Indonesia: Constitutional Court issued ruling on obligation to appoint a data protection officer under Article 53(1) of Personal Data Protection Law

On 30 July 2025, the Constitutional Court of the Republic of Indonesia issued Decision Number 151/PUU-XXII/2024 on the judicial review of Article 53 paragraph (1) of Law Number 27 of 2022 on Personal Data Protection (PDP Law), granting the petitioners’ request in full. The Court declared that the use of the word “and” linking the criteria in points (a), (b), and (c) constitutes a cumulative formulation that narrows the obligation for personal data controllers and processors to appoint a Personal Data Protection Officer (PPDP), thereby limiting protection for high-risk personal data processing activities. The Court held that the criteria must be interpreted as independent, in line with the intent of the legislator and the principle of proportional risk-based protection under Article 34 paragraph (2) of the PDP Law. It concluded that the correct formulation is a cumulative alternative using “and/or”, as stipulated in legislative drafting guidance under Annex II of Law Number 12 of 2011. The Court ruled the word “and” unconstitutional and declared it conditionally non-binding unless interpreted as “and/or”, thereby affirming that any single criterion in points (a), (b), or (c) of Article 53 paragraph (1) is sufficient to require the appointment of a PPDP under the PDP Law.