ABLI-FPF Convergences Series - Status of Consent for Processing Personal Data (Indonesia report)

ABLI-FPF Convergences Series - Status of Consent for Processing Personal Data (Indonesia report)

Author: Dominic Paulger, Policy Manager (APAC), Future of Privacy Forum

Asian Business Law Institute and Future of Privacy Forum

July 2022

This report provides a detailed overview of relevant laws and regulations in Indonesia on

• notice and consent requirements for processing personal data;
• alternative legal bases for processing personal data which permit processing of personal data without consent if the data controller undertakes a risk impact assessment (e.g., legitimate interests); and
• statutory bases for processing personal data without consent and exceptions or derogations from consent requirements in laws and regulations.

Table of Contents 

1. INTRODUCTION 

2. CONSENT AND PRIVACY SELF-MANAGEMENT IN EXISTING LAWS AND REGULATIONS

    2.1. Law 11/2008 

    2.2. MCI 20/2016

    2.3. GR 71/2019 

    2.4. Sectoral regulations

           a. Health sector
           b. Financial sector

3. CONSENT AND PRIVACY SELF-MANAGEMENT IN THE DRAFT PERSONAL DATA PROTECTION BILL (“PDP BILL”)

4. CONDITIONS FOR CONSENT 

    4.1. Definition and forms of consent

           a. PDP Regulations 
           b. PDP Bill 

    4.2. Withdrawal of consent

           a. PDP Regulations 
           b. PDP Bill

    4.3. Bundled consent

5. CONSENT FOR SPECIAL CATEGORIES OR USES OF DATA

    5.1. Children

6. CONSENT FOR CROSS-BORDER DATA TRANSFERS

    6.1. PDP Regulations

    6.2. PDP Bill

7. TRANSPARENCY AND NOTICE

    7.1. PDP Regulations

    7.2. PDP Bill

8. SANCTIONS AND ENFORCEMENT

9. COLLECTING, USING, AND DISCLOSING DATA WITHOUT CONSENT SUBJECT TO A RISK IMPACT ASSESSMENT

10. COLLECTING, USING, AND DISCLOSING DATA WITHOUT CONSENT IN OTHER CIRCUMSTANCES DEFINED BY LAW

      10.1. PDP Regulations

      10.2. PDP Bill

      10.3. Covid-19