From Regulation to Protection: Bridging the Implementation Gap of Indonesia’s Personal Data Protection Law is Safe Nusa’s first policy brief, examining the challenges in implementing Law No. 27 of 2022 on Personal Data Protection (PDP Law). Using a mixed-methods approach that combines a comparative analysis of Indonesia’s PDP Law and the European Union’s General Data Protection Regulation (GDPR), a survey of 209 respondents, and in-depth interviews with seven experts and practitioners, this study identifies the gap between legal protections and their implementation in practice. The findings reveal that 83.3% of respondents were unaware of the actual status of Indonesia’s data protection supervisory authority, only 33.5% expressed trust in government institutions to protect their personal data, and 96.2% called for stronger enforcement of data protection laws.
This policy brief emphasizes that strengthening personal data protection in Indonesia requires more than establishing regulations. It also demands effective institutions, consistent law enforcement, organizational compliance, and citizens who understand and can exercise their data protection rights. Safe Nusa proposes five key policy recommendations: operationalizing a data protection supervisory authority with functional independence, strengthening coordination among regulatory bodies, establishing accessible complaint and redress mechanisms, promoting measurable improvements in data protection literacy, and encouraging risk-based compliance and the adoption of privacy by design, including in the development of AI and emerging technologies. These recommendations are accompanied by a 2027–2031 implementation roadmap aimed at fostering more effective, accountable, and adaptive personal data governance in Indonesia.
Share this article