Privacy Agreement Template for Indonesia

1. Cross-border Data Transfers: Required when personal data may be transferred outside Indonesia, specifying compliance with PDP Law requirements for international transfers

2. Third-Party Processing: Include when external data processors will be involved in data processing activities

3. Special Categories of Personal Data: Required when processing sensitive personal data as defined in the PDP Law

4. Data Protection Impact Assessment: Include when processing activities may result in high risks to individuals' rights

5. Children's Data Processing: Required when collecting or processing personal data of children under 17 years

6. Direct Marketing Provisions: Include when personal data will be used for marketing purposes

7. Automated Decision Making: Required when implementing automated processing or profiling systems

1. Schedule 1: Categories of Personal Data: Detailed list of all personal data categories to be processed

2. Schedule 2: Technical Security Measures: Specific technical and organizational security measures implemented

3. Schedule 3: Authorized Third-Party Processors: List of approved data processors and their roles

4. Schedule 4: Data Processing Activities: Detailed description of all data processing activities and purposes

5. Schedule 5: Data Retention Schedule: Specific retention periods for different categories of personal data

6. Appendix A: Data Subject Request Forms: Standard forms for data subjects to exercise their rights

7. Appendix B: Data Breach Response Plan: Detailed procedures for handling data breach incidents