Articles 5-15 of UU PDP grant Data Subjects 9 core rights. Article 5: right to obtain information regarding identity of Personal Data Controller + legal basis + purpose + accountability party representing Personal Data Controller. Article 6: right to receive + obtain complete information about personal data being processed + the processing carried out + the consequences of personal data processing. Article 7: right to update + correct errors or inaccuracies of personal data within a reasonable timeframe. Article 8: right to obtain access to personal data + receive copy. Article 9: right to terminate processing + delete + or destroy personal data subject to other applicable laws. Article 10: right to revoke consent. Article 11: right to object to decision-making actions based on automated processing including profiling that has legal effects or substantial similar effects on the Data Subject. Article 12: right to delay or restrict personal data processing as proportionate to the purpose of personal data processing. Article 13: right to file lawsuit and receive compensation for violations of personal data protection. Article 14: right to obtain and use personal data + transfer personal data to other Personal Data Controllers as long as supporting systems for personal data are interoperable (portability). Article 15: right exemptions for personal data processing for (a) defence + security; (b) law enforcement processes; (c) public interest; (d) financial services supervision; (e) statistics + scientific research where pseudonymisation/de-identification applied. Response Timelines: per implementing regulations Controller shall respond to Data Subject rights requests within reasonable period typically 3 working days from receipt + may extend with notification + rejection requires written justification + Data Subject right to file complaint with DPA. Identity Verification: Controller may verify Data Subject identity through Indonesian ID (KTP) or alternative documentation. Free of Charge: rights exercises shall be free of charge once per reasonable period. Coordinates with GDPR Arts 15-22 + India DPDP Sec 11-14 + Singapore PDPA + Malaysia PDPA + Indonesia consumer protection law. Indonesia PDP Art 5-15 Data Subject Rights applies.
This control maps to 25 controls across 19 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 25 it maps to, and the evidence behind each claim, over MCP and REST.