Data Controller Agreement Template for Indonesia

A Data Controller Agreement is a legally binding contract that defines the roles, responsibilities, and obligations of parties involved in personal data processing activities in Indonesia. Under Law No. 27 of 2022 on Personal Data Protection (PDP Law), you must establish clear contractual arrangements whenever personal data is processed by or shared with third parties. This agreement protects both your organization and data subjects by ensuring compliance with Indonesia's comprehensive data protection framework.

When do you need this document?

You need a Data Controller Agreement when engaging service providers, technology vendors, or business partners who will process personal data on your behalf or jointly with you. This includes cloud storage providers, marketing agencies, payroll companies, IT support vendors, and any third party that handles customer information, employee data, or other personal data. The agreement is essential when establishing data sharing arrangements, outsourcing business processes, or entering joint ventures that involve personal data processing. Indonesian law requires written contracts for all data processing relationships to ensure accountability and legal compliance.

Key legal considerations

Your Data Controller Agreement must clearly define each party's role as either data controller, data processor, or joint controller under the PDP Law. Include specific provisions for data security measures, breach notification procedures within 72 hours to authorities, and data subject rights including access, rectification, and erasure. The agreement should specify data retention periods, cross-border transfer restrictions, and audit rights. Consider liability allocation, indemnification clauses, and termination procedures including data return or destruction. Include provisions for sub-processor arrangements and ensure compliance with Government Regulation No. 71 of 2019 on Electronic Systems and Transactions for electronic data handling.

Legal requirements in Indonesia

Indonesian PDP Law mandates that data controllers implement appropriate technical and organizational measures to protect personal data. Your agreement must comply with MOCI Regulation 20 of 2016 regarding consent requirements and data processing procedures. Include provisions for lawful bases of processing, data minimization principles, and purpose limitation as required by Indonesian law. The agreement must address local data storage requirements, potential data localization obligations, and compliance with sector-specific regulations. Ensure the contract includes dispute resolution mechanisms under Indonesian jurisdiction and specify governing law as Indonesian law. Regular compliance audits and documentation of processing activities must be contractually mandated to meet regulatory expectations.