Minister of Communication and Digital: No Transfer of Indonesian Citizens' Personal Data to the US
The Minister of Communication and Digital, Meutya Hafid, has guaranteed that the government is not transferring the personal data of Indonesian residents to the United States government under the Reciprocal Trade Agreement (ART). The Golkar politician stated that the data transfers involved are part of the governance of data flows for digital ecosystem activities or digital trade.
“This is within the framework of trade. We must emphasise that this does not mean there is a transfer, or that this regulates the transfer of population data by the Indonesian Government to the United as Government. That is entirely incorrect,” Meutya said during a working meeting with Commission I of the House of Representatives in Jakarta on Monday, 18 May 2026.
The personal data transfer clause is regulated in Article 3.2 of the Indonesia-US ART, agreed upon by both nations on 19 February 2026. The article requires Indonesia to provide certainty regarding the ability to transfer personal data to the US based on Indonesian law.
Meutya highlighted the phrase ‘under Indonesian law’ within the agreement’s clause. The legal umbrella referred to is Law Number 27 of 2022 concerning Personal Data Protection (UU PDP), specifically Article 56.
According to her, as long as that regulation is in effect, data transfers to the US will have legal protection and proceed in accordance with applicable regulations. “So, Ladies and Gentlemen, we have locked this in with three closing words: it is under Indonesia’s law. This means it must continue to follow and comply with the laws applicable in Indonesia,” said Meutya.
Article 56 of the UU PDP stipulates that the transfer of personal data abroad can only be carried out if the destination country has an equivalent or higher level of data protection, there is adequate protection through contractual agreements, or there is explicit consent from the data owner. This is to ensure the destination country maintains standards equal to or higher than Indonesia’s to safeguard the security of Indonesian citizens’ data. However, to date, the United States does not yet have a comprehensive federal personal data protection law.
Consequently, Meutya stated that to meet the provisions of Article 56, the assessment of the level of data protection in the US must be conducted by the Indonesian personal data protection agency. However, this agency is still in the formation stage.
“Therefore, the recognition of the United States as a country with equivalent protection must, once again, go through an assessment procedure conducted according to the principles of the UU PDP and its regulations,” Meutya added.
The results of the negotiations between President Prabowo Subianto and US President Donald Trump regarding the scale of reciprocal tariffs have drawn criticism from various parties, including the issue of personal data transfer.
Wahyudi Djafar, Director of Public Policy at Raksha Initiatives, explained that the criticism is based on the fact that internal issues in Indonesia, particularly the implementation of the UU PDP, have not been resolved. “If the UU PDP situation were well-implemented and the PDP agency had been formed, perhaps this would not be an issue,” Wahyudi said when contacted on Saturday, 26 July 2025.
He noted that the UU PDP, specifically Article 56, does allow for cross-border personal data transfers provided the receiving country has legal provisions at least equivalent to Indonesia’s UU PDP or higher. If these requirements cannot be met, exceptions exist through the formation of international agreements. However, he questioned whether the international agreement between Indonesia and the US possesses standards that guarantee the protection of personal data.
“This is what needs to be explained. If in our data protection law we recognise Standard Contractual Clauses (SCC), then American companies must conduct data transfers in accordance with the laws applicable in Indonesia,” said Wahyudi.
However, he noted that another issue driving criticism regarding these transfers is the lack of explanation regarding the mechanism for resolution in the event of a data breach in the United States, and to whom Indonesian citizens should lodge a complaint. According to him, what Indonesia has established with the United States regarding data transfer only addresses the legal basis without providing an explanation of the protection and resolution mechanisms.