Legal Expert Staff of the Ministry of Communications and Digital, Cahyaning Nuratih Widowati, during the hearing of Case No. 151/PUU-XXII/2024, Wednesday (7/5/2025). Photo by MKRI/Bay.

---

Jakarta (MKRI) – The Constitutional Court held a hearing of Case No. 151/PUU-XXII/2024 to hear testimony from the House of Representatives and the President on the material judicial review of Article 53 paragraph (1) of Law No. 27 of 2022 on Personal Data Protection (PDP Law). The President, who was represented by Legal Expert Staff from the Ministry of Communications and Digital, Cahyaning Nuratih Widowati, stated that Personal Data Controller and Personal Data Processor remained obligated to protect personal data under their control, management, and processing with or without officers who are tasked with managing Personal Data Protection (PPDP) to ensure its compliance with the principles of Personal Data Protection and mitigate violation risks.

“The Petitioners’ arguments that the word ‘and’ at the end of the sentence of point b Article 53 paragraph (1) of the PDP Law, which is cumulative, limit the scope of the obligation to appoint PPDP/DPO from Personal Data Controller and Personal Data Processor, so, that it potentially harms the Petitioners’ constitutional rights is misleading and untrue because the provisions of Article 53 paragraph (1) of the PDP Law is the elaboration of activity types which obligate Personal Data Controller and Personal Data Protection to appoint PPDP/DPO,” Cahya stated at the Plenary Courtroom, Wednesday, May 7, 2025.

Cahya explained that Article 53 paragraph (1) of the PDP Law regulates PPDP, also known as the Data Protection Officer (DPO), are officers or administrator who exercise personal data protection. It is complementary to or supporting of the Personal Data Controller and Personal Data Processor to protect personal data.  The article also mentions the types of activities that require the appointment of PPDP/DPO in conducting Personal Data processing for public service. The main tasks of the Personal Data Controller have a nature, scope, and purposes which need to be observed regularly and systematically on a large scale. Also, the main tasks of the Personal Data Controller consist of a large-scale Personal Data Processing for specific personal data and/or Personal Data related to crime.

Cahya stated that the original intent of the three activities elaborated in the provisions of Article 53 paragraph (1) of the PDP Law is mandatory to appoint PPDP/DPO and not intended to be cumulative or alternative. Other matters and activities related to the appointment of PPDP/DPO would be further regulated under the Government Regulation. Besides those activities, the Personal Data Controller and Personal Data Processor remain obligated to protect personal data from data subjects, but are not mandatory to have a PPDP/DPO.

The elaboration of the word “and”, which was challenged by the Petitioner in Article 53 paragraph (1) of the PDP Law, was intended to show specific situations/conditions by using the phrase “in the case of” because there are activities of the Personal Data Controller and Personal Data Processor which are obligated to appoint PPDP/DPO and not intended as a cumulative precondition which must be fulfilled entirely.

In addition, the House of Representatives’ testimony was delivered by a member, M. Nasir Djamil. He stated that the word “and” in Article 53 paragraph (1) of the PDP Law was not interpreted as cumulative. The obligation in the provisions must be carried out even if one activity is exercised.

“All in the tabulation serves as a list, does not mean it has to be conducted cumulatively; then it becomes mandatory,” Nasir, who attended the hearing online, stated.

Also read:

Personal Data Protection Law Challenged

Petitioners of Personal Data Protection Law Compare Regulations in Other Countries

In the preliminary hearing, the Petitioners explained their petition that questioned the phrase “and” at the end of the sentence of letter b in Article 53 paragraph (1) of the PDP Law related to the provision on the obligation of the personal data controller and processor in assigning an official or officer who performs the function of personal data protection. Article 53 paragraph (1) of the PDP Law reads Personal Data Controller and Personal Data Processor shall appoint an official or officer who performs the function of Personal Data Protection in the case of (a) processing of Personal Data for the benefit of public services; (b) the core activities of the Personal Data Controller have the nature, scope, and/or purpose that require regular and systematic monitoring of large-scale Personal Data; and (c) the core activities of the Personal Data Controller consist of large-scale processing of Personal Data for specific Personal Data and/or Personal Data related to criminal offenses.” 

To the Petitioners, the cumulatively formulated criteria for assigning PPDP have narrowed the scope of the data controller and data processor organization, which is obligated to assign PPDP. In this case, the Petitioners argued, the data controller and data processor organization that only satisfy one or two criteria of the requirements provided in Article 53 paragraph (1) of the PDP Law are not obligated to assign PPDP. It is despite each criterion in each item in the article a quo is a criterion for personal data processing activities categorized as personal data processing that has a high potential risk to personal data subjects, which is also emphasized in Article 34 paragraph (2) of the PDP Law.

In their petitum, the Petitioners request the Court to declare Article 53 paragraph (1) of the PDP Law contrary to the 1945 Constitution and has no binding legal force as long as the phrase “and” is not interpreted with “and/or”.

Penulis: Mimi Kartika
Editor: Lulu Anjarsari P.
Humas: Fauzan Febriyan

Translator: Rizky Kurnia Chaesario

Disclaimer: The original version of the news is in Indonesian. In case of any differences between the English and the Indonesian versions, the Indonesian version will prevail.

---