Indonesia PDP Law

Indonesia Personal Data Protection Law (UU PDP) - data subject rights, DPO, breach notification, transfers.


Short name	ID PDP
Region	Asia-Pacific
Country or scope	Indonesia
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers ID PDP

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 7 controls from Safeguard's control catalog for ID PDP.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for ID PDP and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`ID-PDP-35` Security of Personal Data Processing	Controllers must protect and ensure the security of personal data they process, including preventing unlawful access and unauthorized alteration, which presupposes verifiable integrity of the processing software (UU PDP, Art. 35)	Scan
`ID-PDP-46` Breach Notification Within 3x24 Hours	A controller must notify data subjects and the supervisory institution of a personal data protection failure within 3x24 hours; scoping a breach that quickly requires each deployed component to be individually identifiable (UU PDP, Art. 46)	Scan
`ID-PDP-DPO` Data Protection Officer Contact	Controllers whose core activities involve large-scale or systematic processing must appoint an officer responsible for personal data protection, meaning an accountable named contact must exist for the processing systems (UU PDP, DPO appointment provisions, Arts. 53-54)	Scan
`ID-PDP-PROC` Processor Obligations	Personal data processors must process only on the controller's instruction and share responsibility for protection, so controllers must know which suppliers stand behind the components of their processing systems (UU PDP, processor obligation provisions)	Scan
`ID-PDP-ACC` Demonstrable Accountability for Processing	Controllers must be able to demonstrate that processing is carried out responsibly and in accordance with the law, which requires an enumerated record of the systems and software components performing that processing (UU PDP, controller responsibility provisions)	Scan
`ID-PDP-XBDR` Cross-Border Transfer Documentation	Transfers of personal data outside Indonesia are permitted only where the receiving jurisdiction or recipient ensures equivalent protection, requiring identified, timestamped documentation of the transferring systems for demonstration (UU PDP, cross-border transfer provisions, Art. 56)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`ID-PDP-ART4-8`	Personal Data Protection Principles
`ID-PDP-ART9-15`	Data Subject Rights Implementation
`ID-PDP-ART16-17`	Consent Requirements
`ID-PDP-ART18-21`	Lawful Processing without Consent
`ID-PDP-ART35-36`	Data Protection Officer
`ID-PDP-ART46`	Personal Data Breach Notification
`ID-PDP-ART56`	Cross-Border Data Transfer

Policy templates

Written for ID PDP:

Data Protection Officer Charter (Indonesia UU 27/2022)
Personal Data Breach Notification Procedure (Indonesia UU 27/2022 Article 46)
Consent Management Policy (Indonesia UU 27/2022 Articles 16-21)

And 22 from the standard set, adapted to ID PDP.