“The standard for the appointment of the data protection officer as mandated in the Personal Data Protection Law can be found in Decree of the Minister of Manpower of the Republic of Indonesia Number 103 of 2023.”
Overview of Data Protection Officer
In certain situations, a personal data controller and personal data processor are required to appoint an official or officer who will carry out personal data protection function or referred to as a Data Protection Officer (“DPO”).
Under Article 53 Law Number 27 of 2022 concerning Personal Data Protection (“PDP Law“), such events includes:
- The personal data are for the benefit of public services;
- The core activities of the personal data controller have the nature, scope and/or purposes that require regular and systematic monitoring of personal data on a large scale; or
- The core activities of the personal data controller consist of the personal data processing on a large scale for specific personal data and/or personal data related to crimes.
The duties of the DPO as set out in Article 54 of PDP Law includes the following:
- Inform and provide advice to the personal data controller or the personal data processor in order to comply with the provisions of the PDP Law;
- Monitor and ensure compliance with the PDP Law and the policies of the personal data controller or personal data processor;
- Provide advice on assessing the impact of personal data protection and monitoring the performance of the personal data controller and the personal data processor; and
- Coordinate and act as a liaison for issues related to the processing of personal data.
In carrying out their duties, DPO shall take into account the risk related to the personal data processing and this is done by taking into account the nature, scope, context and purpose of the processing.
Mandatory Criteria for Appointment of DPO
In essence, a personal data controller or personal data processor is free to choose who they appoint to be a DPO, whether from within or outside of the controller or processor itself. However, the PDP Law has set out that the appointment of a DPO shall be based on the following criteria:
- Professionalism;
- Knowledge of the Law;
- Personal Data Protection practice; and
- Ability to fulfill their duties.
Aside from the abovementioned criteria, the PDP Law does not set out any other criteria for the appointment of DPO. However, under the Decree of the Minister of Manpower of the Republic of Indonesia Number 103 of 2023 concerning Determination of Indonesian National Work Competency Standards for the Information and Communication Category of Main Classifications of Programming Activities, Computer Consultations and Related Activities Within the Personal Data Protection Expertise Sector (“DPO Decree”), there are certain additional criteria which must be fulfilled by an individual to be appointed as a DPO.
Among other things, the additional criterium which has the most significant impact is the requirement of having a certification to prove the individual’s competence. However, currently, it has been confirmed by the authorized institutions that there has not been appointed any association or certification body which is nationally accredited to issue legally acknowledged DPO certification.
Therefore, there is an issue with the implementation of the DPO Decree, rendering a void of law when it comes to legally qualified DPO. This issue in particular negatively affects personal data controllers and personal data processors who are obligated to appoint DPO for their activities under the PDP Law. The personal data controllers and the personal data processors as mentioned are obligated to appoint a qualified DPO, but the criterium which must be fulfilled by the appointed DPO is currently unable to be obtained. As such, there should have been appointed an official certification body first prior to enacting the obligation under the DPO Decree.
Author: Felicia Cindy Hanubrata and Yohana Veronica Tanjung
Gaffar & Co. is an Indonesian Boutique Law Firm specializing and focusing in Commercial Law, including Capital Market & Financial Services.
For further queries and information, contact us:
+62 811 877 216 | info@gaffarcolaw.com | www.gaffarcolaw.com
