Personal Data Collection Agreement Template for Indonesia

The Personal Data Collection Agreement is essential for any organization operating in Indonesia that collects, processes, or manages personal data from individuals. This document became particularly crucial following the enactment of Law No. 27 of 2022 on Personal Data Protection (PDP Law), which introduced comprehensive data protection requirements. The agreement serves as a legal framework ensuring compliance with Indonesian data protection regulations while establishing clear rights and obligations for both data controllers and data subjects. It should be used whenever an organization begins collecting personal data from individuals, whether for business operations, service provision, or other legitimate purposes. The document typically includes detailed provisions on data collection scope, processing purposes, security measures, data subject rights, and breach notification procedures, all aligned with Indonesian legal requirements.

1. Parties: Identification of the data controller (collector) and the data subject, including their full legal names and addresses

2. Background: Context of the agreement, purpose of data collection, and relationship between the parties

3. Definitions: Key terms used in the agreement, aligned with Indonesian PDP Law definitions, including 'personal data', 'processing', 'consent', etc.

4. Scope of Data Collection: Detailed description of what personal data will be collected and the specific purposes for collection

5. Consent Declaration: Express consent provisions and acknowledgment of data subject rights under Indonesian law

6. Data Controller Obligations: Obligations of the data collector including data security measures, confidentiality, and compliance with PDP Law

7. Data Subject Rights: Enumeration of data subject rights under Indonesian law, including access, correction, deletion, and data portability

8. Data Security Measures: Specific security measures implemented to protect personal data

9. Data Retention and Deletion: Period of data retention and procedures for data deletion

10. Breach Notification: Procedures for handling and notifying data breaches as required by Indonesian law

11. Governing Law and Jurisdiction: Specification of Indonesian law as governing law and jurisdiction for disputes

12. Term and Termination: Duration of the agreement and conditions for termination