Law lecturer Yu Un Oppusunggu testifying as an expert for the Government at a hearing for cases on the Personal Data Protection Law, Monday (11/3/2025). Photo by MKRI/Ifa.

---

JAKARTA (MKRI) — The President, through his legal representative, presented law lecturer of Universitas Indonesia Yu Un Oppusunggu at a judicial review hearing on several articles of Law No. 27 of 2022 on Personal Data Protection (PDP Law) for Cases No. 135/PUU-XXIII/2025 and No. 137/PUU-XXIII/2025 before the Constitutional Court (MK) on Monday, November 3, 2025. Oppusunggu explained that Article 56 paragraph (1) of the PDP Law applies both territorially and extraterritorially, as it regulates the transfer of personal data outside the jurisdiction of the Republic of Indonesia.

“The legal norm of Article 56 paragraph (1) of the PDP Law regulates the transfer of Personal Data outside the jurisdiction of the Republic of Indonesia as a form of processing based on the needs of (i) the personal data controller, (ii) the personal data processor, and/or (iii) the personal data subject, to which Indonesian positive law continues to apply,” he said in the plenary courtroom.

Article 56 of the PDP Law reads in full: “(1) A Personal Data Controller may transfer Personal Data to another Personal Data Controller and/or Personal Data Processor outside the jurisdiction of the Republic of Indonesia in accordance with the provisions of this Law. (2) In conducting the transfer of Personal Data as referred to in paragraph (1), the Personal Data Controller shall ensure that the state in which the Personal Data Controller and/or Personal Data Processor receiving the transfer is domiciled possesses a level of Personal Data Protection equivalent to or higher than that provided under this Law. (3) In the event that the requirements as referred to in paragraph (2) are not fulfilled, the Personal Data Controller shall ensure the existence of adequate and binding Personal Data Protection. (4) In the event that the provisions referred to in paragraphs (2) and (3) are not met, the Personal Data Controller must obtain the consent of the Personal Data Subject.”

Oppusunggu explained that the basis for the transfer of personal data referred to in Article 16 paragraph (2) letter b of the PDP Law must take into account the explicit and lawful consent of the personal data subject, the fulfillment of legal obligations toward the personal data subject, or the protection of the vital interests of the personal data subject. The PDP Law—whether Article 55, which regulates the transfer of personal data within Indonesian jurisdiction, Article 56, or other articles—does not explicitly specify the types or reasons for personal data transfer.

However, both Articles 55 and 56 of the PDP Law stipulate that transfers of personal data, whether within or outside Indonesian jurisdiction, must comply with the provisions of the PDP Law. In other words, the PDP Law applies both territorially and extraterritorially. The territorial and extraterritorial application of the PDP Law under Article 56 paragraph (1) is a restatement of the legal norm contained in Article 2 of the PDP Law.

As formulated, through the use of the preposition “in,” Article 56 paragraph (1) of the PDP Law regulates the transfer of personal data from outside Indonesian jurisdiction to outside Indonesian jurisdiction, and prima facie does not regulate the transfer of personal data from within Indonesia to outside its jurisdiction. Considering that Chapter VII of the PDP Law is entitled “Transfer of Personal Data,” and Part II thereof is titled “Transfer of Personal Data Outside the Jurisdiction of the Republic of Indonesia,” Oppusunggu concluded that, in the drafting process, the phrasing of Article 56 paragraph (1) was merely a typographical error that may be disregarded.

Furthermore, Article 56 paragraph (2) of the PDP Law elaborates on an important issue related to the transfer of personal data from within the jurisdiction of the Republic of Indonesia to outside its jurisdiction—namely, the standard. Implicitly, Article 56 paragraph (2) establishes two types of standards: (i) normative and (ii) technological. The paragraph merely requires that the country where the receiving personal data controller and/or personal data processor are located possess a level of personal data protection equivalent to or higher than that of the Republic of Indonesia.

Oppusunggu explained that Article 56 paragraph (2) of the PDP Law assumes that the normative and technological standards applicable within Indonesian jurisdiction are adequate and appropriate, though continually evolving, and that such standards must be met by foreign personal data controllers receiving personal data transfers. The reference to normative and/or technological standards “higher than those stipulated in” the PDP Law reflects a visionary and adaptive formulation accommodating technological diversity and progress in other countries.

He added that where there is a lack of transparency on the part of the foreign state where the receiving personal data controller and/or processor is located, the assessment of compliance with the requirements of Article 56 paragraph (2) of the PDP Law may be conducted by (i) the transferring personal data controller, (ii) the receiving personal data controller, and/or (iii) the receiving personal data processor. Naturally, such assessments have been or will be established in accordance with best practices within the relevant industry.

The normative and technological standards of personal data protection as set forth in Article 56 paragraph (2) of the PDP Law do not change conceptually or in practice when personal data are transferred outside Indonesian jurisdiction. “If the requirements of Article 56 paragraph (2) of the PDP Law are not met, an alternative solution is provided under Article 56 paragraph (3) of the PDP Law,” said Oppusunggu.

He continued that Article 56 paragraph (3) of the PDP Law serves as an alternative or responsible exception in situations where the foreign state where the receiving personal data controller and/or processor is located has normative and/or technological standards that are not equivalent to or lower than those prevailing in the Republic of Indonesia. If the level of personal data protection in the foreign state concerned is not equivalent to or lower than that in Indonesia, the “Personal Data Controller must ensure the existence of adequate and binding Personal Data Protection.”

According to Oppusunggu, the obligation imposed by this paragraph must be understood objectively and proportionally, at least on the basis of two considerations: first, what is the necessity for the transfer of personal data; and second, what type of personal data is the object of the transfer (Article 4 of the PDP Law in conjunction with Article 35 letter b of the PDP Law).

If, on an objective and proportional basis, the transfer of personal data to a foreign state where the receiving personal data controller and/or processor maintains lower or inadequate standards of normative and/or technological protection could harm the personal data subject or result in misuse of personal data, such transfer cannot take place. If the transfer nevertheless occurs, whether intentionally or unintentionally, the personal data controller may be subject to administrative sanctions as provided in Article 57 paragraphs (2) and (3) of the PDP Law.

Alternative Solution

Oppusunggu further explained that Article 56 paragraph (4) of the PDP Law provides a further alternative solution in cases where, objectively and proportionally, the level of Personal data protection in the foreign state where the receiving personal data controller and/or processor is located is inadequate and non-binding. Such inadequacy or non-binding condition may be overridden if the personal data controller obtains the consent of the personal data subject for the transfer of their personal data outside the jurisdiction of the Republic of Indonesia.

The consent of the personal data subject signifies not only the fulfillment of the data subject’s rights (Article 5 of the PDP Law) and the obligations of the personal data controller (including Article 20 of the PDP Law), but also the recognition of personal data as a property (Article 1 point 1 of the PDP Law). Therefore, the obligation of the personal data controller to obtain the consent of the personal data subject constitutes protection of the data subject’s constitutional rights.

“The transfer of personal data without the consent of the personal data subject constitutes an unlawful act that may serve as the basis for the data subject to file a lawsuit against the personal data controller or for the imposition of criminal sanctions by the court,” Oppusunggu stated.

Before concluding the hearing, Chief Justice Suhartoyo stated that the session was the final hearing for both cases. Accordingly, all parties—Petitioners in both cases as well as the House of Representatives (DPR) and the President/Government—may submit their closing statements no later than Tuesday, November 11, 2025, or within seven working days from today’s hearing.

Also read:

Journalists, Illustrator Seek Exception from Ban on Personal Data Disclosure

Petitioners: Cross-Border Personal Data Transfer Poses Greater Risk

Ministry: Ban on Personal Data Disclosure Does Not Restrict Journalists, Scholars, Artists

Ban on Personal Data Disclosure in PDP Law Requires Strict Interpretation

Journalist Named Suspect for Allegedly Disclosing Personal Data

The Petitioner of case No. 137/PUU-XXIII/2025, lawyer and law lecturer Rega Felix, challenges Article 56 paragraphs (1), (2, (3) and (4) of the PDP Law. He contends that these provisions fail to recognize popular sovereignty as the true owner of personal data sovereignty, treating the transfer of personal data merely as a technical matter without acknowledging its far-reaching impact on citizens’ lives.

The petition is prompted by an agreement between the Government of Indonesia and the United States concerning the transfer of citizens’ personal data as part of a reciprocal trade agreement. According to the Petitioner, if the Government interprets Article 56 of the PDP Law unilaterally, it could result in broad and fundamental constitutional harm to the Indonesian people, including the Petitioner, in violation of Article 28G paragraph (1) of the 1945 Constitution.

The hearing also concerns case No. 135/PUU-XXIII/2025, petitioned by academic Prof. Masduki, illustrator/cartoonist Amry Al Mursalaat, the Alliance of Independent Journalists (AJI) Indonesia, and the Southeast Asia Freedom of Expression Network (SAFEnet), who are members of civil society coalition for freedom of information and personal data operating under the name SIKAP. They challenge Article 65 paragraph (2) and Article 67 paragraph (2) of the PDP Law, which they believe have allowed for broad and imprecise interpretation, posing a threat to their constitutional rights, as their professional activities often require the disclosure of personal data in order to fulfil the public’s right to information. 

Author         : Mimi Kartika
Editor          : Lulu Anjarsari P.
PR               : Tiara Agustina
Translator     : Yuniar Widiastuti (NL)

Disclaimer: The original version of the news is in Indonesian. In case of any differences between the English and the Indonesian versions, the Indonesian version will prevail.

---