Overview

This edition of Indonesian Law Digest (“ILD”) picks up where the previous first and second parts of this four-part series on personal data (“Data”) protection left off. The first two parts offered an extensive analysis of Data classifications, the rights of Data subjects (“Subjects”) and various aspects relating to Data processing (“Processing”). This time around, this third part in our ongoing series on Data protection addresses matters that relate to Data transfers, including classifications and the requirements that Data controllers (“Controllers”) and/or Data processors (“Processors”) are required to fulfill whenever engaging in Data transfers. While Data transfers are essentially classified as Processing activities, we have decided to address this area separately, given its importance and the fact that Data transfers are Processing activities that are highly vulnerable to Data breaches.