Almost every business website and app collects personal data, from names, WhatsApp numbers, and emails to addresses and user locations. Since Law No. 27 of 2022 on Personal Data Protection (UU PDP) took full effect after its two-year transition period ended in October 2024, handling that data carries clear legal consequences in Indonesia.
This article summarizes the main obligations from the perspective of website and app owners, along with a technical checklist you can apply right away.
Note: this article is general information, not legal advice. For specific cases, consult a legal professional.
Who Must Comply?
The law applies to anyone who processes personal data, whether a private company, government agency, or organization. It defines two roles:
- Data Controller, the party that decides the purpose of processing. Usually this is the website or app owner.
- Data Processor, the party that processes data on the controller's behalf, such as a hosting provider, email service, or development vendor.
Key Obligations That Affect Your System
- A lawful basis for processing, for example clear user consent, not a pre-ticked checkbox.
- Transparency. Users have the right to know what data is collected, why, and for how long. This belongs in your privacy policy.
- Honoring data subject rights, such as the right to access, correct, and delete data, and to withdraw consent.
- Data security through adequate technical and organizational measures.
- Breach notification. If a data protection failure occurs, the controller must notify data subjects and the relevant authority within 3 x 24 hours.
Violations can lead to administrative sanctions, including fines of up to 2% of annual revenue, as well as criminal penalties for certain acts.
Technical Checklist for Websites and Apps
- HTTPS on every page, not just the login page.
- Forms ask only for data you truly need. Less data means less risk.
- Clear consent for newsletters, marketing, and tracking cookies.
- Hashed passwords using modern algorithms such as bcrypt or Argon2, never stored as plain text.
- Encryption of sensitive data such as ID numbers or health data in the database.
- Role-based access. Staff see only the data relevant to their job.
- Activity logs recording who accessed and changed data.
- Account deletion or data request features so user rights can be fulfilled.
- Encrypted backups and a tested recovery procedure.
- Agreements with vendors that process data, including hosting providers and developers.
Where to Start
- Map what data you collect, where it is stored, and who can access it.
- Update your privacy policy to reflect your actual practices.
- Fix the highest-risk technical gaps first.
- Prepare a written procedure for data breaches.
Conclusion
Compliance is not just about legal documents. Most obligations must be built into system design: forms, databases, access rights, and server security. The earlier it is designed in, the cheaper it is compared to fixing things after a problem.
Codeinspira applies privacy by design to every website and app we build. Contact us to review your system's readiness.
