Data Controller Responsibility In The Event Of Data Breach

This article discusses data controller liability in the event of a data breach for Indonesian data subjects.

The principal regulation is Law 27 of 2022 on Personal Data Protection (“PDPA”). Please refer to  this article for an overview of the PDPA.

Data breaches encompass incidents when the data controller system is hacked resulting in hackers gaining access to personal data and releasing such personal data on the web because their demand for ransom is not satisfied. A data breach can also happen when a company employee whether intentionally or immensely releases personal data into the public domain. For the purpose of this article, data breach refers to a situation when a data controller system has been hacked and personal data is disclosed. This is because such type of breaches seems prevalent in Indonesia.