Online Privacy Notice Template for Indonesia

An Online Privacy Notice is a legally required document that informs users about how your organization collects, uses, and protects their personal data when they interact with your website or digital services. Under Indonesian law, particularly the Personal Data Protection Law (UU PDP) No. 27 of 2022, this notice is not optional but a mandatory compliance requirement for any entity processing personal data electronically.

When do you need this document?

You need an Online Privacy Notice whenever your website or digital platform collects any form of personal data from Indonesian users. This includes e-commerce sites processing customer information, social media platforms gathering user profiles, mobile applications tracking usage data, or even simple contact forms collecting email addresses. The requirement applies to both Indonesian companies and foreign entities serving Indonesian users. Additionally, you must update your privacy notice whenever you change your data processing activities, introduce new data collection methods, or modify how you share information with third parties.

Key legal considerations

Your privacy notice must clearly explain the legal basis for processing personal data under Indonesian law, which can include user consent, contractual necessity, legal obligations, or legitimate interests. The document should specify what types of personal data you collect, including sensitive categories like biometric or health information that require special protection. You must describe data retention periods, explaining how long you keep different types of information and your deletion practices. The notice should also detail user rights under UU PDP, including rights to access, correct, delete, and port their data, along with clear procedures for exercising these rights. International data transfers require specific disclosure, particularly if you share data with countries not deemed adequate by Indonesian authorities.

Legal requirements in Indonesia

Under UU PDP and related regulations, your privacy notice must be written in Bahasa Indonesia for Indonesian users and be easily accessible through prominent website placement. The document must include your organization's contact details and, if applicable, your Data Protection Officer's information. You need explicit consent mechanisms for sensitive data processing and clear opt-out procedures for marketing communications. The notice must comply with Kominfo regulations regarding electronic systems and specify how you handle data breaches, including notification procedures. Regular compliance audits are recommended as penalties under UU PDP can include administrative sanctions and fines up to 2% of annual revenue for serious violations.