Articles 57-73 of UU PDP establish comprehensive enforcement and sanctions regime. Article 57 Administrative Sanctions: violations may result in (a) written warning; (b) temporary suspension of processing activities; (c) deletion or destruction of personal data; (d) administrative fine up to maximum 2 percent of annual revenue or annual receipts during preceding fiscal year (similar to GDPR Art 83 Tier 2 + India DPDP INR 200 crore for similar offences). Article 58 Lembaga PDP: separate Personal Data Protection Agency to be established by Presidential Regulation as an independent statutory body responsible for protection enforcement. Functions: (a) policy formulation + implementation oversight; (b) registration of Controllers/Processors/DPOs; (c) breach handling + complaint resolution; (d) inquiry + investigation + adjudication; (e) cooperation with international DPAs and DPA networks (e.g. APPA Asia Pacific Privacy Authorities); (f) audit + certification + adequacy assessments; (g) public education + transparency. Transitional: until Lembaga PDP fully operational + Kemkominfo continues to handle enforcement per existing authority. Articles 67-73 Criminal Sanctions: most stringent in ASEAN region: Article 67 - illegal personal data collection or processing without right - imprisonment up to 5 years or fine up to IDR 5 billion; Article 68 - illegal disclosure of personal data not belonging to person - imprisonment up to 4 years or fine up to IDR 4 billion; Article 69 - illegal use of personal data not belonging to person - imprisonment up to 5 years or fine up to IDR 5 billion; Article 70 (forging personal data + 6 years + IDR 6 billion); Article 71 (selling/exchanging illegally obtained personal data + 6 years + IDR 6 billion); Article 72 (creating fake personal data + IDR 6 billion + 6 years); Article 73 (illegal disclosure of personal data abroad). Corporate Liability: corporations subject to fines up to 10 times maximum individual fine + additional penalties including suspension of corporate activities + revocation of permits + dissolution. Article 65 Civil Liability + Damages Claims: Data Subjects may file civil lawsuit for damages caused by violations of UU PDP through district court + class actions permitted. Coordinates with GDPR Arts 83 + 84 + India DPDP Sec 18-42 + Indonesian Criminal Code + Indonesia Anti-Corruption Law + UU ITE Electronic Information and Transactions Law + OJK financial sanctions + BSSN cyber sanctions. Indonesia PDP Art 57-73 Enforcement + Sanctions applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.