JAKARTA, (MKRI) – The Petitioners in Case Number 153/PUU-XXIV/2026 submitted a revised petition for the judicial review of Law Number 27 of 2022 on Personal Data Protection (PDP Law) to the Constitutional Court (MK) on Wednesday (05/20/2026). According to the Petitioners, the government’s delay in carrying out its statutory obligation to establish a personal data protection authority constitutes an unconstitutional act because it contradicts the principles of the rule of law, as enshrined in Article 1 paragraph (3) and Article 28D paragraph (1) of the 1945 Constitution of the Republic of Indonesia (UUD 1945).
“Besides being contrary to the principles of the rule of law and legal certainty, the delay in implementing the obligation imposed by law upon the government under Law Number 27 of 2022 on Personal Data Protection also reflects a deviation from the principle of effective enforcement of a legal norm,” said student Matthew Febrian Otniel Lambok Hutasoit, alongside Legal Consultant Pardamean Sihombing, Advocate Eprina Manurung, and Advocate Christian Adrianus Sihite as the Petitioners at the MK courtroom in Jakarta.
The Petitioners also supplemented their revised submission with a comparative table outlining personal data protection efforts in foreign jurisdictions such as the European Union and Singapore. The European Union has the General Data Protection Regulation (GDPR), regarded as one of the strictest privacy and data security frameworks in the world. Meanwhile, Singapore has the Personal Data Protection Act (PDPA), which requires companies to safeguard personal data, ensure transparency, and obtain the consent of data subjects before processing their information.
The Petitioners stated that recent developments demonstrate an increasingly urgent need for an effective personal data protection system in Indonesia. Most recently, Bank Indonesia officially launched cross-border QRIS payment services with China, effective as of April 30. This initiative marks the growing integration of Indonesia’s digital payment system into the global ecosystem, which directly involves the exchange and processing of personal data across jurisdictions.
According to the Petitioners, this situation increases the risk of misuse of personal data and demands higher protection standards, including certainty regarding supervisory authorities, complaint mechanisms, and cross-border law enforcement. They argued that such conditions directly heighten the risks of data breaches, misuse, and the erosion of legal control over citizens’ personal data.
In their petitum, the Petitioners requested the Court to declare Article 58 paragraph (5) and Article 61 of the PDP Law contrary to the 1945 Constitution of the Republic of Indonesia (UUD 1945) and conditionally unconstitutional, insofar as they are not interpreted to mean that further provisions concerning the authority referred to in paragraph (2) must be established and regulated through a Presidential Regulation within no later than two years from the pronouncement of the a quo decision. They further requested that Article 61 of the PDP Law be declared contrary to the 1945 Constitution of the Republic of Indonesia (UUD 1945) and conditionally unconstitutional insofar as it is not interpreted to require that procedures governing the exercise of the authority referred to in Article 60 be regulated through a Government Regulation within no later than two years from the pronouncement of the a quo decision.
Read also:
Absence of an Independent Personal Data Protection Authority
During the preliminary hearing, the Petitioners stated that the PDP Law explicitly mandates the establishment of a personal data protection authority as an independent body responsible for administering personal data protection in Indonesia. However, by mid-2025, the institution had yet to be formally established.
This delay created a vacuum in functional authority, particularly in preventing violations, supervising compliance, and resolving disputes arising from personal data breaches or misuse. Within the framework of a democratic rule of law, the Petitioners argued that the delay in establishing the personal data protection authority may be viewed as a form of legal uncertainty.
The case was heard before a Panel of Constitutional Justices chaired by Chief Justice Suhartoyo, accompanied by Constitutional Justices Daniel Yusmic P. Foekh and M. Guntur Hamzah. Suhartoyo stated that the Panel would report the petition during the justices’ deliberation meeting to determine whether the case would proceed to further examination in a plenary hearing or be decided without such hearing.
Author : Mimi Kartika
Editor : N. Rosi.
PR : Raisa Ayuditha M.
Translator : Agusweka PS.
Disclaimer: The original version of the news is in Indonesian. In case of any differences between the English and the Indonesian versions, the Indonesian version prevails.
Case Track: Number 153/PUU-XXIV/2026
Thursday, May 21, 2026 | 12:41 WIB 175