Client Update: Indonesia

4 May 2023

Constitutional Court Rulings Illuminate

Certain Provisions of the PDP Law

Shortly after the enactment of Law No. 27 of 2022 on Personal Data Protection ("PDP Law") on 17
October 2022 (click here and here to read our previous client alerts on the PDP Law), the Indonesian
Constitutional Court received two distinct constitutional review petitions concerning the PDP Law.

As discussed in our previous client alerts, there were ambiguities in the PDP Law, and we mentioned
these ambiguities are likely to be clarified through the Law’s implementing regulations, when such
regulations are issued. While the government has not issued any implementing regulations for the PDP
Law, the Constitutional Court’s rulings clarified some provisions of the Law, namely on personal and
household processing of personal data and limitation of data subjects’ rights, specifically with regards
to national security and defence.

We discuss these clarifications in more detail below.

Background
Both petitions were filed by individual applicants and essentially, the petitions requested the
Constitutional Court to declare specific articles of the PDP Law to be unconstitutional. In the first case,

© Assegaf Hamzah & Partners | 1

Client Update: Indonesia
4 May 2023

which was filed in October 2022, 1 the applicant (“Applicant 1”) requested the Court to declare the
following articles as unconstitutional:

(1) Article 1(4) of the PDP Law on the definition of a Controller;

(2) Article 2(2) of the PDP Law on the personal or household data processing exemption; and

(3) Article 19 of the PDP Law, which delineates the various types of Controllers and Processors.

Applicant 1 expressed the belief that, under Articles 1(4) and 19 of the PDP Law, legal entities were not
classified as Controllers. As a result, he cannot engage a legal entity to manage personal data subject
to the PDP Law's requirements.

Concerning the exemption outlined in Article 2(2) of the PDP Law, Applicant 1 contended that such an
exemption might inadvertently leave small or household-scale businesses, which also process personal
data, unregulated. Applicant 1 emphasised the significant presence of these businesses in Indonesia,
particularly within the e-commerce sector. He worried that, due to the exemption, if any data breaches
were to occur in these businesses, they would not be held accountable under the PDP Law.

Additionally, Applicant 1 highlighted the lack of clarity surrounding the scope of the exemption in Article
2(2) of the PDP Law. Consequently, he believed that his constitutional right to legal certainty, as
guaranteed under Article 28D(1) of the Indonesian Constitution, had been violated.

Meanwhile, in the second case, which was filed in November 2022, 2 the applicant (“Applicant 2”)
requested the Court to declare Article 15(1)(a) of the PDP Law on limitations of certain data subjects’
rights as unconstitutional. This Article allows specific data subjects’ rights to be limited if it relates to
data processing activities pertaining to defence and national security matters. Nonetheless, Applicant 2
argued that the PDP Law fails to clearly define "defence and national security", and consequently, this
lack of clarity has infringed upon Applicant 2's constitutional rights as a citizen, resulting in a violation of
his entitlement to legal certainty.

Court’s Finding
In both cases, the Court determined that it has jurisdiction to hear these cases, and that the applicants
have a legal standing to file the petitions. However, the Court also found that the applicants' arguments
regarding the merit of the cases lack legal justification. Consequently, the Court denied the petitions in
their entirety and therefore, the provisions that the applicants sought to have annulled by the Court
remain valid, as the Court found no inconsistencies between these provisions of the PDP Law and the
Constitution.

1
Case No. 108/PUU-XX/2022.
2
Case No. 110/PUU-XX/2022.

© Assegaf Hamzah & Partners | 2

Client Update: Indonesia
4 May 2023

Personal and household exemption

For the first case, the Court clarified that data processing by an individual for personal or household
activities is not subject to the PDP Law if such processing is conducted for non-commercial purposes.

Additionally, the government offered valuable guidance on how to apply for the personal and household
exemption under Article 2(2) of the PDP Law in its defence of this case. For personal and household
data processing activities to be exempted from the PDP Law, such processing activities must have these
characteristics:

(1) Personal;

(2) Intimate;

(3) Non-commercial; and/or

(4) Non-professional.

Defence and national security

In the second case, the government offered clarification on the restrictions for certain data subject rights,
as outlined in Article 15(1) of the PDP Law, with respect to defence or national security. It is essential
to interpret this Article in conjunction with Article 15(2) of the PDP Law, which stipulates that data
processing concerning defence or national security must occur within the framework of implementing a
legislative requirement, i.e. implementing a law that regulates defence or national security.

The government gave several examples of these laws, namely Government Regulation in lieu of Law
No. 1 of 2002 on the Eradication of Terrorism, Law No. 3 of 2002 on State Defence, Law No. 34 of 2004
on the Indonesian National Army, Law No. 12 of 2005 on the Ratification of the International Covenant
on Civil and Political Rights, Law No. 17 of 2011 on State Intelligence, and Law No. 23 of 2019 on the
Management of National Resources for State Defence.

Conclusion
These recent Constitutional Court rulings have shed light on ambiguous provisions in the PDP Law,
offering essential guidance to individuals, organisations, and public bodies.

By addressing concerns surrounding the personal and household exemption, and clarifying the
limitations of data subject rights in the context of defence and national security, the Court has fostered
a more transparent and comprehensive understanding of the law. Pending the issuance of the
implementing regulations of the PDP Law, these rulings will contribute to the effective implementation
of the PDP Law and empower stakeholders to navigate the legal landscape of data protection in
Indonesia with more confidence.

© Assegaf Hamzah & Partners | 3

Client Update: Indonesia
4 May 2023

Contacts
Zacky Zainal Husein Muhammad Iqsan Sirie
Partner Partner

D +62 21 2555 9956 D +62 21 2555 7805

F +62 21 2555 7899 F +62 21 2555 7899
[email protected] [email protected]

© Assegaf Hamzah & Partners | 4

Client Update: Indonesia
4 May 2023

Regional Contacts
R&T Sok & Heng Law Office Rajah & Tann Myanmar Company Limited
T +855 23 963 112 / 113 T +95 1 9345 343 / +95 1 9345 346
F +855 23 963 116 F +95 1 9345 348
kh.rajahtannasia.com mm.rajahtannasia.com

Rajah & Tann Singapore LLP Gatmaytan Yap Patacsil Gutierrez & Protacio (C&G Law)
Shanghai Representative Office T +632 8894 0377 to 79 / +632 8894 4931 to 32
T +86 21 6120 8818 F +632 8552 1977 to 78
F +86 21 6120 8820 www.cagatlaw.com
cn.rajahtannasia.com

Assegaf Hamzah & Partners Rajah & Tann Singapore LLP

T +65 6535 3600
Jakarta Office sg.rajahtannasia.com
T +62 21 2555 7800
F +62 21 2555 7899
R&T Asia (Thailand) Limited
Surabaya Office T +66 2 656 1991
T +62 31 5116 4550 F +66 2 656 0833
F +62 31 5116 4560 th.rajahtannasia.com
www.ahp.id

Rajah & Tann (Laos) Co., Ltd. Rajah & Tann LCT Lawyers
T +856 21 454 239
F +856 21 285 261 Ho Chi Minh City Office
la.rajahtannasia.com T +84 28 3821 2382 / +84 28 3821 2673
F +84 28 3520 8206

Christopher & Lee Ong Hanoi Office

T +60 3 2273 1919 T +84 24 3267 6127
F +60 3 2273 8310 F +84 24 3267 6128
www.christopherleeong.com www.rajahtannlct.com

Rajah & Tann Asia is a network of legal practices based in Asia.

Member firms are independently constituted and regulated in accordance with relevant local legal requirements. Services provided by a
member firm are governed by the terms of engagement between the member firm and the client.

This update is solely intended to provide general information and does not provide any advice or create any relationship, whether
legally binding or otherwise. Rajah & Tann Asia and its member firms do not accept, and fully disclaim, responsibility for any loss or
damage which may result from accessing or relying on this update.

© Assegaf Hamzah & Partners | 5

Client Update: Indonesia
31 March 2023

Our Regional Presence

Based in Indonesia, and consistently gaining recognition from independent observers, Assegaf Hamzah & Partners has established itself as a major
force locally and regionally and is ranked as a top-tier firm in many practice areas. Founded in 2001, it has a reputation for providing advice of the
highest quality to a wide variety of blue-chip corporate clients, high net worth individuals, and government institutions.

Assegaf Hamzah & Partners is part of Rajah & Tann Asia, a network of local law firms in Cambodia, China, Indonesia, Lao PDR, Malaysia, Myanmar,
the Philippines, Singapore, Thailand and Vietnam. Our Asian network also includes regional desks focused on Brunei, Japan and South Asia.

The contents of this Update are owned by Assegaf Hamzah & Partners and subject to copyright protection under the laws of Indonesia and, through
international treaties, other countries. No part of this Update may be reproduced, licensed, sold, published, transmitted, modified, adapted, publicly
displayed, broadcast (including storage in any medium by electronic means whether or not transiently for any purpose save as permitted herein)
without the prior written permission of Assegaf Hamzah & Partners.

Please note also that whilst the information in this Update is correct to the best of our knowledge and belief at the time of writing, it is only intended
to provide a general guide to the subject matter and should not be treated as a substitute for specific professional advice for any particular course
of action as such information may not suit your specific business and operational requirements. It is to your advantage to seek legal advice for your
specific situation. In this regard, you may call the lawyer you normally deal with in Assegaf Hamzah & Partners.

© Assegaf Hamzah & Partners | 6