The Petitioners, accompanied by their legal counsel, presented their arguments in the judicial review of Law Number 27 of 2022 on Personal Data Protection before the Constitutional Court’s panel hearing on Thursday (05/07/2026), in Jakarta. Photo by MKRI/Panji.
JAKARTA, (MKRI) – Legal Consultant Pardamean Sihombing, Advocate Eprina Manurung, Advocate Christian Adrianus Sihite, and a student, Matthew Febrian Otniel Lambok Hutasoit, stated that Law Number 27 of 2022 on Personal Data Protection (PDP Law) explicitly mandates the establishment of a personal data protection authority as an independent body responsible for administering personal data protection in Indonesia. However, as of mid-2025, the institution has yet to be formally established.
This delay has resulted in a functional authority gap, particularly in preventing violations, supervising compliance, and resolving disputes arising from personal data breaches or misuse. The Petitioners conveyed this in Petition Number 153/PUU-XXIV/2026 during the preliminary hearing before the Constitutional Court (MK) on Thursday (05/07/2026).
“This situation clearly creates a disparity between normative regulation and practical implementation, where the legal framework is already in place, but the implementing body that should ensure effective protection has yet to operate,” Pardamean stated in the Plenary Hall of Building I of the Constitutional Court, Jakarta.
Within the framework of a democratic rule of law, the Petitioners consider the delay in establishing the personal data protection authority as a form of legal uncertainty. This is because the public does not have a clear institutional reference to seek protection against personal data violations. Consequently, the supervisory function is currently carried out by the Ministry of Communication and Digital Affairs (Komdigi), which institutionally does not constitute the independent authority envisioned under the PDP Law.
The Petitioners argue that the existence of such an authority is crucial to bridging the interests of the state, business actors, and society in ensuring that personal data is managed securely and responsibly. The limited enforcement of sanctions in major data breach cases, such as Tokopedia (91 million accounts) and BPJS Kesehatan (279 million data records), serves as a reminder that the challenges in data protection are systemic. This condition is further exacerbated by the absence of the personal data protection authority and the lack of implementing regulations for the PDP Law, resulting in the state’s ineffective presence in protecting citizens’ constitutional rights.
The establishment of a personal data protection authority as an independent body responsible for administering personal data protection in Indonesia is mandated under Article 58 paragraph (2) of the PDP Law. The provision stipulates that the authority shall carry out policy formulation and determination, supervision, and law enforcement in the field of personal data protection.
However, the PDP Law does not contain any provision regulating a definite timeframe for the issuance of its implementing regulations. Article 58 paragraph (5) of the PDP Law, which states, “Further provisions regarding the authority as referred to in paragraph (2) shall be regulated by Presidential Regulation,” as well as Article 61, which provides, “Provisions regarding the procedures for the exercise of the authority’s powers as referred to in Article 60 shall be regulated by Government Regulation,” according to the Petitioners, do not stipulate any timeframe or deadline for the establishment and operationalization of the authority.
In their petitum, the Petitioners request the Court to declare Article 58 paragraph (5) and Article 61 of the PDP Law as contrary to the 1945 Constitution of the Republic of Indonesia (UUD 1945) and conditionally unconstitutional, insofar as they are not interpreted to mean:
Article 58 paragraph (5): “Further provisions regarding the authority as referred to in paragraph (2) must be established and regulated by Presidential Regulation within a maximum period of 2 (two) years from the pronouncement of this a quo decision.”
And Article 61: “Provisions regarding the procedures for the exercise of the authority’s powers as referred to in Article 60 must be regulated by Government Regulation within a maximum period of 2 (two) years from the pronouncement of this a quo decision.”
The petition was examined by a Panel of Constitutional Justices chaired by Chief Justice Suhartoyo, accompanied by Constitutional Justice Daniel Yusmic P. Foekh and Constitutional Justice M. Guntur Hamzah. During the advisory session, Guntur stated that the Petitioners could examine legislative records to identify the original intent of the lawmakers regarding the challenged provisions, ensuring that the interpretation remains aligned with the spirit of their formulation.
According to him, the Petitioners may uncover the rationale behind delegating the establishment of the authority to a Presidential Regulation and the procedures for exercising its powers to a Government Regulation. They may also identify the reasons for the absence of a specified timeframe for the authority’s establishment. Subsequently, the Petitioners should elaborate clear arguments demonstrating how the challenged provisions contradict the 1945 Constitution of the Republic of Indonesia (UUD 1945) and result in the violation of their respective constitutional rights.
“Please examine those records first—why was it designed this way? Perhaps at the time the lawmakers had not fully considered it and simply delegated it to a Presidential Regulation for establishment, with the implementing provisions to be later regulated by a Government Regulation,” Guntur remarked.
Before closing the hearing, Suhartoyo stated that the Petitioners are granted one opportunity to revise their petition within 14 days. The revised petition, both in softcopy and hardcopy, must be submitted to the Court no later than Wednesday (05/20/2026) at 12:00 PM WIB.
Author : Mimi Kartika
Editor : N. Rosi.
PR : Raisa Ayuditha M.
Translator : Agusweka PS.
Disclaimer: The original version of the news is in Indonesian. In case of any differences between the English and the Indonesian versions, the Indonesian version prevails.
Case Track: Number 153/PUU-XXIV/2026
Thursday, May 07, 2026 | 16:58 WIB 277