Symbolic Law, Substantial Gaps: Reassessing Indonesia’s Personal Data Protection Law in Light of the GDPR (General Data Protection Regulation) Effectiveness and Adequacy Standards

Rizkita Kurnia Sari; Happy Yulia Anggraeni; Erna Listiawati

doi:10.58824/arjis.v5i3.648

Authors

Rizkita Kurnia Sari Universitas Islam Nusantara
Happy Yulia Anggraeni Universitas Islam Nusantara
Erna Listiawati Universitas Padjajaran

DOI:

https://doi.org/10.58824/arjis.v5i3.648

Keywords:

Adequacy, GDPR, Legal Effectiveness, PDP Law, Personal Data Protection

Abstract

The rapid advancement of information and communication technology has triggered the massive commodification of digital data, which has direct implications for global privacy vulnerabilities. As a cornerstone of international regulation, the European Union has implemented the General Data Protection Regulation (GDPR) using the doctrine of adequacy decisions to assess the equivalence of legal protections across countries. At the domestic level, Indonesia has responded to this challenge by enacting Law No. 27 of 2022 on Personal Data Protection (PDP Law). Using a normative and comparative legal approach, this study evaluates the degree of alignment and the legal protection capabilities of the PDP Law relative to GDPR standards. The analysis reveals that the PDP Act has adopted the GDPR’s fundamental principles regarding data subjects’ rights and data controllers’ obligations. Nevertheless, significant regulatory gaps remain in the areas of supervisory authority independence, the rationalization of fines, and the governance of international data transfers. These operational obstacles are exacerbated by limited institutional capacity and low awareness of legal compliance. This study concludes that although Indonesia is on the path to harmonization, the PDP Law has not yet fully met the European Union’s Adequacy criteria, thus requiring ongoing regulatory reform to achieve equivalent transnational protection effectiveness.

Downloads

Download data is not yet available.

References

Absor, A. M. (2023). Juridical Analysis of Human Rights Protection in the Era of Digital Transformation: Perspective of Laws and Regulations. Indonesia Media Law Review, 2(2). https://doi.org/10.15294/imrev.v2i2.69472

Aura, A., Priowirjanto, E. S., & Dewi, C. T. I. (2025). Privacy Protection Guarantee for Data Hacking Victims According to Indonesian Law. Padjadjaran Journal of International Law, 9(1), 1–15. https://doi.org/10.23920/pjil.v8i2.1823

Cejas, O. A., Sannier, N., Abualhaija, S., Ceci, M., & Bianculli, D. (2025). GDPR-Relevant Privacy Concerns in Mobile Apps Research: A Systematic Literature Review (arXiv:2411.19142). arXiv. https://doi.org/10.48550/arXiv.2411.19142

Chong, A. (2026, February 25). Cross-Border Personal Data Transfers: The Remaining Issues Following the Indonesian Constitutional Court Decision. https://conflictoflaws.net/2026/cross-border-personal-data-transfers-the-remaining-issues-following-the-indonesian-constitutional-court-decision/

Coche, E., Kolk, A., & Ocelík, V. (2024). Unravelling cross-country regulatory intricacies of data governance: The relevance of legal insights for digitalization and international business. Journal of International Business Policy, 7(1), 112–127. https://doi.org/10.1057/s42214-023-00172-1

Creswell, John W., and J. David Creswell. (2023). Research Design: Qualitative, Quantitative, and Mixed Methods Approaches. 6th ed. Thousand Oaks, CA: SAGE Publications.

Elza, P. (2025). Tinjauan Hukum Perlindungan Data Pribadi dalam Peraturan Perundang-Undangan di Indonesia. Jurnal Ilmu Hukum, 1(1), 1–7.

Fachran, S., Rosadi, S. D., & Amalia, P. (2026). PROTECTION OF DATA SUBJECT RIGHTS IN THE TRANSFER OF PERSONAL DATA BETWEEN DATA CONTROLLERS IN INDONESIA: A COMPARATIVE ANALYSIS OF THE PDP LAW AND THE EU GDPR. Awang Long Law Review, 8(2), 518–529. https://doi.org/10.56301/awl.v8i2.1827

Fauzy, E., & Shandy, N. A. R. (2022). Hak Atas Privasi dan Politik Hukum Undang-Undang Nomor 27 Tahun 2022 Tentang Pelindungan Data Pribadi. Lex Renaissance, 7(3), 445–461. https://doi.org/10.20885/JLR.vol7.iss3.art1

Kriswandaru, A. S., Pratiwi, B., & Suwardi, S. (2024). Efektivitas Kebijakan Perlindungan Data Pribadi di Indonesia: Analisis Hukum Perdata dengan Pendekatan Studi Kasus. Hakim: Jurnal Ilmu Hukum Dan Sosial, 2(4), 740–756. https://doi.org/10.51903/hakim.v2i4.2157

Manurung, E. A. P., & Thalib, E. F. (2022). Tinjauan Yuridis Perlindungan Data Pribadi Berdasarkan Uu Nomor 27 Tahun 2022. Jurnal Hukum Saraswati (JHS), 4(2), 139–148.

Marelli, M. (2024). Transferring personal data to international organizations under the GDPR: An analysis of the transfer mechanisms. International Data Privacy Law, 14(1), 19–36. https://doi.org/10.1093/idpl/ipad022

Nusantara, A. H. S., Umam, I. K., & Lubis, M. (2024). Jaminan Informasi dan Keamanan yang Lebih Baik: Studi Kasus BPJS Kesehatan. NUANSA INFORMATIKA, 18(2), 120–127. https://doi.org/10.25134/ilkom.v18i2.202

Prastyanti, R. A., & Sharma, R. (2024). Establishing Consumer Trust Through Data Protection Law as a Competitive Advantage in Indonesia and India. Journal of Human Rights, Culture and Legal System, 4(2), 354–390. https://doi.org/10.53955/jhcls.v4i2.200

Rahman, F., & Mulyani, C. K. (2025). Minimising unnecessary restrictions on cross-border data flows? Indonesia’s position and challenges post personal data protection act enactment. International Review of Law, Computers & Technology, 39(2), 281–300. https://doi.org/10.1080/13600869.2024.2359901

Rajah & Tann Asia (2026). PDP Law Updates: The PDP Implementing Regulation Is Out, and It Clarifies Some Key Questions Under Indonesia’s PDP Law https://www.rajahtannasia.com/viewpoints/pdp-law-updates-the-pdp-implementing-regulation-is-out-and-it-clarifies-some-key-questions-under-indonesias-pdp-law/.

Saluste, M. (2025). Cross-Border ‘Data Adequacy’ Frameworks under GATS Article VII: Aligning WTO Members’ Rights to Protect Personal Data with Their International Commitments. World Trade Review, 24(5), 593–619. https://doi.org/10.1017/S1474745625000047

Satory, A., Febrianty, Y., Astuti, W. R. B., & Pradana, A. F. K. (2024). METODE PENELITIAN HUKUM. Penerbit Tahta Media. https://tahtamedia.co.id/index.php/issj/article/view/1031

Siems, Mathias. (2022). Comparative Law. 3rd ed. Cambridge: Cambridge University Press.

Simanjuntak, P. H. (2024). PERLINDUNGAN HUKUM TERHADAP DATA PRIBADI PADA ERA DIGITAL DI INDONESIA: STUDI UNDANG - UNDANG PERLINDUNGAN DATA PRIBADI DAN GENERAL DATA PROTECTION REGULATION (GDPR). Esensi Hukum, 6(2), 105–124. https://doi.org/10.35586/esensihukum.v6i2.412

S?ok-Wódkowska, M., & Mazur, J. (2024). Between commodification and data protection: Regulatory models governing cross-border information transfers in regional trade agreements. Leiden Journal of International Law, 37(1), 111–138. https://doi.org/10.1017/S092215652300050X

Voigt, P., & Bussche, A. von dem. (2021). The EU General Data Protection Regulation (GDPR): A practical guide. Springer International Publishing.

Wibowo, A., Alawiyah, W., & Azriadi. (2024). The importance of personal data protection in Indonesia’s economic development. Cogent Social Sciences, 10(1), 2306751. https://doi.org/10.1080/23311886.2024.2306751