The Constitutional Court just clarified the meaning of Article 53(1) of the Indonesia’s personal data protection law (“PDP Law”) that the conditions triggering the requirement for data controllers or data processors to appoint a data protection officer (“DPO”) listed therein are alternative and not cumulative. This Constitutional Court ruling confirms W&P previous interpretation of Article 53(1) of the PDP Law discussed in our previous newsletter (click here).
Due to the poor drafting of the initial text of Article 53(1) of the PDP Law – specifically the use of the word “and” instead of “or” – there has been a misinterpretation that a data controller or a data processor is only obliged to appoint a DPO if all the following three conditions listed therein are met:
- it processes personal data for public services;
- its core business activities require regular and systematic large-scale monitoring of personal data; AND
- its core business activities involve large-scale processing of specific personal data (such as medical information, biometric, personal financial data) and/or personal data related to criminal matters.
The Constitutional Court Decision No. 151/PUU-XXII/2024, dated 16 July 2025, clarified the meaning of the rule to the effect that the provision is now becoming stricter because meeting just one condition under Article 53(1) of the PDP Law is sufficient to trigger the obligation to appoint a DPO. Non-compliance may potentially lead to administrative sanctions under the PDP Law, emphasizing the importance of proactive adherence to the requirement to appoint a DPO.
Further details regarding the DPO appointment—such as whether a DPO may be appointed as an individual or a team, method of appointment, competency standards—will be further regulated in implementing regulations which remain pending to date. Our team will closely monitor developments in this space and keep you informed of any updates.
In the meantime, if you would like to know more about this newsletter or receive further analysis on whether you fall under one of the conditions requiring the appointment of a DPO, please contact us at info@wplaws.com or reach out to any of our lawyers in this newsletter.