Joint Controller Data Sharing Agreement Template for Indonesia

When organizations collaborate on data processing activities in Indonesia, a Joint Controller Data Sharing Agreement becomes legally essential under the Personal Data Protection Law No. 27 of 2022. This agreement establishes clear responsibilities between parties who jointly determine the purposes and means of personal data processing, ensuring compliance with Indonesian data protection regulations while facilitating legitimate business collaborations.

When do you need this document?

You need this agreement when your organization shares decision-making authority over personal data processing with other entities. Common scenarios include joint ventures between technology companies and financial institutions for fintech solutions, healthcare providers collaborating with research institutions on patient data studies, or educational institutions partnering with government agencies for student information systems. The agreement is also crucial when telecommunications providers work with retail companies on customer analytics projects, or when insurance companies collaborate with professional services firms on risk assessment data. Any arrangement where multiple organizations jointly control how personal data is collected, used, or shared requires this legal framework to ensure compliance with Indonesian law.

Key legal considerations

The agreement must clearly define each party's role as joint controllers and allocate specific responsibilities for PDP Law compliance. Critical clauses include data subject consent management, as both controllers must ensure proper legal basis for processing under Article 16 of the PDP Law. You must establish procedures for handling data subject rights requests, including access, rectification, and deletion rights guaranteed under Articles 31-34. Security measures must meet the standards outlined in Government Regulation No. 71 of 2019, including data encryption, access controls, and breach notification procedures within 72 hours to KOMINFO. The agreement should address cross-border data transfer restrictions and localization requirements for certain data categories. Liability allocation between joint controllers is crucial, as both parties can be held jointly and severally liable for violations. Include termination clauses that address data deletion or return obligations and ongoing compliance responsibilities.

Legal requirements in Indonesia

Under Indonesian law, joint controllers must register their data processing activities with the Ministry of Communication and Information Technology (KOMINFO) and maintain detailed processing records as required by Article 65 of the PDP Law. Both parties must appoint Data Protection Officers if they process large volumes of personal data or sensitive personal data categories defined in Article 4. The agreement must comply with data localization requirements under KOMINFO Regulation 20 of 2016, ensuring that Indonesian citizens' personal data is stored and processed within Indonesian territory. Consent mechanisms must meet the specific requirements of Article 16, including being freely given, specific, informed, and unambiguous. For sensitive personal data processing, explicit written consent is mandatory under Article 26. The agreement must establish audit rights and compliance monitoring procedures to demonstrate ongoing adherence to Indonesian data protection standards. Both controllers are required to conduct Data Protection Impact Assessments (DPIAs) for high-risk processing activities as outlined in Article 58 of the PDP Law.