Law No. 27 of 2022 on Personal Data Protection — personal data of children and of persons with disabilities

Art. 25 requires that children's personal data be processed in a specific manner and with the consent of a parent or guardian. The Law itself sets NO age threshold, which is the practical problem — the implementing regulation supplies it, defining a child as an individual under 18 and unmarried, so confirm the current definition rather than assuming 13 or 16. Art. 26 is unusual enough to note separately: Indonesia gives persons with disabilities a parallel protected status, requiring processing in a specified manner and consent from the person or their guardian, with further rules on how controllers must communicate with them. Very few regimes in this dataset pair the two that way, and a compliance program scoped only to minors will miss half of it. Marked 'check': the primary texts are Indonesian-language, the implementing regulation is recent, and Indonesia's supervisory authority was still being stood up.