UU 27/2022 (PDP Law) Arts. 10 and 34 — objection to solely-automated decisions and mandatory impact assessment
Binds Personal-data controllers ('Pengendali Data Pribadi') within the scope of Art. 2: any person, public body or international organisation acting inside Indonesian jurisdiction, and those outside it whose acts have legal effect in Indonesia or affect Indonesian data subjects abroad. Processing by a natural person for purely personal or household activity is excluded. Impact tier: all entities.. Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi is Indonesia's general data-protection statute. Art. 10(1) gives the data subject the right to object to a decision taken solely on the basis of automated processing, including profiling, that produces legal effects or has a significant impact on them; Art. 10(2) leaves the procedure for lodging that objection to a Government Regulation (Peraturan Pemerintah). Art. 34(1) separately obliges the personal-data controller to carry out a personal-data-protection impact assessment where processing carries a high potential risk to the data subject, and Art. 34(2)(a) lists automated decision-making with legal effect or significant impact on the data subject as the first such high-risk category — alongside large-scale processing, systematic evaluation, scoring or monitoring, data matching or combination, and the use of new technologies. The elucidation of Art. 10(1) defines 'pemrofilan' as electronically identifying a person by reference to matters including employment history, economic condition, health, personal preferences, interests, reliability, behaviour, location or movements.
Enacted and promulgated in Jakarta on 17 October 2022; Lembaran Negara 2022 No. 196, Tambahan Lembaran Negara No. 6820. Art. 76 provides that the Act enters into force on the date of promulgation, so 17 October 2022 is the in-force date. Art. 74 is a transitional rule, not a deferred commencement: controllers, processors and other parties involved in personal-data processing were given at most two years from promulgation to align their processing with the Act, so the adjustment window closed on 17 October 2024 and the duties are now fully exigible. Two implementation caveats, both verified rather than assumed. First, the implementing Government Regulation has since been issued: Peraturan Pemerintah No. 33 Tahun 2026 tentang Pelindungan Data Pribadi, signed 16 July 2026, which enters into force 16 January 2027 and sets out the procedure for objecting to automated processing (Art. 10(2)) and for personal-data-protection impact assessments (Art. 34(3)), among other implementing rules; until then those procedures remain undetailed. Provenance flag, 10 September 2026: that Government Regulation is so far attested only by commercial legal databases and press reporting and is NOT yet confirmable against any primary Indonesian corpus, so its number, its 16 July 2026 signature date and its 16 January 2027 commencement are unverified pending the official salinan. Checked and ruled out: the JDIH of the Kementerian Sekretariat Negara, whose 2026 collection ceilings at 2 July 2026 across every instrument type — the highest Peraturan Pemerintah on file is No. 31 of 2026, promulgated 2 July — so PP 33 lies beyond the corpus ceiling rather than being absent from it; the JDIH of the Kementerian Komunikasi dan Digital, the ministry of record, whose entry for UU 27/2022 still reports «Peraturan Pelaksanaan: Data belum Tersedia»; peraturan.bpk.go.id, which returns HTTP 403 to every request; jdihn.go.id, the national JDIH portal, which refuses the connection; and peraturan.go.id, which does not resolve. One secondary account puts commencement at 15 rather than 16 January 2027, a further reason to hold the date open. Nothing in the row's own duties, dates or lifecycle turns on this paragraph. Second, Art. 57(1) lists the provisions carrying administrative sanctions and Art. 34(1) is on that list while Art. 10 is not — the sanctioned duty is the impact assessment, while the Art. 10 right is exercised through the supervisory body and the dispute-resolution route of Chapter XIII. Indonesia's peer of br-lgpd-art20, cn-pipl-art24, kr-pipa-art37-2-adm, ar-ley25326-art20 and cl-ley21719-art8bis: like Brazil and Argentina it is already in force, and like Chile it pairs the objection right with a mandatory impact assessment, but unlike Korea it grants no express right to an explanation or to human re-processing. Text read in the full statutory text published by the JDIH of the Kementerian Komunikasi dan Digital, the ministry of record for the Act; the Sekretariat Negara salinan (LN 2022/196) is a scanned image and carries no text layer, and peraturan.bpk.go.id returned HTTP 403 to every request.
Stated maximum penalty — Administrative sanctions under Art. 57 for breach of the Art. 34(1) impact-assessment duty: written warning, temporary suspension of processing, erasure or destruction of the personal data, and/or an administrative fine of at most 2 per cent of annual revenue or annual receipts measured against the variable of the violation, imposed by the supervisory body. Art. 57(5) leaves the procedure for imposing those fines to a Government Regulation; Peraturan Pemerintah No. 33 Tahun 2026, signed 16 July 2026 and in force from 16 January 2027, is the regulation now issued. That regulation is reported rather than primary-source-confirmed, and the fine-imposition procedure therefore remains unconfirmed — see status_note.