Law No. 27 of 2022 on Personal Data Protection mandates both personal data controllers and processors to provide external notifications to personal data subjects, known as a privacy notice or privacy policy. A privacy notice serves as an external document informing visitors about the utilization of their data and outlining their data privacy rights, while a privacy policy functions as an internal document that governs the organization's procedures for implementing personal data protection.The PDP Law outlines the obligations of personal data controllers and processors to inform personal data subjects through the development of a privacy notice, which must include the legality of the processing of personal data, the purpose of processing personal data, the type and relevance of the personal data to be processed, the retention period for documents containing the personal data, details regarding the information that is collected, the period in which the personal data is processed, and the rights of the personal data subjects.The Indonesian Government has drafted a Bill of Government Regulation on the implementation of the PDP Law, which further elaborates on the minimum required information in a Privacy Notice. It is the responsibility of Personal Data Controllers and Processors to ensure that Privacy Notices are easily accessible to Personal Data Subjects and notify them before any changes occur.Developing a Privacy Policy is essential for organizations seeking ISO 27701 certification, which defines management systems and requirements for processing personal data. There are several approaches to developing a Privacy Notice and Privacy Policy, including engaging with external consultants, using templates provided by consultants or other reputable sources, or creating a policy from scratch.Link di fonte:https://www.aseanbriefing.com/news/understanding-privacy-compliance-in-indonesia/ (ICE GIACARTA)

Fonte notizia: ASEAN Briefing, 12 March 2024