The Indonesian Constitutional Court recently received two constitutional review petitions regarding Law No. 27 of 2022 on Personal Data Protection ("PDP Law"). The petitions sought to declare specific articles of the PDP Law as unconstitutional. One petition questioned the classification of legal entities as controllers, while the other focused on the limitations of data subjects' rights related to defence and national security. However, the Court ruled that the provisions in question were valid and consistent with the Constitution.
In its rulings, the Court clarified certain aspects of the PDP Law. It emphasised that personal and household data processing activities conducted for non-commercial purposes are exempt from the PDP Law. The Government provided guidance on the criteria for this exemption. Additionally, the Court addressed the restrictions on data subjects' rights in the context of defence and national security, highlighting that data processing must align with legislative requirements governing defence and national security.
These rulings provide valuable guidance and enhance the understanding of the PDP Law. While awaiting the issuance of implementing regulations, the rulings contribute to the effective implementation of the PDP Law and empower stakeholders to navigate data protection regulations in Indonesia more confidently.
For more information, click here to read our Legal Update.
