UU 27/2022 (PDP Law) Arts. 10 and 34 — objection to solely-automated decisions and mandatory impact assessment
Binds Personal-data controllers ('Pengendali Data Pribadi') within the scope of Art. 2: any person, public body or international organisation acting inside Indonesian jurisdiction, and those outside it whose acts have legal effect in Indonesia or affect Indonesian data subjects abroad. Processing by a natural person for purely personal or household activity is excluded. Impact tier: all entities.. Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi is Indonesia's general data-protection statute. Art. 10(1) gives the data subject the right to object to a decision taken solely on the basis of automated processing, including profiling, that produces legal effects or has a significant impact on them; Art. 10(2) leaves the procedure for lodging that objection to a Government Regulation (Peraturan Pemerintah). Art. 34(1) separately obliges the personal-data controller to carry out a personal-data-protection impact assessment where processing carries a high potential risk to the data subject, and Art. 34(2)(a) lists automated decision-making with legal effect or significant impact on the data subject as the first such high-risk category — alongside large-scale processing, systematic evaluation, scoring or monitoring, data matching or combination, and the use of new technologies. The elucidation of Art. 10(1) defines 'pemrofilan' as electronically identifying a person by reference to matters including employment history, economic condition, health, personal preferences, interests, reliability, behaviour, location or movements.
Enacted and promulgated in Jakarta on 17 October 2022; Lembaran Negara 2022 No. 196, Tambahan Lembaran Negara No. 6820. Art. 76 provides that the Act enters into force on the date of promulgation, so 17 October 2022 is the in-force date. Art. 74 is a transitional rule, not a deferred commencement: controllers, processors and other parties involved in personal-data processing were given at most two years from promulgation to align their processing with the Act, so the adjustment window closed on 17 October 2024 and the duties are now fully exigible. Two implementation caveats, both verified rather than assumed. First, no Government Regulation implementing the Act has been issued: a search of the Sekretariat Negara legal database returns no PP under UU 27/2022, and the Komdigi JDIH record for the Act carries an empty 'Peraturan Pelaksanaan' section. The Art. 10(2) objection procedure and the Art. 34(3) impact-assessment procedure therefore still lack their detailed rules. Second, Art. 57(1) lists the provisions carrying administrative sanctions and Art. 34(1) is on that list while Art. 10 is not — the sanctioned duty is the impact assessment, while the Art. 10 right is exercised through the supervisory body and the dispute-resolution route of Chapter XIII. Indonesia's peer of br-lgpd-art20, cn-pipl-art24, kr-pipa-art37-2-adm, ar-ley25326-art20 and cl-ley21719-art8bis: like Brazil and Argentina it is already in force, and like Chile it pairs the objection right with a mandatory impact assessment, but unlike Korea it grants no express right to an explanation or to human re-processing. Text read in the full statutory text published by the JDIH of the Kementerian Komunikasi dan Digital, the ministry of record for the Act; the Sekretariat Negara salinan (LN 2022/196) is a scanned image and carries no text layer, and peraturan.bpk.go.id returned HTTP 403 to every request.
Stated maximum penalty — Administrative sanctions under Art. 57 for breach of the Art. 34(1) impact-assessment duty: written warning, temporary suspension of processing, erasure or destruction of the personal data, and/or an administrative fine of at most 2 per cent of annual revenue or annual receipts measured against the variable of the violation, imposed by the supervisory body. Art. 57(5) leaves the procedure for imposing those fines to a Government Regulation that has not yet been issued.