The legal position is not straight forward because of overlapping legacy regulations passed in 2019 and 2016. This note attempts to reconcile Indonesian laws and regulations on the cross border transfer of data:
GR 71 on Organization of Electronic Systems and Transactions
Article 21(1) of GR 71 explicitly allows for private commercial enterprises to store data outside Indonesia.
This is in contrast with government sector electronic system organizer – data collected by the government (public electronic system organizers) must be stored locally.
Although ESOs may locate their data outside Indonesia, they must ensure that their electronic systems and data are accessible to the Indonesian authority for supervision and law enforcement (Article 21(2) of GR 71).
GR 71 is a government-issued regulation passed before 2022 (the year when the 2022 PDPA was passed) and remains in force.
PDPA
Under Article 56 of the 2022 PDPA, the transfer of personal data out of Indonesia is permitted if:
Presumably, this means that the data controller needs to at least have in place adequate assurance from the overseas entity that is receiving the data.
MOCI 20/2016 on the Protection of Personal Data Protection in Electronic Systems
In addition to securing consent from the users, when a cross border transfer of the customers’ personal data from Indonesia occurs, ESOs are required to "be in coordination with" (Article 22 of MOCI 20/2016) the Directorate of Informatics Application Control, a division under Ministry of Communication and Information. In practice, this is compiled by submitting pre and post notification of such transfer. MOCI has confirmed that the requirement is still in effect. This is done by submitting reports in prescribed forms – before and after transfer.
In the case where data is submitted by Indonesian data subjects directly to a server outside Indonesia, MOCI has confirmed that data controllers/electronic system operators must also comply with the same reporting requirement.
Data Collected by Financial Institutions
Approval from the Indonesian Financial Services Authority ("FSA") is required before financial institutions can establish a data center or a data processing outside Indonesia territory (Article 35(2) and (3) of the Financial Services Authority Regulation No. 11/POJK.03/2022 on the Organization of Information Technology by Commercial Banks).
Concluding remarks
In summary, the primary obligation is to comply with Article 56 of the 2022 PDPA as discussed above, the primary purpose is to ensure that the data subject would get the same level of protection as they would get in Indonesia.
Other related articles:
2022 Indonesian Data Protection Law
Electronic Contract Best Practices: Indonesia
Data Controller responsibility in the event of data breach – Indonesia
