Data Protection And Cybersecurity In Indonesia: Sensitive Data

Indoensia's Electronic Information Law, Government Regulation 82 regarding the Implementation of Electronic Systems and Transactions, and MOCI Regulation 20 regarding the Pro­tection of Personal Data in Electronic Systems (jointly referred to as the PDP Regulations) do not provide a specific definition of sensitive data, and consequently no special issues apply. There are, however, several laws in a number of specific areas that indirectly deal with data privacy relating to financial, health and communications data.

Financial service providers are prohibited by Article 31 of Financial Services Authority (Otoritas Jasa Keuangan or "OJK") Regulation No. 1/POJK.07/2013 regarding financial consumer protection ("POJK No. 1/2013") from disclosing customer data and/or information to third parties, unless they receive written consent from the cus­tomer or are required to by lawful authority. If a financial service-provider obtains the personal data and/or informa­tion of a