Search

The enactment of the Indonesian Personal Data Protection (PDP) Law is in line with the nation’s position as the most promising digital economy in Southeast Asia. The PDP Law, amongst others, introduces Data Subject Access Request (DSAR), a cornerstone mechanism to exercise data subject rights mirroring the European Union General Data Protection Regulation (GDPR). However, major causes of DSAR failure are predominantly triggered by resource constraint, lack of fundamental understanding, and technical gap when responding to such requests. In practice, DSAR management is time consuming and taxing since organisations shall manage numerous and complex requests within a tight timeline. By way of comparative analysis, we explore the concept of data subject rights, specifically the Rights to Access. Through observations and constructive responses by global data protection professionals, academics and non-lawyers, this paper alluded that similar failure scenario might occur in Indonesia when PDP Law grace period ended in 2024 – if the causes are not addressed and mitigated. Apropos, in safeguarding data subjects’ right, we assert that DSAR under the PDP law might bring disproportionate impracticality, hence there is demand for a robust consultation and holistic regulatory implementation. We also propose to consider a harmonized DSAR ASEAN framework for future proofing cross-border payment, in 2024 and beyond.

The rapid progress of digital transformation underscores the critical need for robust personal data protection as a guarantee of individual rights, particularly to address the prevalent issues of data leakage and misuse, including population data. This need aligns with Article 28 G of the 1945 Constitution, which is actualized through the provision of access to population data for verification purposes to both state and private institutions. Additionally, data users are mandated to adhere to a Zero Data Sharing Policy that strictly prohibits the dissemination or sharing of population data with third parties. However, challenges persist due to limited legal protections concerning personal data classifications and the delineation of authority between data owners and users, highlighting the urgent need for comprehensive personal data protection legislation. Furthermore, the establishment of an Independent Surveillance Authority is essential to ensure effective regulation enforcement. This Authority's roles and powers would align with government efforts to protect population data and be guided by the standards set forth in the European Union General Data Protection Regulation (EU GDPR). Its independent status is crucial to prevent undue influence from parties with vested interests. Functionally, such an authority would enhance the effectiveness of the Zero Data Sharing Policy through its capacity to conduct investigations and enforce collective rights, thus ensuring the protection of human rights. This research employs normative legal research, utilizing legislation and literature reviews alongside descriptive analysis with a deductive approach to manage qualitative data, concluding that legal protections must be bolstered by optimal oversight through an established Independent Surveillance Authority.