The Ministry of Communication and Information (Kominfo) published, on August 30, 2023, the draft regulation for implementing the Personal Data Protection Law (PDPL), seeking public comments on the same.

Notably, the Minister of Kominfo, Budi Arie Setiadi, noted that the draft regulation is a mandate under the PDPL and "involving all stakeholders would make the PDPL a comprehensive legal umbrella and encourage ethical and responsible innovation as well as increase standards for processing personal data in the public and private sectors."

In particular, the draft regulation will govern, among others, the rights and obligations of controllers and processors, data transfers, international cooperation, administrative sanctions, dispute resolution, the rights of data subjects, including objecting to automated decision-making, and data retention mechanisms. Notably, the draft regulation provides an article-by-article clarification of the PDPL, including, the meanings of processing in good faith, clarification on violations, and processing of personal data on a large scale.

Additionally, in terms of the obligations of the data controller, the draft regulations provide details on international data transfers, limits on disclosure of personal data, legal bases for processing, implementation of organizational and security measures, carrying out a Data Protection Impact Assessment (DPIA) for high potential risks, and the implementation of privacy principles.

Furthermore, the draft regulation provides an explanation for certain terms, namely:

• 'child,' which means a person under the age of 18 years and who is unmarried; and
• 'direct referencing,' 'mapping reference,' and 'triangulation,' under the definition of 'combination of personal data.'

Public comments can be submitted until September 14, 2023.

You can read the press release here, and the draft and information on how to submit public comments here, both only available in Indonesian.