Digital platforms such as Facebook and Instagram are known to store\nuser data outside of Indonesian territory. Wahyudi Djafar, Executive\nDirector of Catalyst Policy-Works, explained that the Personal Data\nProtection Law (UU PDP) does not specifically mandate data localisation\nor the determination of physical data storage locations.<\/p>\n
According to him, the UU PDP focuses more on regulating the\nmechanisms of personal data transfers, including when data is sent from\nwithin the country to abroad. Meanwhile, technical provisions regarding\ndata storage are regulated under Government Regulation (PP) Number 71 of\n2019, which is further detailed through Ministry of Communication and\nDigital Affairs Regulation Number 5 of 2025 concerning Electronic System\nProviders (PSE) in the public scope.<\/p>\n
\u201cThere is a classification of public data and how the storage process\nworks,\u201d Wahyudi told CNBC Indonesia via telephone on Wednesday\n(16\/9\/2026).<\/p>\n
Wahyudi explained that the UU PDP allows the personal data of\nIndonesian citizens to be transferred abroad, provided that the\ndestination country has a level of legal protection equivalent to\nIndonesia\u2019s PDP regulations. This provision is clearly stated in Article\n56 of the UU PDP. The absolute requirement for this cross-border data\ntransfer is the equivalence of personal data protection levels between\nIndonesia and the destination country.<\/p>\n
\u201cSo, the main requirement is equivalence. If that equivalence is not\nachieved, it means it does not exist. For example, if data is to be\ntransferred to the United States, but it turns out the United States is\nnot considered equivalent to Indonesia,\u201d he explained.<\/p>\n
Nevertheless, if the destination country does not meet that level of\nequivalence, the data transfer process can still proceed through certain\nexceptions. One valid legal loophole is obtaining explicit consent from\nthe data subject involved.<\/p>\n
\u201cTherefore, the exception clause allows transfers to proceed if there\nis explicit consent\u2014clear permission from the data subject allowing\ntheir data to be transferred abroad,\u201d said Wahyudi.<\/p>\n
He added that the mechanism for assessing the level of equivalence of\nthe destination country has been further regulated through PP Number 33\nof 2026. This regulation contains various obligations that data\ncontrollers must comply with when intending to move personal data from\nIndonesia outside the country\u2019s sovereign territory.<\/p>\n
One of the primary obligations for data controllers is to conduct a\nrisk assessment of the data transfer scheme being implemented.<\/p>\n
\u201cUnfortunately, regarding how to conduct the risk assessment, the\nprocess and details will eventually be regulated through guidelines\nissued by the Personal Data Protection Agency,\u201d he revealed.<\/p>\n
Crucial Issues in Protecting Indonesian Citizens\u2019 Personal\nData<\/strong><\/p>\n According to Wahyund, the fundamental problem arises because the\nPersonal Data Protection Agency, which should serve as the primary\nreference for executing these functions, has not yet been formed.\nTechnical guidelines regarding risk assessments are also not yet\navailable.<\/p>\n In addition to risk assessments, the Personal Data Protection Agency\nwill also hold full authority to assess the level of legal protection\nequivalence in the destination countries for personal data\ntransfers.<\/p>\n Wahyudi believes this institutional vacuum is a serious obstacle to\nthe implementation of cross-border personal data transfer regulations.\nHe noted that although the substantive requirements for transfers have\nbeen normatively regulated, the operational technical rules and the\noverseeing supervisory body are not yet fully functional.<\/p>\n \u201cThat is the problem. So, even though the transfer requirements and\nthe obligations of data controllers when transferring personal data from\nIndonesia to outside Indonesia have been regulated, the technical\nregulatory reference is still non-existent,\u201d he emphasised.<\/p>\n He also stressed that the presence of such an agency is a crucial\nelement for the UU PDP to be implemented optimally in the field. The\nagency, according to him, must be supported by adequate authority so\nthat the UU PDP can be applied effectively.<\/p>\n \u201cTherefore, without a strong and independent Personal Data Protection\nAgency, it will be difficult for the UU PDP to be implemented\neffectively,\u201d he concluded.<\/p>",
"url": "https:\/\/jawawa.id\/newsitem\/indonesian-citizens-data-stored-abroad-experts-issue-warning-1789639160",
"image": ""
},
"sponsor": "Okusi Associates",
"sponsor_url": "https:\/\/okusiassociates.com"
}