Indonesia: Constitutional Court affirmed constitutionality of Article 56 of Personal Data Protection Law on cross-border data transfers

On 19 January 2026, the Constitutional Court issued a ruling confirming the constitutionality of Article 56 of Personal Data Protection Law over alleged failure to recognise popular sovereignty. The Court rejected all four counts of the petition, holding that the Personal Data Protection (PDP) Law already requires consent for data processing, that the House of Representatives does not need to assess the adequacy of another country's data protection level, that the law already provides a remediation framework, and that it is unnecessary to add a clause to Article 56(4) stipulating that the data subject be informed of the risks of data transfer prior to international data transfers where equivalent protection is not guaranteed. The legal challenge arose in the context of the trade agreement between Indonesia and the United States, which provided for personal data transfers between the United States and Indonesia. The challenge sought a number of declarations from the Court, including that international personal data transfers should only be permitted when based on the explicit consent of the data subject or an international treaty approved by the House of Representatives, that the assessment of equivalent levels of protection should be based on a treaty approved by the House of Representatives, and regarding the need effective remediation mechanisms.