Indonesia

Dedicated supervisory body to be established. Kominfo currently oversees implementation.

Consent must be explicit, specific, and informed. Additional lawful bases similar to GDPR.

Rights to information, access, correction, deletion, restriction, objection, and portability.

Transfers to countries with equivalent or adequate protection. Implementing regulations specify criteria.

Must notify authority and affected individuals within 72 hours.

Required for certain categories of controllers processing at scale.

Parental consent required for children. Specific protections as sensitive data.

Fines up to 2% of annual revenue. Criminal penalties up to 6 years imprisonment. Enforcement mechanisms being established.

OJK financial data rules, health ministry regulations, telecom sector requirements.

No specific cookie regulation.

No specific provisions on automated decisions in the PDP Law.

GR 71/2019 previously required local processing. PDP Law eases some requirements but sector rules remain.

No direct equivalent concept.

PDP Law applies to government processing with national security exemptions.