Indonesia's New Personal Data Protection Law And The Impact On M&A Transactions

Indonesia's new Personal Data Protection Law ("PDP Law") is the country's first comprehensive law to govern personal data protection in both electronic systems and non-electronic systems. However, until the necessary implementing regulations are issued, it remains to be seen just how the PDP Law will be implemented or its impact on M&A transactions.

On the face of it, the PDP Law requires corporate Personal Data Controllers (defined in the law as any person, public entity, or international organization acting individually or jointly in determining the objectives and exercising control over the processing of personal data) to notify the relevant Personal Data Subjects (defined as every individual to whom the personal data is attached) before and after conducting an M&A transaction. This notification may be carried out by way of direct notification to the Personal Data Subjects or via a public announcement through the mass media, whether electronically or