Legal Certainty of Personal Data Protection in Indonesia: A Legal Analysis of the Implementation of Law No. 27 of 2022

Abstract

The development of information technology has triggered an increase in incidents of digital data exploitation, prompting the birth of Law Number 27 of 2022 concerning Personal Data Protection (UU PDP) as the main legal instrument (lex specialis). This research aims to analyze the legal certainty of personal data protection after the full enactment of the PDP Law and identify juridical obstacles in its implementation in Indonesia. The research method used is normative law (doctrine) with a statutory approach and a conceptual approach. The research results show that the PDP Law has provided a strong normative framework by emphasizing the rights of data subjects, the obligations of data controllers, as well as strict administrative and criminal sanctions. However, the principle of legal certainty is still hampered by the lack of formalization of the independent PDP Authority Supervisory Institution in accordance with the mandate of Article 58, as well as the incomplete completion of several crucial derivative regulations. This condition triggers temporary dualism of supervision and hampers the optimization of corporate sanctions enforcement. This research concludes that accelerating the formation of the Presidential Regulation on PDP Bodies and strengthening the competence of Data Protection Officers (DPO) in each sector is an absolute prerequisite for realizing just legal certainty in Indonesia’s digital space.