Articles 16-19 of UU PDP establish the foundational lawful processing framework. Article 16: lawful basis for processing personal data limited to (a) explicit valid consent of the Data Subject for one or more specific purposes; (b) performance of a contract to which the Data Subject is party or to take steps at the request of the Data Subject prior to entering into a contract; (c) fulfilment of legal obligations of the Data Controller; (d) protection of vital interests of the Data Subject; (e) performance of a task carried out in the public interest including for public services; (f) legitimate interests of the Data Controller or third parties (with balancing test). Six lawful bases parallel GDPR Art 6. Article 17 Notice: prior to obtaining personal data + Data Controller shall provide Data Subject with information regarding (a) legal basis for processing; (b) purposes for processing; (c) types of personal data; (d) retention period; (e) personal data details to be collected and processed; (f) period of personal data processing; (g) rights of the Data Subject; (h) personal data controller identity + business address + contact + accountability party representing the Controller in Indonesia. Notice must be in Bahasa Indonesia + clear + readily accessible. Article 18 Explicit Consent: consent must be express + delivered in writing or through audio or video or in electronic form + freely given + specific + informed + unambiguous + capable of being demonstrated + Data Subject must be informed of the right to withdraw consent + withdrawal as easy as giving consent + no penalty for withdrawal. Article 19 Purpose Limitation + Compatibility: personal data shall be processed only in accordance with the purposes notified at the time of collection or compatible purposes + further processing for incompatible purposes requires new consent or other lawful basis. Withdrawal: Article 30 details consent withdrawal mechanism + Controller must cease processing + cause processors to cease + retention only as required by other laws. Coordinates with GDPR Arts 5 + 6 + 7 + 13 + 14 + Singapore PDPA Notification of Purpose + India DPDP Sec 5 + 6 + EU Cookie/ePrivacy Directive + ASEAN MCCs + APEC CBPR. Indonesia PDP Art 16-19 Lawful Basis + Notice + Consent applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.