The Indonesian public is currently in an uproar over the issue of the United States government gaining access to the personal data of Indonesian citizens. This issue arose from the upcoming agreement between the United States and Indonesia, which will see them enter into a Reciprocal Trade Agreement. According to a TEMPO report, an official White House document released on Tuesday, July 22, 2025, local time, states that one of the key points of this collaboration is the management of Indonesian citizens' personal data by the United States.

“Indonesia has committed to addressing barriers affecting digital trade, services, and investment. Indonesia will provide certainty regarding the ability to transfer personal data out of its territory to the United States,” the document states.

President Prabowo Subianto stated that negotiations between the governments of the Republic of Indonesia and the United States are still ongoing. This was conveyed at the National Awakening Day celebration at the Jakarta Convention Center (JCC) in Senayan, Jakarta, on Wednesday, July 23, 2025.

“Indonesia will provide certainty regarding its willingness to transfer personal data out of its territory to the United States, by recognizing the US as a country or jurisdiction that provides adequate data protection under Indonesian law.”

From the statement above regarding the commitment to ensure the transfer of personal data, we can examine it from the perspective of existing regulations in Indonesia that govern personal data, especially since Indonesia has the Personal Data Protection Law, Law Number 27 of 2022 concerning Personal Data Protection. Regarding the Transfer of Personal Data outside the territory of the Republic of Indonesia, this is regulated in Article 56 paragraphs (2), (3), (4):

(2) "...the Personal Data Controller is obliged to ensure that the country where the Personal Data Controller and/or Personal Data processor receiving the transfer of personal data has an equivalent or higher level of Personal Data Protection..." (3) "If the provisions in paragraph (2) are not met, the Personal Data Controller is obliged to ensure that there is adequate and binding Personal Data Protection."

(4) "If the provisions referred to in paragraphs (2) and (3) are not met, the Personal Data Controller is required to obtain the consent of the Personal Data Subject."

Therefore, under these provisions, if personal data is transferred outside of Indonesian jurisdiction, it is mandatory to ensure that the country receiving the Personal Data transfer has data protection at the same level or higher than that of Indonesia. If this cannot be met, the Personal Data Controller is required to obtain the consent of the Personal Data Subject, namely the party who owns the Personal Data.

Sanctions for non-fulfillment of the provisions of Article 56 are also regulated in the Personal Data Protection Law, namely Administrative Sanctions in Article 57 paragraphs (2), (3), and (4).
Paragraph (2) includes:

a. Written Warning;
b. Temporary Suspension of Personal Data Processing Activities;
c. Deletion or Destruction of Personal Data and/or;
d. Administrative Fines.
Paragraph (3) Administrative sanctions in the form of an administrative fine as referred to in paragraph (2) letter d shall be a maximum of 2 (two) percent of annual revenue or annual receipts for the violation variable.
Paragraph (4) The imposition of administrative sanctions as referred to in paragraph (2) shall be imposed by the Institution.

However, to date, the Indonesian government has not yet established an Institution to oversee the implementation of Personal Data Protection. It is hoped that the existence of such an Institution will oversee the transfer of personal data within Indonesia and outside of Indonesia, considering the existing trade agreement between Indonesia and the United States, which provides certainty regarding the ability to transfer personal data from its territory to the United States.

This institution's role is to ensure that the Indonesian Personal Data Protection Law is enforced and that the Indonesia-United States agreement is implemented in accordance with applicable Indonesian laws and regulations.