Indonesia Personal Data Protection Law (Undang-Undang No. 27 Tahun 2022 tentang Pelindungan Data Pribadi, UU PDP) signed into law by President Joko Widodo on 17 October 2022 + published in the State Gazette of Indonesia + becoming Indonesia first comprehensive personal data protection law. 2-year transition period from publication: full enforceability from 17 October 2024 + entities had until that date to comply with administrative + security + organisational requirements. UU PDP comprises 76 Articles organised in 16 Chapters: Chapter I General Provisions (Art 1-3) + Chapter II Types of Personal Data (Art 4) + Chapter III Rights of Personal Data Subject (Art 5-15) + Chapter IV Processing of Personal Data (Art 16-19) + Chapter V Obligations of Personal Data Controller and Processor (Art 20-46) + Chapter VI Transfer of Personal Data (Art 55-56) + Chapter VII Administrative Sanctions (Art 57-65) + Chapter VIII Institutional Framework (Art 58) DPA + Chapter IX International Cooperation (Art 56) + Chapter X Public Participation (Art 63) + Chapter XI Dispute Settlement (Art 64-65) + Chapter XII Prohibitions (Art 65) + Chapter XIII Criminal Provisions (Art 67-73) + Chapter XIV Transitional Provisions (Art 74) + Chapter XV Closing (Art 75-76). Scope: applies to (a) personal data processing within Indonesian territory; (b) personal data processing outside Indonesian territory by Indonesian personal data controllers + processors (extraterritorial for Indonesian entities); (c) personal data processing outside Indonesian territory by foreign personal data controllers + processors that has legal effect on (i) personal data subjects within Indonesian territory; or (ii) Indonesian citizens outside Indonesian territory. Definitions include: Personal Data = data about an identified or identifiable natural person individually or in combination with other information; General Personal Data + Specific Personal Data (sensitive: health + biometric + genetics + crime + child + personal finance data + other data per legislation); Data Subject (Subjek Data Pribadi); Controller (Pengendali Data Pribadi); Processor (Prosesor Data Pribadi); Specific Personal Data has elevated protections similar to GDPR sensitive data. Personal Data Protection Agency (Lembaga Pelindung Data Pribadi - Indonesian DPA): UU PDP establishes a separate Lembaga (Agency) to be established by Presidential Regulation - separate from the existing Ministry of Communication and Informatics (Kemkominfo) which currently handles personal data protection enforcement. As of 2026 the Lembaga is in establishment + transitional enforcement remains with Kemkominfo. Public availability: published in Bahasa Indonesia in State Gazette + multiple English translations widely available (IAPP + DLA Piper + Linklaters + Hogan Lovells + Tilleke and Gibbins). Coordinates with ASEAN Data Management Framework + ASEAN Model Contractual Clauses (MCCs) + Singapore PDPA (template influence) + Malaysia PDPA + Philippines DPA + Thailand PDPA + Vietnam Cybersecurity Law + APEC CBPR + GDPR + India DPDP Act + UK GDPR + Australia Privacy Act + Japan APPI + EU equivalents. Indonesia UU PDP + Scope + 17 Oct 2022 + Effective 17 Oct 2024 applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.