Data protection
The Law's duties fall on controllers and processors, which may be individuals, public bodies or international organisations (Art. 19), but it does not apply to processing by an individual in personal or household activities (Art. 2(2)). 'Specific' data are health data, biometric and genetic data, criminal records, children's data and personal financial data; general data include full name, sex, nationality, religion and marital status (Art. 4). Processing needs a legal basis, one of which is explicit consent (Art. 20(2)); consent must be written or recorded, distinguishable from other matters and in plain Indonesian, and non-compliant consent is void (Art. 22), as is a contract clause demanding processing without valid consent (Art. 23). Children's data require the consent of a parent or guardian (Art. 25(2)).
A data subject may ask who is requesting the data and why (Art. 5), complete or correct it (Art. 6), obtain access and a copy (Art. 7), have it deleted or destroyed (Art. 8), withdraw consent (Art. 9), object to decisions based solely on automated processing including profiling (Art. 10), delay or restrict processing (Art. 11), claim damages (Art. 12) and move data to another controller (Art. 13). Requests go to the controller as a recorded application, electronic or on paper (Art. 14). The controller must correct data and give access within 3x24 hours (Arts. 30 and 32), stop processing within 3x24 hours of a withdrawal of consent (Art. 40), erase data that are no longer needed, were obtained unlawfully, or whose deletion is requested (Art. 43), and tell the data subject and the supervisory agency in writing within 3x24 hours of a failure of protection (Art. 46(1)). Defence and security, law enforcement, public administration, financial-sector supervision, statistics and scientific research are carved out of several of these rights (Art. 15).
The sanctions are layered. The agency can issue a written warning, suspend processing, order erasure or destruction and impose an administrative fine of up to 2% of annual income or revenue (Art. 57(2) and (3)); the Law leaves that agency to be set up by the President, accountable to him (Art. 58(3) and (4)), and the procedure for sanctions to a government regulation (Art. 57(5)). Disputes go to arbitration, the courts or other alternative settlement, and hearings may be closed to protect the data (Art. 64). Law No. 1 of 2026 rewrote Art. 613(3) of the Criminal Code so that, for an administrative statute carrying criminal sanctions, guidance and administrative sanctions come before criminal ones; the Law's elucidation names the Personal Data Protection Law as an example. Constitutional Court Decision No. 151/PUU-XXII/2024 of 30 July 2025 held the word 'and' in Art. 53(1)(b), which lists when a data protection officer must be appointed, conditionally unconstitutional unless read 'and/or'.
Criminal liability is separate. Unlawfully obtaining or collecting someone else's data for gain carries up to five years; unlawfully disclosing it, up to four years; unlawfully using it, up to five years, each with and/or a fine of up to category IV, Rp200 million (Art. 67); forging personal data for gain, up to six years and/or a fine of up to category V, Rp500 million (Art. 68). These fines were set at Rp4 to 6 billion in 2022 and restated by Law No. 1 of 2026 (Annex I, entry 137). The court may order forfeiture of the gains and payment of damages (Art. 69), and a corporation faces a fine of up to ten times the maximum, besides closure or suspension of business (Art. 70).
Two other texts matter online. Under the Electronic Information and Transactions Law, using someone's personal data through electronic media requires that person's consent unless a law provides otherwise, and a person whose right is violated may sue for damages (Art. 26(1) and (2)); since 2016 electronic system operators must also delete irrelevant information on a court order and offer a deletion mechanism (Art. 26(3) and (4)). For children, Government Regulation No. 17 of 2025 (27 March 2025) allows children under 13 to hold accounts only on low-risk services designed for them with parental consent, children aged 13 to 15 only on low-risk services with parental consent, and those aged 16 and 17 on other services with parental consent (Art. 21(1)).
Key points
| Statute | Law No. 27 of 2022 on Personal Data Protection, promulgated 17 October 2022 |
|---|---|
| Adjustment period | Two years from promulgation, to 17 October 2024 (Art. 74) |
| Excluded | Processing by an individual in personal or household activities (Art. 2(2)) |
| Specific data | Health, biometric, genetic, criminal records, children's data, personal financial data (Art. 4(2)) |
| Consent | Written or recorded; consent not meeting the form rules is void (Art. 22) |
| Deadlines for the controller | 3x24 hours to correct (Art. 30), give access (Art. 32) and stop processing after withdrawal (Art. 40) |
| Breach notification | Written notice to the data subject and the agency within 3x24 hours (Art. 46(1)) |
| Administrative fine | Up to 2% of annual income or revenue (Art. 57(3)) |
| Unlawful collection / disclosure | Up to 5 years / up to 4 years, and/or a fine up to category IV, Rp200 million (Art. 67(1) and (2); Law No. 1 of 2026, Annex I) |
In practice
- Send the controller a recorded request, electronic or on paper, to correct, access, delete or restrict your data (Art. 14); keep the proof, because the deadlines of three days run from receipt.
- To stop a company using your data, withdraw consent in writing: it must stop within 3x24 hours (Art. 40) and delete data collected on that basis (Art. 43(1)(b)).
- If the controller does not comply, you may sue for damages (Art. 12) or use arbitration, the courts or another alternative dispute procedure (Art. 64(1)); ask for a closed hearing where the data are sensitive (Art. 64(4)).
- Report unlawful collection, disclosure, use or forgery of your data to the police under Arts. 65 to 68; keep screenshots, messages and electronic documents, which count as evidence (Art. 64(3)).
- For irrelevant information held by an online platform, ask the operator to use its deletion mechanism, or seek a court order (ITE Law Art. 26(3) and (4)).
Recent changes
On 2 January 2026 Law No. 1 of 2026 rewrote Art. 613(3) of the Criminal Code to put administrative sanctions before criminal ones for administrative statutes, with the Personal Data Protection Law named in the elucidation, and restated the Law's criminal fines as categories IV and V; Constitutional Court Decision No. 151/PUU-XXII/2024 of 30 July 2025 concerns Art. 53(1)(b).
Where to go
- The controller's data protection officer, where one must be appointed (Law No. 27 of 2022 Arts. 53 and 54).
- District court, for damages claims (Art. 12), and the police for the offences in Arts. 65 to 68.
- The Ministry of Communication and Digital Affairs (Komdigi), which runs reporting portals such as aduankonten.id and aduannomor.id; the Law leaves the supervisory agency to the President (Art. 58(3)).
Worth knowing
Art. 2(2) takes processing by an individual in personal or household activities outside the Law, while Arts. 65 to 67 forbid 'every person' to obtain, disclose or use data that are not theirs unlawfully; the text does not say how the two fit together.
Frequently asked questions
How quickly must a company act on my request under the Indonesian data protection law?
The controller must correct data and grant access within 3x24 hours of the request (Arts. 30 and 32), stop processing within 3x24 hours after consent is withdrawn (Art. 40) and delay or restrict processing within the same time (Art. 41).
Can I make a company delete my personal data?
Yes: Art. 8 gives the right to have data deleted or destroyed, and Art. 43 obliges the controller to delete when the data are no longer needed, consent is withdrawn, the subject asks, or the data were obtained unlawfully; Art. 15 excludes defence, law enforcement, public administration, financial supervision and statistics.
What are the penalties for leaking or misusing someone's data?
Up to five years for unlawful obtaining or use and four years for unlawful disclosure, with and/or a fine of up to Rp200 million, and six years and/or up to Rp500 million for forging personal data (Arts. 67 and 68 as adjusted by Law No. 1 of 2026).
Sources
- Law No. 27 of 2022 on Personal Data Protection (UU PDP), official copy (Ministry of Finance JDIH) — Arts. 2 to 15, 19 to 26, 30 to 33, 40 to 47, 53, 54, 57 to 61, 64 to 70 and 74 (official copy)
- JDIH BPK record of Law No. 27 of 2022, with Constitutional Court Decision No. 151/PUU-XXII/2024 — Constitutional Court Decision No. 151/PUU-XXII/2024 on Art. 53(1)(b) and status of the Law
- Constitutional Court, decision 151/PUU-XXII/2024 (decided 30 July 2025) on Art. 53(1)(b) of the Personal Data Protection Law, full text on pasal.id — ruling: 'and' conditionally unconstitutional unless read 'and/or'
- Law No. 1 of 2026 on the Adjustment of Criminal Provisions (enacted 2 January 2026), official copy (JDIH BPK) — point 52: Art. 613(3) rewritten; elucidation naming the Personal Data Protection Law; Annex I, entry 137: Arts. 67 and 68
- Law No. 19 of 2016 amending the ITE Law, official copy (JDIH BPK) — Art. 26 as rewritten in 2016
- Government Regulation No. 17 of 2025 on the governance of electronic systems for child protection (27 March 2025), official copy (JDIH BPK) — Arts. 9 and 20 to 21 on children's accounts and parental consent
- Law No. 12 of 2022 on Sexual Violence Crimes (UU TPKS), official copy (JDIH BPK) — Art. 14 (electronic sexual violence)
- Ministry of Communication and Digital Affairs (Komdigi) -- home page with links to Adukan Konten, Adukan Nomor, Cek Rekening and LAPOR! — official reporting channels listed by the Ministry
The general article: Data protection · Compare with another country
Romance scams
Article 492 of the Criminal Code punishes anyone who, to benefit himself or another unlawfully, uses a false name or false position, deceit or a series of lies to make a person hand over goods, give a loan, acknowledge a debt or cancel a claim, with up to four years or a fine up to category V (Rp500 million); Art. 510 applies Art. 481 to it, so a spouse who is not separated from the victim in bed and board or in property cannot be prosecuted, and a separated spouse or a relative by blood or marriage up to the second degree only on the victim's complaint. The ITE Law adds Art. 28(1), on misleading information causing material loss to consumers in electronic transactions (Art. 45A(1): up to six years and/or a fine up to category V, Rp500 million, as adjusted by Law No. 1 of 2026), and Art. 35, on manipulating or creating electronic information so that it is taken as authentic (up to 12 years and/or a fine up to category VII, Rp5 billion, Art. 51(1) as adjusted by Law No. 1 of 2026).
Threats are separate offences. Distributing electronic information, to gain unlawfully, with a threat of violence to make someone hand over goods or acknowledge a debt, or with a threat of defamation or exposure of secrets, carries up to six years and/or a fine up to category V, Rp500 million (ITE Law Arts. 27B and 45(8) and (10), fines as adjusted by Law No. 1 of 2026); the exposure-of-secrets variant is prosecuted only on the victim's complaint, as is the threat variant within the family (Art. 45(9) and (11)). When the threat concerns intimate recordings, the 2022 Law on Sexual Violence Crimes applies: recording, sending or tracking sexual content without consent carries up to four years and/or a fine up to category IV, Rp200 million, and up to six years and/or category V, Rp500 million, when the aim is to extort, coerce or deceive (Art. 14(1) and (2)); it is a complaint offence unless the victim is a child or has a disability (Art. 14(3)).
Money-recovery and criminal tracks run in parallel. The Indonesia Anti-Scam Centre (IASC), led by the OJK's Satgas PASTI, connects the victim's report to banks, e-wallets and other institutions so that the account receiving the funds can be delayed or blocked and the money traced; its FAQ says that a report to IASC does not replace a police report, that both are required, and that return of the money is not guaranteed because scammers move funds through many accounts within minutes. Reports are made on the IASC portal, which issues a report number, or through the OJK call centre on 157 (konsumen@ojk.go.id).
The Ministry of Communication and Digital Affairs (Komdigi) runs AduanNomor.id, a portal for complaints about mobile numbers used for fraud. Besides the police, the ITE Law gives designated civil-servant investigators of the ministry power to order the temporary cutting of access to social-media accounts, bank accounts, electronic money and digital assets (Art. 43(1) and (5)(l)); investigators may cooperate with foreign investigators to share information and evidence (Art. 43(8)).
The Criminal Code's entry into force on 2 January 2026 changed the ITE Law: Law No. 1 of 2026 lists, among provisions repealed once the Code took effect, Arts. 27(1), 27(3), 28(2), 30, 31(1) and (2), 36, 45(1), 45(3), 45A(2), 46, 47 and 51(2) of the ITE Law; Arts. 28(1), 35 and 27B are not on that list.
Key points
| Fraud | Up to 4 years or fine up to category V, Rp500 million (Criminal Code Art. 492) |
|---|---|
| Fraud against a non-separated spouse | Not prosecuted (Art. 510 applying Art. 481(1)) |
| Misleading online information causing consumer loss | Up to 6 years and/or category V, Rp500 million (ITE Law Arts. 28(1) and 45A(1); Law No. 1 of 2026, Annex I) |
| Manipulating electronic data to look authentic | Up to 12 years and/or category VII, Rp5 billion (ITE Law Arts. 35 and 51(1)) |
| Extortion by threat of exposure | Up to 6 years and/or category V, Rp500 million; complaint offence (ITE Law Arts. 27B(2) and 45(10) to (11)) |
| Sexual-content extortion | Up to 6 years and/or category V, Rp500 million (Law No. 12 of 2022 Art. 14(2); Law No. 1 of 2026, Annex I) |
| Freezing accounts | Civil-servant investigators may order temporary suspension of social-media, bank and e-money accounts and digital assets (ITE Law Art. 43(5)(l)) |
| Report to the financial system | IASC portal and OJK call centre 157; a police report is also required |
| Report a scam number | AduanNomor.id (Ministry of Communication and Digital Affairs) |
In practice
- Stop all payments and gather proof before reporting: IASC asks for transfer receipts, your account data, the scammer's account data and the chat evidence, together with your identity card and contact details.
- Report immediately on the IASC portal, which gives a report number, or call the OJK on 157: speed is what gives banks a chance to freeze the remaining funds.
- File a police report (Laporan Polisi) at the nearest police station; IASC states that this is a separate, required step for the criminal case.
- Report the scammer's mobile number on AduanNomor.id, the ministry's portal for numbers used in fraud.
- If intimate images are used to blackmail you, also report to the police or a UPTD PPA and call SAPA 129 (129 or WhatsApp 08-111-129-129): Art. 14 of the 2022 Law covers this conduct.
Recent changes
Since 2 January 2026, when the new Criminal Code took effect, ITE Law Arts. 30 (unauthorised access) and 36 (acts causing loss to others) are among the provisions repealed under Art. 622 of the Code as rewritten by Law No. 1 of 2026, while Arts. 28(1), 35 and 27B are not on the list.
Where to go
- Indonesia Anti-Scam Centre (OJK / Satgas PASTI): iasc.ojk.go.id; OJK call centre 157, email konsumen@ojk.go.id.
- Nearest police station, for the criminal complaint under the Criminal Code and the ITE Law.
- AduanNomor.id of the Ministry of Communication and Digital Affairs (Komdigi).
- SAPA 129 for victims of sexual-content blackmail: telephone 129, WhatsApp 08-111-129-129.
Worth knowing
Texts written before 2026 that cite 'ITE Law Art. 36' or 'Art. 51(2)' for fraud-related losses describe provisions repealed on 2 January 2026; Art. 51(1) now reads up to 12 years and/or category VII instead of Rp12 billion.
Frequently asked questions
Is a fake online profile used to win someone's trust a crime in Indonesia?
When it is used to obtain money, Art. 492 of the Criminal Code covers the use of a false name or position and a series of lies (up to four years or category V), and Art. 35 of the ITE Law (up to 12 years and/or category VII) covers creating or manipulating electronic information so that it is taken as authentic.
Does reporting to the Indonesia Anti-Scam Centre replace a police report?
No: IASC's FAQ says both are required, IASC for the financial track (blocking and tracing accounts) and the police report for the criminal case, and that recovery of the money is not guaranteed.
Can my spouse be prosecuted for defrauding me?
Not while the two of you are not separated in bed and board or in property: Art. 510 applies Art. 481(1) of the Code to fraud, so there is no prosecution of such a spouse; if separated, only on the victim's complaint (Art. 481(2)).
Sources
- Law No. 1 of 2023 on the Criminal Code (KUHP), official copy, in force since 2 January 2026 (JDIH BPK) — Arts. 79, 481, 492 and 510
- Law No. 11 of 2008 on Electronic Information and Transactions (ITE), official copy (JDIH BPK) — Arts. 35 and 51(1) as printed in 2008
- Law No. 1 of 2024, second amendment of the ITE Law, official copy (JDIH BPK) — Arts. 27B, 28(1), 43, 45 and 45A as rewritten in 2024
- Law No. 1 of 2026 on the Adjustment of Criminal Provisions (enacted 2 January 2026), official copy (JDIH BPK) — Annex I entries 56 (Art. 51(1)), 136 (Law No. 12 of 2022, Art. 14) and 182 (ITE Arts. 45(8), 45(10) and 45A(1)); Art. 622 as rewritten, list of repealed ITE provisions
- Law No. 12 of 2022 on Sexual Violence Crimes (UU TPKS), official copy (JDIH BPK) — Art. 14
- Indonesia Anti-Scam Centre (IASC), OJK / Satgas PASTI -- reporting portal, FAQ and OJK call centre 157 — what IASC is, FAQ on police report and recovery, call centre 157
- AduanNomor.id -- Ministry of Communication and Digital Affairs portal for mobile numbers used in fraud — portal title 'Aduan Nomor - Komdigi'
- Ministry of Women's Empowerment and Child Protection (KemenPPPA), SAPA 129 reporting service — hotline 129 and WhatsApp 08-111-129-129
The general article: Romance scams · Compare with another country