Personal Data Protection Law Challenged at Constitutional Court, Petitioners Highlight Risks of Data Transfer to the US
JAKARTA, KOMPAS.com - Four Indonesian citizens have filed a judicial review of Article 62 paragraph (2) of Law Number 27 of 2022 on Personal Data Protection (UU PDP) with the Constitutional Court (MK).
This petition was triggered by concerns over the increasing risk of personal data misuse following the reciprocal trade agreement between Indonesia and the United States.
In the preliminary examination hearing for case Number 133/PUU-XXIV/2026 on Wednesday (22/4/2026), the petitioners were Muhammad Fakhri Hadisyah Putra along with Fairuz Najwa Sahara Tanjung, Dela Puspita Ainnur Fadillah, and Muhammad Rizky Fadhillah.
“The issue of cross-border personal data transfer must not be reduced solely to technical administrative matters or digital trade,” stated the petitioners during the hearing.
The challenged article stipulates that international cooperation shall be carried out in accordance with statutory regulations and principles of international law.
However, the petitioners consider this norm to conflict with Article 28G paragraph (1) of the 1945 Constitution regarding the right to self-protection and a sense of security.
According to the petitioners, the regulation does not provide clarity on the scope, mechanisms, and types of data that may be transferred abroad.
“The petitioners also emphasise that the ambiguity of this norm has had real implications because the government uses that construction in the context of the Indonesia-United States Agreement,” they said.
They also view personal data transfer not merely as an administrative or trade issue.
“Personal data protection must be placed within the framework of human rights, not solely within an administrative framework,” they explained.
Personal data, according to the petitioners, is part of human rights that must be protected to the maximum extent.
“Yet when this issue is placed only as a technical matter, democratic oversight becomes weak and the honourable role of the DPR can be sidelined. What is at stake is the constitutional rights of citizens over their own personal data,” they clarified.