Data Protection And Cybersecurity In Indonesia: Enforcement And Litigation

The Electronic Information Law, Government Regulation 82 regarding the Implementation of Electronic Systems and Transactions, and  of Communication and Informatics MOCI) Regulation 20 regarding the Pro­tection of Personal Data in Electronic Systems (jointly referred to as the PDP Regulations) do not provide much detail on the standards that must be established by regulators in Indonesia to allege violations of privacy or data protection laws.

In the absence of specific standards, in order to allege violations of privacy or data protection laws, a regulator is bound by the standards under the applicable criminal laws in Indonesia. Indonesian criminal law requires a regulator to put forward a minimum of two pieces of evidence in order to establish an allegation of any criminal violation. Under the Electronic Information Law, any electronic document would constitute lawful evi­dence.