Indonesian Constitutional Cases Challenge PDP Law

Abstract

A two-year grace period has come and gone since Indonesia’s first omnibus Personal Data Protection Act (PDP Law) was enacted in 2022 and the law came into full effect on 17 October 2024. However, two vital signs of life, implementing regulations and appointment of a data protection authority, are still nowhere to be seen.

Despite this general inaction, the PDP Law has come under the limelight of two judicial review cases in Indonesia’s Constitution Court (MKRI), both involving important interpretations of the PDP Law.

The first case, concerning data exports, was decided against the backdrop of the US-Indonesia Agreement on Reciprocal Trade signed on 19 February 2026, and providing that ‘Indonesia shall provide certainty regarding the ability to move personal data out of its territory to the United States by recognizing the United States as a country or jurisdiction that provides adequate data protection under Indonesia’s law’. Despite this wording, Indonesian authorities insist this is not a commitment to do anything beyond applying Indonesian law.

The petitioner to the MKRI argued that Article 56 of the PDP Law, unless interpreted very narrowly, would result in breaches of Indonesia’s constitution. contending that the US-Indonesia Agreement concerned the transfer of Indonesians’ personal data, without their consent and could result in significant constitutional harm to the Indonesian people, in violation of the 1945 Constitution.

The MKRI did not consider that any of the additions proposed by the petitioner needed to be read into Article 56 in order for it to be consistent with Indonesia’s constitution. But it did not clarify whether a data sharing agreement between the US and Indonesia (which had been announced but is not yet completed) would be likely to be classified as requiring an adequacy decision, or regarded as already constituting adequate and binding personal data protection, or still requiring individual consent.

The second case, initiated by the Civil Society Coalition for Freedom of Information and Personal Data (SIKAP) argued that provisions in the PDP Law concerning disclosure of personal data provisions under the PDP Law should be interpreted constitutionally by accommodating forms of expression that are based on legitimate public interest.

The MKRI rejected this, essentially stating that Article 65 paragraph (2) of the PDP Law is constitutional since ‘unlawful’ disclosure must be viewed alongside other relevant laws which provide protection to these interests.

Keywords: Indonesia, Constitutional Court, MKRI, data protection, privacy, Personal Data Protection Act, Treaties