Indonesia: Constitutional Court received a lawsuit challenging Article 53(1) of Personal Data Protection Law over obligation to appoint a data protection criteria

On 30 October 2024, the Constitutional Court of the Republic of Indonesia held a preliminary hearing in Case Number 151/PUU-XXII/2024 concerning a judicial review of Article 53 paragraph (1) of Law Number 27 of 2022 on Personal Data Protection (PDP Law) against Article 28G paragraph (1) of the 1945 Constitution. The petitioners challenged the constitutionality of the cumulative obligation to appoint a Personal Data Protection Officer (PPDP) under the provision, which mandates that personal data controllers and processors appoint a PPDP only when all three criteria set out in points (a), (b), and (c) are fulfilled simultaneously. The petitioners argued that each point represents an independent high-risk data processing activity that should independently trigger the PPDP appointment obligation, consistent with the risk-based approach in Article 34 paragraph (2) of the PDP Law. The petitioners requested the Court to interpret the word “and” linking the criteria as “and/or”, in accordance with legislative drafting standards under Law Number 12 of 2011. The Court instructed the petitioners to submit revisions within 14 days and scheduled further proceedings in accordance with procedural requirements.