Joint Controller Agreement Template for Indonesia

A Joint Controller Agreement is a legal contract that defines the relationship between two or more organizations that jointly determine the purposes and means of processing personal data under Indonesian law. Under the Personal Data Protection Law (Law No. 27 of 2022), when multiple entities collaborate in data processing activities, they must establish clear roles and responsibilities through a formal agreement to ensure compliance with Indonesian data protection regulations.

When do you need this document?

You need a Joint Controller Agreement whenever your organization collaborates with other entities in processing personal data where both parties have decision-making authority over the processing activities. This commonly occurs in technology partnerships where companies share user databases, financial institutions collaborating on loan processing systems, healthcare providers exchanging patient information for treatment purposes, or educational institutions sharing student data for research projects. The agreement is also essential when government agencies work with private companies on public services that involve citizen data, or when retail companies partner with logistics providers for customer order fulfillment. Without this agreement, joint controllers risk regulatory penalties and unclear liability allocation in case of data breaches or compliance violations.

Key legal considerations

The agreement must clearly define each party's specific responsibilities for data protection compliance, including data security measures, breach notification procedures, and handling of data subject requests. You should establish detailed protocols for responding to individual rights requests such as data access, rectification, deletion, and portability under the PDP Law. The document must specify how personal data will be shared between controllers, including technical and organizational measures to protect data during transfer and storage. Consider including provisions for liability allocation, indemnification clauses, and dispute resolution mechanisms to address potential conflicts between joint controllers. The agreement should also address data retention periods, deletion procedures, and what happens to shared data when the collaboration ends.

Legal requirements in Indonesia

Under Indonesia's Personal Data Protection Law (Law No. 27 of 2022), joint controllers must ensure their agreement complies with fundamental data protection principles including lawfulness, limitation of purpose, data minimization, accuracy, storage limitation, and accountability. The agreement must demonstrate that you have obtained proper consent from data subjects for the joint processing activities or establish another lawful basis for processing under Article 12 of the PDP Law. You must implement appropriate technical and organizational security measures as required by Government Regulation No. 71 of 2019, including encryption, access controls, and regular security assessments. The document should address cross-border data transfer requirements if either controller plans to transfer data outside Indonesia, ensuring compliance with adequacy decisions or implementing appropriate safeguards. Additionally, both controllers must designate data protection officers if required under the PDP Law and establish procedures for cooperating with the Ministry of Communication and Informatics during regulatory investigations or audits.