Joint Control Addendum Template for Indonesia

A Joint Control Addendum is a critical legal document that governs shared data processing arrangements between two or more organizations under Indonesian law. When you're involved in collaborative data processing activities, this addendum ensures compliance with Indonesia's comprehensive Personal Data Protection Law (Law No. 27 of 2022) while clearly defining each party's obligations and responsibilities.

When do you need this document?

You need a Joint Control Addendum when your organization collaborates with other entities in determining both the purposes and means of processing personal data. This commonly occurs in business partnerships, joint ventures, shared marketing campaigns, or collaborative research projects where multiple parties have decision-making authority over data processing activities. The addendum becomes essential when you're sharing customer databases, conducting joint market research, operating shared platforms, or engaging in any activity where you jointly decide what personal data to collect, how to process it, and for what purposes. Under Indonesian law, joint controllers must have clear arrangements in place before beginning any shared processing activities.

Key legal considerations

The most critical aspect of your Joint Control Addendum is the clear allocation of responsibilities between all parties involved. You must define who handles data subject requests, manages consent mechanisms, conducts privacy impact assessments, and responds to data protection authority inquiries. The document should specify breach notification procedures, ensuring compliance with Indonesia's strict 72-hour reporting requirements to authorities and affected individuals. Security measures must be outlined comprehensively, including technical and organizational safeguards that meet Indonesian standards. You'll also need to address data transfer arrangements, particularly if data crosses borders, ensuring compliance with Indonesia's data localization requirements where applicable. The addendum must clearly establish which party serves as the primary contact point for data subjects exercising their rights under the PDP Law.

Legal requirements in Indonesia

Under Indonesia's Personal Data Protection Law (Law No. 27 of 2022), joint controllers must establish transparent arrangements that demonstrate accountability and enable effective data subject rights management. Your addendum must comply with Government Regulation No. 71 of 2019 regarding electronic systems implementation, ensuring proper technical safeguards are in place. The document should reference relevant provisions of MOCI Regulation 20 of 2016 for electronic data protection requirements. You must ensure the addendum aligns with fundamental contract law principles under the Indonesian Civil Code, including proper formation, validity, and enforceability. The arrangement must facilitate compliance with mandatory data protection officer appointment requirements where applicable, and ensure proper legal representation for foreign entities operating in Indonesia. Your addendum should also address potential regulatory changes and provide mechanisms for updating obligations as Indonesian data protection law continues to evolve.