 controls

  • LOPDP-EC-Cross-Border-Transfers-Articles-59-65-Adequacy-SCC-BCR-EU-Schrems-LatAm-CBPR-Andean-Community Ecuador LOPDP Cross-Border + Articles 59-65 + Adequacy + Andean Community + LatAm
  • LOPDP-EC-Governance-DPO-ROPA-DPIA-Privacy-by-Design-Training-Articles-46-58-Compliance-Monitoring Ecuador LOPDP Governance + DPO + ROPA + DPIA + Privacy by Design + Training

French Sapin II Law (Law No. 2016-1691) · 2 controls

  • Sapin2-Pillar3-Risk-Mapping Pillar 3 - Corruption Risk Mapping (Cartographie des Risques)
  • Sapin2-Pillar4-ThirdParty-DueDiligence Pillar 4 - Third-Party Due Diligence (Clients, Suppliers, Intermediaries, M&A)

German Supply Chain Due Diligence Act (LkSG) · 2 controls

ICAO Annex 17 - Aviation Security (AVSEC) · 2 controls

  • ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18)
  • ICAO-ANX17-Chap4-Cargo-Mail-Catering-Stores-Supplies-RegulatedAgent-KnownConsignor ICAO Annex 17 Chapter 4 - Cargo + Mail + Catering + Stores + Supplies Security + Regulated Agent + Known Consignor + Supply Chain

IEEE 1686 · 2 controls

  • IEEE1686-IR-Recovery-Reporting-Exercises-Drills-RECOV IEEE 1686 - Incident Response + Recovery from Failed Update + Reporting to Authorities + Coordination with Sector-Specific Agencies + Exercises and Drills
  • IEEE1686-Section5.1-AccessControl-Accounts-Roles-Password-Session-Remote IEEE 1686 Section 5.1 - Electronic Access Account Management + Roles + Password + Failed Login + Session + Remote Access + Personnel

ISO/IEC 27400:2022 · 2 controls

  • 27400-7.1 Network Security for IoT
  • 27400-7.4 Data retention and deletion

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 2 controls

  • 27557-4.3 Individual impact consideration
  • 27557-6.3 Privacy risk assessment

Italy Personal Data Protection Code (Legislative Decree No. 196/2003, amended 2018) · 2 controls

  • ItalyCodice-Garante-Enforcement-AdministrativeSanctions-Criminal-Art166-167-170-20MEUR-Coord-EDPB Italy Codice Garante Authority + Article 140-bis + Article 144 Complaints + Article 166 Administrative Sanctions up to EUR 20M/4% + Article 167 Criminal Offences + Article 170 Failure to Comply with Garante Orders + EDPB Coordination
  • ItalyCodice-ePrivacy-Cookies-ElectronicCommunications-Telemarketing-PublicOpposition-TrafficDataRetention-Art121-122-130-132 Italy Codice ePrivacy - Article 121 Electronic Communications + Article 122 Cookies and Tracking + Article 130 Unsolicited Direct Marketing + Article 132 Traffic Data Retention + Italian Public Opposition Register (Registro delle Opposizioni)

PCAOB AS 2201 - Audit of Internal Control Over Financial Reporting (ICFR) · 2 controls

  • ASTWO-1 Audit Planning, Scaling, Risk Assessment, and Integration
  • ASTWO-3 Entity-Level Controls and Period-End Financial Reporting Process

Pakistan Personal Data Protection Bill 2023 · 2 controls

  • PAKPDPB-6 Cross-Border Transfer and Data Localization
  • PAKPDPB-7 NCPDP, Registration, Records, Processor Contracts, DPO

SQF Code Edition 9 - Safe Quality Food · 2 controls

  • 2.4.4 Hazard Analysis and Risk Assessment
  • 2.7.2 Food Fraud Plan

UAE Virtual Asset Regulatory Authority (VARA) Regulations · 2 controls

  • CRM-1 AML/CFT Compliance
  • CRM-4 Business Risk Assessment

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers · 2 controls

  • D.1 Incident Response Planning
  • UKDEFSTD-1 Cyber Defence Cyber Risk Profile (CRP)

US Consumer Product Safety Act (CPSC) Manufacturer and Importer Duties · 2 controls

  • CPSC-CS.3 Data Protection for Safety Systems
  • CPSC-RA.3 Lifecycle Risk Assessment

US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule · 2 controls

Vermont Data Privacy and Online Surveillance Act · 2 controls

  • VERMONTAICDA-3 Bias Testing, Discrimination Prevention, Transparency
  • VERMONTAICDA-4 Vermont AG Enforcement and Cure

AML/CTF Act 2006 (Australia) · 1 control

  • AMLCTF-PartA-RiskAssess ML/TF Risk Assessment

APRA CPS 230 Operational Risk Management · 1 control

  • CPS230-11 Identification, Assessment and Management of Operational Risk

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-27 Outbound data loss prevention (Very Good)

ASIS SPC.1-2009 - Organizational Resilience Standard · 1 control

  • 4.3.1 Risk Assessment and Impact Analysis

Annex 11 to EU GMP - Computerised Systems · 1 control

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 1 control

  • CPG-3.C Strong and Agile Encryption

FBI CJIS Security Policy · 1 control

  • CJIS-17 Risk Assessment

FTC GLBA Safeguards Rule (16 CFR Part 314) · 1 control

  • FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c))

Florida Digital Bill of Rights (FDBR) · 1 control

  • FDBR-ControllerObligations-DPA-Notice Controller + Processor Obligations + Data Protection Assessments (Fla. Stat. 501.707, 501.708, 501.71, 501.711)

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) · 1 control

IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.4) · 1 control

  • IMO-MSC-FAL-Identify-AssetInventory-ThreatsVulnerabilities-CyberRiskAssessment-RolesResponsibilities IMO MSC-FAL Identify Function - OT/IT Asset Inventory + Threats + Vulnerabilities + Cyber Risk Assessment + Roles and Responsibilities + Crew + CSO + DPA

ISO/IEC 27031:2011 · 1 control

  • 27031-7.2 Resource Requirements

ISO/IEC 29147:2018 · 1 control

  • 29147-5.11 Researcher Safe Harbour and Legal Posture

Law No. 172-13 on the Protection of Personal Data · 1 control

  • DOM172-Supervisory-Authority-Cooperation-Sanctions-Penalties-Articles-77-79-Awareness-Training-Retention-DPO-Designation Dominican Republic Law 172-13 Supervisory Authority + Sanctions + Articles 77-79 + DPO + Awareness

Law on Personal Data Protection (Official Gazette No. 42/2020) · 1 control

Regulation on the European Health Data Space (EHDS) · 1 control

  • EHDS-HOLD-3 Dataset Descriptions and Catalogues

Russia Federal Law on Personal Data (152-FZ) · 1 control

  • RUSPD-4 Special Categories, Biometric Data

Singapore AI Governance Framework · 1 control

  • AIGF-1.3 Data Management

South Korea PIPA · 1 control

  • PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33

Vietnam Law on Cybersecurity (No. 116/2025/QH15) · 1 control

  • VIETNAMCYBER-4 Incident Reporting and Cooperation

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 155 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Indonesia PDP Law controls