PDP Law basics for AI users

The PDP Law, Indonesia's Law Number 27 of 2022 on Personal Data Protection, governs how personal data is collected, processed, stored and moved. Whenever you ask AI to read a CV, summarise complaints that mention names, or analyse employee data, you are processing personal data, and this law applies.

The law splits personal data in two. General personal data (Article 4(3)) covers full name, sex, nationality, religion, marital status, and data combined to identify a person. Specific personal data (Article 4(2)) covers health data and information, biometric data, genetic data, criminal records, children's data, personal financial data, and other data under the laws and regulations. Specific data carries greater risk if it leaks and calls for more care.

A person whose data is processed is called a Personal Data Subject (Subjek Data Pribadi). They have a number of rights. One of them, under Article 5, is the right to information about the identity of the party asking for their data, the legal basis, the purpose of the request and use, and that party's accountability. So an applicant whose CV will be read by AI has a right to know what their data is used for and who is responsible. Another right, specific to automated decisions, is covered in the lesson on automated decisions and people's rights.

There are two roles to recognise. The Personal Data Controller is the party that sets the purpose and controls the processing; usually that is your organisation, not you personally. The Personal Data Processor is a party that processes data on the Controller's behalf; an AI provider contracted by your organisation is often in this position, depending on the contract. This split explains why a contracted work account differs from your personal account: with a personal account, there is no contract between your organisation and the provider governing that data.

The next two duties are the ones that most often meet everyday AI use.

Transfer abroad (Article 56). Many AI services process data on servers outside Indonesia. Sending personal data there is a transfer of personal data outside Indonesia's jurisdiction. The law sets the conditions in order: the Controller must ensure the receiving country has an equal or higher level of protection; if not, there must be adequate and binding protection; if neither exists, the Controller must obtain the Personal Data Subject's consent. For you, this means: before sending personal data to an AI service, ask where the data is processed and whether your organisation has put the basis in place.

Notice of a protection failure (Article 46). If personal data protection fails, for example employee data is uploaded to the wrong place, the Controller must give written notice within 3 x 24 hours to the Personal Data Subjects and to the agency that implements data protection. The notice covers what data was exposed, when and how, and the steps to handle and recover. The organisation counts this deadline, but the first hours are in your hands: if you are the one who knows, report it internally as fast as you can.

One more duty you should know by name: the impact assessment (Article 34), which the Controller must carry out for high-risk processing, such as processing specific data, large-scale processing, or automated decisions with significant effects. If your team plans to use AI for something like that, plan the impact assessment from the start with your data protection officer.