Cross-Border Personal Data Transfers: The Remaining Issues Following the Indonesian Constitutional Court Decision

Key Takeaways

• Court rules data transfers are executive, not legislative matters
• Controllers must verify adequacy; PDPA oversight pending
• No parliamentary approval needed for cross‑border data transfers
• Implementing regulations and PDPA establishment still awaited
• Indonesian courts likely to retain jurisdiction over foreign disputes

Summary

On 19 January 2026 Indonesia’s Constitutional Court dismissed a petition challenging Article 56 of the 2022 Personal Data Protection Law, which governs cross‑border data transfers. The Court held that such transfers are administrative actions of the executive, not matters requiring parliamentary approval, and affirmed that data exporters must independently verify the recipient’s adequacy while the yet‑to‑be‑created Personal Data Protection Authority (PDPA) will oversee compliance. The ruling leaves the law’s implementing regulations and the establishment of the PDPA pending, preserving the law’s broad extraterritorial reach. The decision also underscores uncertainty for firms seeking to move Indonesian personal data abroad, especially to the United States under the pending trade framework.

Pulse Analysis

Indonesia’s Constitutional Court has effectively placed the responsibility for cross‑border personal data transfers on private controllers and a future regulator, rather than on the legislature. By interpreting Article 56 as an executive function, the Court sidestepped the constitutional requirement for parliamentary oversight, reinforcing the law’s extraterritorial scope. This legal posture mirrors the GDPR’s adequacy model but diverges in procedural safeguards, leaving a gap until the Personal Data Protection Authority (PDPA) is formally constituted and detailed implementing regulations are issued.

For multinational corporations, the ruling introduces both risk and flexibility. Companies targeting the Indonesian market must now conduct their own technical adequacy assessments for any data export, especially to the United States where the pending Indonesia‑USA Reciprocal Trade Agreement seeks to streamline data flows. Without a parliamentary sign‑off, firms cannot rely on a political guarantee of protection, heightening the need for robust contractual clauses, encryption, and pseudonymisation. The decision also signals that Indonesian courts are likely to assert jurisdiction over disputes, even when parallel proceedings occur abroad, complicating litigation strategy and enforcement.

Looking ahead, the urgency to finalize the PDP Law’s implementing regulations and to appoint the PDPA cannot be overstated. Clear criteria for adequacy, whitelist/blacklist mechanisms, and standardized transfer agreements will reduce compliance ambiguity. Until then, businesses should adopt a proactive governance framework, document all adequacy verifications, and engage local counsel to navigate potential court interventions. The evolving landscape underscores Indonesia’s ambition to align with global data protection norms while retaining sovereign control over personal data.