Articles 5-15 of UU PDP grant Data Subjects 9 core rights. Article 5: right to obtain information regarding identity of Personal Data Controller + legal basis + purpose + accountability party representing Personal Data Controller. Article 6: right to receive + obtain complete information about personal data being processed + the processing carried out + the consequences of personal data processing. Article 7: right to update + correct errors or inaccuracies of personal data within a reasonable timeframe. Article 8: right to obtain access to personal data + receive copy. Article 9: right to terminate processing + delete + or destroy personal data subject to other applicable laws. Article 10: right to revoke consent. Article 11: right to object to decision-making actions based on automated processing including profiling that has legal effects or substantial similar effects on the Data Subject. Article 12: right to delay or restrict personal data processing as proportionate to the purpose of personal data processing. Article 13: right to file lawsuit and receive compensation for violations of personal data protection. Article 14: right to obtain and use personal data + transfer personal data to other Personal Data Controllers as long as supporting systems for personal data are interoperable (portability). Article 15: right exemptions for personal data processing for (a) defence + security; (b) law enforcement processes; (c) public interest; (d) financial services supervision; (e) statistics + scientific research where pseudonymisation/de-identification applied. Response Timelines: per implementing regulations Controller shall respond to Data Subject rights requests within reasonable period typically 3 working days from receipt + may extend with notification + rejection requires written justification + Data Subject right to file complaint with DPA. Identity Verification: Controller may verify Data Subject identity through Indonesian ID (KTP) or alternative documentation. Free of Charge: rights exercises shall be free of charge once per reasonable period. Coordinates with GDPR Arts 15-22 + India DPDP Sec 11-14 + Singapore PDPA + Malaysia PDPA + Indonesia consumer protection law. Indonesia PDP Art 5-15 Data Subject Rights applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.