TheJakartaPost
Please Update your browser
Your browser is out of date, and may not be compatible with our website. A list of the most popular web browsers can be found below.
Just click on the icons to get to the download page.
Data protection officer: Challenges for new profession
If a policy or a product of the company is in violation of the PDPL, the company cannot force the DPO to approve.
Change text size
Gift Premium Articles
to Anyone
Share the best of The Jakarta Post with friends, family, or colleagues. As a subscriber, you can gift 3 to 5 articles each month that anyone can read—no subscription needed!
undefined (Reuters/Kacper Pempel)
T
he enactment of the Personal Data Protection (PDP) Law in September 2022 marks a new era of personal data protection in Indonesia. The law will make a huge impact on businesses in Indonesia as they are required to adjust their personal data protection standards.
One of the implications of the enactment of the law is a requirement for organizations to appoint a data protection officer (DPO). Although not all organizations are required to appoint a DPO, a considerable amount of companies will be required to comply with the law.
The law states that organizations that meet the following criteria must appoint a DPO:
First, the organizations are involved in personal data processing for the purpose of public services (such as government agencies). Second, the nature, scope and/or purpose of the main business line requires periodic and systematic supervision against considerable amounts of personal data. Third, the main business line consists of big-scale personal data processing for specific and/or crime-related personal data.
Under these criteria, many organizations in Indonesia, including government institutions and private companies are required to appoint a DPO. As such, the need for DPOs in Indonesia shall increase now that the PDP law has come into force.
Learning from experience from other countries, there is always a high demand for a DPO. For example, in the United Kingdom, since the European Union General Data Protection Regulation (GDPR) was passed in April 2016, the number of total job listings for the position of DPO within a period of 18 months increased almost 10 times. The trend does not only happen in the UK or EU countries, but also in Indonesia.
Over the past few years, as issues on personal data protection and cybersecurity gain traction, many Indonesian companies have started to employ professionals to play the DPO role in the company, particularly in the technology and financial sector. This is despite the fact that the PDP Law was yet to be passed.
