Law No. 27 of 2022 on Personal Data Protection — transfer of personal data outside Indonesia

Art. 56 is a strict waterfall, taken in order rather than chosen from: transfer is permitted if the recipient country's level of personal data protection is equal to or higher than Indonesia's; if it is not, then only where adequate and binding protection exists in the recipient country; and if neither holds, only with the data subject's consent. Consent is the last resort here, not a parallel option — the opposite of how many businesses structure their analysis. GR 33 of 2026 confirms that adequacy assessments are made by the supervisory authority, which will maintain a whitelist of adequate jurisdictions, and gives a six-month transition from its July 16, 2026 promulgation before administrative sanctions attach around January 16, 2027. Marked 'check': the primary texts are Indonesian-language, the whitelist did not exist at the time of writing, and Indonesia's supervisory authority was still being stood up.