Indonesia PDP Law: Constitutional Court Affirms Executive Authority Over Cross-Border Transfers and Adequacy (January 2026)

On January 19, 2026, the Constitutional Court of the Republic of Indonesia issued a landmark ruling in Case Number 137/PUU-XXIII/2025, upholding Article 56 of the Personal Data Protection Law (Law Number 27 of 2022). The Court rejected a constitutional challenge that sought to require parliamentary approval for cross-border data transfers, thereby affirming the executive branch's sole authority to manage international data flows and issue adequacy decisions.

Background and the Lawsuit

The constitutional challenge was triggered by a joint statement on July 22, 2025, between the White House and the Indonesian government concerning the Framework for Negotiating a Reciprocal Trade Agreement between Indonesia and the United States of America. As part of this framework, Indonesia committed to establishing legal certainty regarding cross-border data transfers to the United States.

The Petitioner argued that under a strict interpretive approach, Article 56 of the PDP Law allowed data controllers to assess adequacy requirements independently without parliamentary oversight. They requested that the Court interpret Article 56 to mean that:

1. Transferring personal data to jurisdictions like the United States should occur only if there is an international agreement formally approved by the Indonesian House of Representatives (DPR).
2. Transfers to countries lacking adequate personal data protection standards should occur only with explicit consent from the data subjects after being fully informed of the risks.

The Court's Decision

The Constitutional Court rejected all of the Petitioner's arguments on the following grounds:

• Administrative vs. Sovereign Agreements: The Court ruled that the cross-border transfer of personal data constitutes an administrative and technical measure of the executive branch. It is not an international treaty that creates rights and obligations in the domains of politics, defense, or national sovereignty. Therefore, there is no constitutional obligation to involve the House of Representatives (DPR) in determining adequacy decisions or managing cross-border data transfer processes.
• Role of Data Exporters & the PDPA: The Court clarified that while data controllers (exporters) must perform technical verification to ensure that the recipient country offers an adequate or higher level of protection, they do not act in isolation. The process necessitates the active involvement of the Personal Data Protection Authority (PDPA) (prescribed in Articles 58-61 of the PDP Law) to oversee, evaluate, and implement technical policy measures.

Ongoing Compliance Challenges

Despite the Court's ruling, several critical operational and litigation challenges persist for multinational companies operating under the Indonesian PDP Law:

1. Absence of the PDPA and Regulations: As of early 2026, the independent Personal Data Protection Authority (PDPA) has not been fully established/designated, and the comprehensive implementing regulations of the PDP Law remain in draft form.
2. Extraterritoriality & INSULAR Litigation: The PDP Law has an extensive extraterritorial scope. However, Indonesian civil procedural law does not recognize or enforce foreign judgments (except for marine salvage). Data disputes involving Indonesian citizens must be relitigated from scratch in Indonesian courts, which can lead to complex parallel proceedings.

Verbatim Evidence

From Cross-Border Personal Data Transfers: The Remaining Issues Following the Indonesian Constitutional Court Decision:

"According to the Court, the cross-border transfer of personal data constitutes part of the administrative and technical measures carried out by the executive branch, rather than an agreement between nations that creates rights and obligations in the domains of politics, defence, or sovereignty." "Based on this reasoning, the Court affirmed that there is no constitutional obligation to involve the Indonesian House of Representatives in any cross-border data transfer process, including in determining the adequacy decision regarding such a personal data transfer." "Since the PDPA has not yet been established or designated to date, this situation underscores the urgent need to set up or appoint such an authority."