Data Transfer to the U.S.: Association Urges Legal Certainty and Establishment of PDP Agency

The Indonesian Data Protection Practitioners Association (APPDI) considers the joint statement between Indonesia and the United States regarding the transfer of personal data to be unilateral, following the reduction of reciprocal tariffs to 19 percent. This issue relates to the three layers of cross-border data transfer as stipulated in Article 56 of Law No. 27 Tahun 2022 (“ PDP Law ”) on Personal Data Protection (“ PDP ”).

“Data transfers can only be made to 'adequate' countries, meaning those that have data protection measures equivalent to Indonesia's. Considering that the US system is federal, it means not all states have regulations equivalent to the PDP Law,” said Bernhard Ruben Fritz Sumiga, an Analyst of APPDI to Hukumonline.

If a country is not deemed adequate, data transfers can still be carried out with the explicit consent of the data subject. Therefore, there must be a written agreement between Indonesia and the US regarding the Data Sharing Agreement & Safeguards (“ DSA ”) to ensure that data protection remains in effect.

Although the Coordinating Ministry for Economic Affairs states that the data being transferred is only “commercial data,” this information remains very unclear, as e-commerce data still contains elements of personal identity.

“To ensure accountability and provide legal certainty, the government must immediately establish a PDP Agency as an independent referee, including technical regulations as a mechanism for assessment and transparency in bilateral agreement on data,” he explained.