Indonesia: Draft DPA Regulation, Constitutional Court Rulings, and US Trade Agreement Reshape PDP Law Landscape

In early 2026, the regulatory, treaty-level, and judicial environments of Indonesia’s Personal Data Protection Law (Law No. 27 of 2022 - PDP Law) reached a critical inflection point. Compliance teams managing Indonesian operations must adapt to a rapidly formalizing enforcement structure and evolving cross-border transfer pathways.

1. Formal Establishment of the Data Protection Authority (DPA)

Article 58(5) of the PDP Law mandates the establishment of an independent supervisory authority via presidential regulation. At the end of February 2026, the Ministry of Communication and Digital Affairs (MOCD) made public a draft Presidential Regulation ("Draft Regulation") and submitted it to the Ministry of State Secretariat for presidential approval.

• Structure: The DPA will be established as a non-ministerial government agency reporting directly to the President through the MOCD. It will be led by a presidential-appointed Head and three deputies specializing in (i) policy and guidance, (ii) dispute resolution, and (iii) compliance and enforcement.
• Transition: To ensure immediate operationality, the DPA will temporarily utilize personnel, assets, and resources from the existing personal data protection unit within the MOCD’s Directorate General for Digital Space Oversight.

2. U.S.-Indonesia Reciprocal Trade Agreement Affects Data Transfers

On February 19, 2026, the United States and Indonesia signed the U.S.-Indonesia Agreement on Reciprocal Trade.

• Adequacy Commitment: Under Article 3.2 of Annex III (Specific Commitments), Indonesia agreed to provide legal certainty for personal data transfers to the US by recognizing the United States as a jurisdiction that offers "adequate" data protection under Indonesian law.
• Operational Tension: Under domestic law, the Trade Agreement must undergo ratification by the House of Representatives (DPR) before taking effect. Furthermore, Article 56 of the PDP Law requires data controllers to ensure that a destination country provides equivalent or higher protection, typically discharged through a formal adequacy decision by the DPA. It remains unclear how the Indonesian government will align this treaty commitment with the DPA's statutory adequacy assessment powers.

3. Constitutional Court Settles Key PDP Law Provisions

In 2025 and early 2026, the Constitutional Court of the Republic of Indonesia rejected three major challenges to the PDP Law, providing critical legal certainty for businesses:

• Cross-Border Transfers: In Case Number 137/PUU-XXIII/2025, the Court rejected a challenge to Article 56, ruling that the PDP Law's cross-border transfer framework (governing adequacy, contractual clauses, and consent) is constitutionally settled.
• Criminal Liability: The Court upheld Article 65's criminal liability provisions for unlawful data disclosure, refusing to grant explicit industry-specific exemptions (such as for journalism), and clarifying that "unlawful" must be interpreted alongside other relevant sectoral laws (e.g., the Press Law).
• Consent Standards: The Court rejected a petition arguing that explicit consent under Article 20(2)(a) must require certified electronic signatures, clarifying that technical implementation rules belong in implementing regulations, not constitutional doctrine.

4. Rising Litigation and Enforcement Action

Litigation under the PDP Law has steadily escalated. Public registries indicate at least 23 criminal cases and 7 civil cases involving the PDP Law:

• Criminal Enforcement: District courts in 2025 actively applied Articles 65(1) and 65(3) as operational criminal provisions in cases involving unauthorized extraction and dark web sales of employee data, and the misuse of identity information to create fraudulent accounts. However, the courts still primarily rely on the Electronic Information and Transactions (EIT) Law, using the PDP Law as an alternative legal basis.
• Civil HR Risks: In January 2026, three former contract employees filed a civil lawsuit against a data controller in the West Jakarta District Court. The claimants alleged that the employer conducted credit-history checks on contract workers without explicit consent or a valid contractual basis. This highlights significant civil liability risks for internal HR operations that fail to provide clear privacy notices at the outset of employment relationships.

Verbatim Quotes

"Under Article 3.2 of Annex III (Specific Commitments), Indonesia is required to provide legal certainty for the transfer of personal data to the United States by recognising the United States as a jurisdiction that offers adequate data protection under Indonesian law. In practical terms, this commitment appears to imply that the United States is automatically regarded as a country whose data protection standards are equivalent to, or exceed, those of Indonesia."

"Under the Draft Regulation, the DPA will be classified as a non-ministerial government agency reporting to the President through the MOCD... The DPA will be led by a Head appointed by the President and supported by three deputies responsible for (i) policy and guidance, (ii) dispute resolution, and (iii) compliance and enforcement."

"The PDP Law's cross-border transfer framework, covering adequacy, contractual safeguards, and consent, is now constitutionally settled, making further judicial challenge unlikely."