Personal Data Protection in the Artificial Intelligence Era: Evaluating the Implementation of Indonesia’s Law No. 27 of 2022
TL;DR
It was concluded that effective protection required stronger supervision, clearer implementing rules, enforceable accountability, privacy-by-design practices, improved cyber security, and sustained public digital-literacy programs.
Abstract
This study evaluated the implementation of Indonesia’s Law No. 27 of 2022 on Personal Data Protection in the context of rapid digitalization and artificial intelligence. A socio-legal empirical design was employed by combining statutory and conceptual analysis with questionnaire data from 49 respondents and qualitative stakeholder material. The findings showed that the Law established a substantially stronger rights-based framework, including rights of access, correction, erasure, withdrawal of consent, data portability, and objection to solely automated decisions. Nevertheless, implementation remained uneven. Respondents demonstrated moderate awareness of data-subject rights, while perceived protection, government socialization, complaint accessibility, deterrent effect, and overall effectiveness remained limited. Artificial intelligence intensified these implementation challenges because profiling, biometric processing, model training, and automated decision-making increased the scale and opacity of personal-data processing. The study concluded that effective protection required stronger supervision, clearer implementing rules, enforceable accountability, privacy-by-design practices, improved cyber security, and sustained public digital-literacy programs.