Data Often Leaks Without

Supervisory Institution, This is the

Fate of Indonesian Citizens

Jakarta, CNBC Indonesia –The Personal Data Protection Supervisory Institution (PDP) has not been formed until March 2025. In fact, one of the mandates in the Personal Data Protection Law (UU PDP) is the formation of the PDP Institution.

Its functions and authorities are stated in Article 59 and Article 60 of the PDP Law. One of them is tasked with supervising the implementation and enforcement of administrative law on violations of the Law.

Given the important role of this institution, will the PDP Law still apply?

Deputy Chairman of Commission I of the Indonesian House of Representatives, Dave Laksono, said that the PDP Law remains in effect and running even though the supervisory institution has not been formed. This is because the rules in the law bind all parties since it was enacted.

“Currently, supervision is still being carried out by the relevant Directorate at the Ministry of Communication and Digital (Kemkomdigi) until the Personal Data Protection Supervisory Agency is officially formed,” Dave told CNBC Indonesia, quoted Monday (17/3/2025).

According to him, based on the information obtained, currently the derivative regulations of Law Number 27 of 2022 concerning PDP are in the process of being harmonized at the Ministry of Law.

The derivative regulations include the Government Regulation (PP) which is the basis for implementing the PDP Law, and the Presidential Regulation (Perpres) for the establishment of the Personal Data Protection Supervisory Agency.

Dave said that the government needs time to finalize the establishment of the PDP Institution, considering the urgency and complexity of the task. This process must also ensure that the Personal Data Protection Supervisory Agency has sufficient independence so that it can carry out its functions optimally without excessive intervention.

“Commission I will continue to monitor this development and encourage the government to accelerate the completion of derivative regulations and ensure that the institution that is formed later has sufficient capacity to protect people’s personal data,” said Dave.

SOURCE : CNBC INDONESIA