Layered Privacy Notice Template for Indonesia

The Layered Privacy Notice is a mandatory document required under Indonesian Personal Data Protection Law (UU PDP) 2022 for organizations processing personal data of Indonesian residents. This document follows a tiered approach to presenting privacy information, making it more accessible and understandable for data subjects while ensuring comprehensive compliance with legal requirements. It should be implemented when an organization collects, processes, or handles personal data in Indonesia, whether through digital or physical means. The notice must address specific requirements under Indonesian law, including mandatory disclosures about data processing activities, data subject rights, and security measures. The layered approach allows organizations to present information in a way that balances the need for comprehensive disclosure with user-friendly communication, making it easier for data subjects to understand how their personal data is being handled.

1. Layer 1 - Key Privacy Information: Brief overview of essential privacy information in clear, simple language including who we are, what data we collect, and key rights

2. Identity and Contact Details: Information about the data controller, including company name, registration details, and contact information of the data protection officer

3. Types of Personal Data Collected: Comprehensive list of personal data categories collected, including both direct collection and indirect collection methods

4. Purposes of Processing: Detailed explanation of why personal data is collected and how it will be used, including legal bases for processing

5. Data Sharing and Disclosure: Information about third parties with whom data is shared, including categories of recipients and purposes

6. Data Security Measures: Description of technical and organizational measures implemented to protect personal data

7. Data Retention Period: Information about how long personal data will be stored and criteria used to determine this period

8. Individual Rights: Explanation of data subject rights under Indonesian law, including access, correction, deletion, and data portability

9. Contact Information for Complaints: Details on how to submit complaints or concerns about data processing