You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

October 25, 2023

Personal Data Protection and Healthcare Services in Indonesia

Subscribe to Updates

One significant development in the health sector in Indonesia is the use of information technology and communication in the implementation of health efforts—particularly digital health services such as telehealth and telemedicine integrated into the country’s National Health Information System.

This development was addressed in a major new piece of legislation for the healthcare sector in Indonesia. Enacted in August 2023, Law No. 17 of 2023 concerning Health (the “Health Law”) provides the updates needed to support the development of healthcare services in Indonesia.

Under the Health Law, health information system (HIS) providers must:

  • Carry out processing of data and health information in the territory of Indonesia, except for certain limited and specific processing activities that may be conducted outside Indonesia when permitted by the relevant authorities and in compliance with relevant regulations.
  • Ensure the reliability of its HIS, including availability, security, maintenance, and integration with Indonesia’s National Health Information System.
  • Provide quality health data and information.
  • Process data and health information, which includes planning, collection, storage, inspection, transfer, utilization, and destruction.
  • Record its data- and information-processing history.
  • Protect every person’s data and health information.
  • Obtain approval from the relevant personal data subject or comply with relevant regulations if the processing of data and health information involves an individual’s health data.
  • Inform the data owner if there is a failure to protect data and individual health information.

The Health Law’s personal data protection requirements listed above appear to be aligned with the provisions in Law No. 27 of 2022 concerning Personal Data Protection (the “PDP Law”). Under this law, data and information relating to health are identified as “specific personal data,” the processing of which carries a high potential risk of impacting the relevant personal data subject.

In the implementation of digital health services, patients’ personal data or medical records must be generated by a health service facility. Health service facilities are responsible for the maintenance of the security, integrity, confidentiality, and availability of the data in Medical Records.

Regulatory Implementation of the PDP Law

In preparation for the implementation of the PDP Law, in September 2023 Indonesia’s Ministry of Communication and Information published the Draft Government Regulation regarding Implementation of PDP Law (the “Draft GR PDP”).

The provisions in the Draft GR PDP most relevant to digital health services and medical records are described below.

Personal Data Subject Rights

According to the Draft GR PDP, personal data subjects have the right to:

  • Terminate processing of personal data about themselves in accordance with relevant laws and regulations.
  • Delete personal data about themselves in accordance with relevant laws and regulations.
  • Destroy personal data about themselves in accordance with relevant laws and regulations.
  • Withdraw their previously given consent to the processing of personal data.
  • Object to decision-making actions based solely on automated processing (including profiling) that have legal consequences or a significant impact on the personal data subject.
  • Suspend or limit the processing of personal data proportionately in accordance with the purpose of processing the personal data.
  • Obtain and use personal data about themselves from the personal data controller in a form that fits a structure or format commonly used or readable by electronic systems.
  • Use and transmit personal data about themselves to other personal data controllers if the systems used can communicate with each other securely in accordance with the personal data protection principles.

Personal Data Controller Obligations

Among personal data controllers’ many obligations related to the protection of personal data in general, there are two related to health. Under the Draft GR PDP, personal data subjects have the right to complete, update, and correct errors or inaccuracies in personal data about them through the means provided by the personal data controller, either independently or by submitting a written request to the personal data controller, who must reject such a request if it:

  • Jeopardizes the security or physical or mental health of the personal data subject or others;
  • Impacts the disclosure of personal data belonging to others; or
  • Is contrary to the interests of national defense and security.

Personal data controllers must assess the impact of their processing of personal data related to health, because processing this type of data carries a high potential risk of impacting the relevant personal data subject.

Other than the obligations mentioned above, personal data controllers are also required to do the following, among others:

  • Have a basis for processing personal data;
  • Present evidence of personal data subjects’ consent to the processing of their personal data;
  • Carry out the processing of personal data in a limited, specific, legally valid, and transparent manner;
  • Carry out the processing of personal data in accordance with the declared purpose for processing the personal data;
  • Ensure the accuracy, completeness, and consistency of personal data in accordance with the provisions of laws and regulations;
  • Update or fix any errors or inaccuracies in personal data under their control;
  • Record all personal data processing activities; and
  • Provide personal data subjects with access to the processed personal data along with a record of processing activities during the period for which the personal data is retained.

Personal Data Processing

Besides identifying personal data subjects and personal data controllers as relevant parties in the processing of personal data, the Draft GR PDP also details the role of personal data processors. A personal data processor is a party who carries out personal data processing activities, appointed by through an agreement with the personal data controller.

The Draft GR PDP lays out criteria that must be followed in processing personal data. The collection of personal data must be done in a limited, specific, lawful, and transparent manner, and the processing of personal data must be conducted:

  • In accordance with the declared purpose for processing the personal data;
  • In a manner that guarantees the rights of the personal data subject;
  • In a manner that is accurate, complete, not misleading, up-to-date, and reliable.
  • In a manner that protects the security of personal data by preventing unauthorized access, unauthorized disclosure, unauthorized alteration, misuse, destruction, and erasure of the personal data;
  • By informing the personal data subject of its purpose and activities of processing, as well as any failure in protecting the personal data; and
  • Responsibly, as supported by clear evidence of the personal data processing activities.

Personal data must be destroyed or erased after the retention period ends or upon the request of the personal data subject, unless otherwise stipulated by laws or regulations.

Cross-Border Transfers of Personal Data

According to the Draft GR PDP, personal data controllers are allowed to transfer personal data to another personal data controller or personal data processor outside of Indonesia only after the personal data controller ensures that the intended receiver of the personal data has an equivalent or higher level of personal data protection. Personal data controllers must also ensure that there are adequate and binding personal data protection mechanisms in the receiver’s country. If the receiver’s country does not meet the requirements mentioned in Indonesia’s data protection laws and regulations, the personal data controller must obtain the personal data subject’s approval to transfer the data.

Next Steps

The publication of the Draft GR PDP suggests that the final implementing regulation will align with the Health Law and its implementing regulation in relation to the storage, processing, and transfer of health and medical data. This alignment is essential in order to enforce the protection of personal data in healthcare services in Indonesia. With these strong protections in place, patients and providers will benefit from greater security and privacy, leading to an overall better standard of care in Indonesia’s rapidly advancing digital and other health services.

Related Professionals

Industries

Life Sciences

Technology

Location

RELATED INSIGHTS​ 

September 7, 2026
On September 4, 2026, Thailand’s prime minister convened the first meeting of the Data Center Business Policy Committee. The committee endorsed a draft policy framework for the data center industry and tasked four subcommittees with developing the standards that would sit beneath it, shifting away from fragmented, agency-by-agency approvals toward a unified national strategy aiming to maximize economic value while managing environmental and infrastructure concerns. Proposed Scope and Pillars of the National Data Center Policy Framework The proposed framework would cover all types of data centers, including internal or captive facilities operated within a company or its affiliates, rather than only commercial third-party providers. If adopted in this form, companies running private data centers purely for internal purposes would also become subject to regulatory oversight. Minimum safety and operational standards would be established, with uniform enforcement across all categories. The committee endorsed a draft policy framework with four key pillars: Industrial classification: Data centers exceeding 2 MW would be classified as industrial operations, which may require factory licenses and environmental impact assessments under the Factory Act. Resource pricing: Utility rates would be structured to reflect both direct and indirect costs, supporting green energy and green data center standards. Centralized screening: A centralized review would evaluate project suitability and resource allocation. Operators may be required to submit proposals through periodic “pitching” rounds, where projects are competitively assessed on their potential economic and strategic benefits to Thailand. Digital ecosystem: The framework would prioritize data sovereignty, tax incentives, and conditions promoting domestic digital businesses, AI, and cloud infrastructure. Multidimensional Evaluation Criteria and Subcommittees Four subcommittees will be established to develop standards responsible for the following dimensions: Economic: Criteria for assessing the economic viability of data center projects, for use in prioritizing data centers based on infrastructure readiness, demand type (including AI factories),
Read More
September 7, 2026
Indonesia’s Constitutional Court (Mahkamah Konstitusi) has reinstated a key provision limiting pharmaceutical patent protection, signaling a renewed commitment to balancing patent rights with public access to medicines. In its ruling to Case No. 255/PUU-XXIII/2025, the court partially granted a petition for judicial review of Law No. 65 of 2024, which had amended the country’s Patent Law, and ordered the restoration of a provision that had excluded certain pharmaceutical inventions from patentability. The decision took effect immediately upon its pronouncement at the court’s plenary session on August 28, 2026. Background The petition challenged the removal of article 4(f) from Law No. 13 of 2016 concerning Patents (Patent Law), as amended by Law No. 65 of 2024. Article 4(f) had excluded from patentability certain inventions relating to new uses of known substances. The petitioners argued that removing this provision would open the door to patent protection for second medical use inventions and facilitate patent evergreening—practices that can extend exclusivity periods, delay generic market entry, and reduce public access to affordable medicines. The petitioners included several patient advocacy and public-interest organizations: the Indonesian Dialysis Patients Community Association, the Indonesian Association of Drug Abuse Victims (PKNI), the Indonesian Pulmonary Hypertension Foundation (YHPI), the Rekat Peduli Indonesia Foundation, and the Indonesian Positive Women’s Association (IPPI), along with the Indonesia for Global Justice Association and four individual petitioners. The petitioners also challenged the constitutionality of the phrase “interested party” in article 70(1) of the Patent Law, arguing that it should be construed expressly to clarify who has standing to appeal a decision to grant a patent before the Board of Patent Appeal, and to allow a broader range of parties—such as patent holders, licensees, consumer organizations, prosecutors, aggrieved third parties, and others who may suffer direct or indirect harm from the grant of a patent—to
Read More
September 4, 2026
Blind boxes and collectibles have become increasingly popular, driven by the excitement of not knowing which character or design will be revealed until the package is opened. While most visible in the art toy market, the same concept is also used in the food industry. Confectionery, snacks, and other food products are sometimes sold with toys, character figures, cards, or other collectibles. A package might, for example, contain one of ten possible characters, with consumers knowing that an item is included but not which one they will receive. Some collections may also feature rare or “secret” items. For food businesses, however, adding a randomized toy or collectible involves more than a marketing decision. The food, the nonfood item, and the randomized mechanism may each raise different regulatory considerations in Thailand. Thai FDA Requirements for Nonfood Objects Packaged with Food The main food regulatory consideration is Ministry of Public Health Notification No. 310 B.E. 2551 (2008), which regulates food packaged together with things or objects that are not food. Under Notification No. 310, certain nonfood objects may be packaged together with food where they fall within specified exceptions, including objects that serve the following purposes: Maintaining the quality or standard of the food, such as a desiccant or oxygen absorber; Serving as a seasoning or as part of food preparation, such as chili powder sachets or seasoning sachets contained in instant noodle packages; or Functioning as an eating or food-preparation utensil, such as a spoon or fork included with instant noodles. Other nonfood objects that do not fall within these categories generally should not be placed inside the food container together with the food. Where a toy, collectible, or other nonfood object is intended to be sold together with a food product, businesses should therefore carefully consider the nature of
Read More
September 4, 2026
Foreign business restrictions on telecommunications, treasury center businesses, and intragroup support services were eased when Thailand published the Ministerial Regulation Prescribing Service Businesses Not Requiring Permission for Foreign Business Operations (No. 5) B.E. 2569 (2026) in the Government Gazette on August 28, 2026. The ministerial regulation expands the categories of service businesses that foreign investors may operate without a foreign business license (FBL) under the Foreign Business Act B.E. 2542 (1999) (FBA). Of particular relevance to the telecommunications, fintech, and technology sectors, the ministerial regulation exempts: Type 1 telecommunications licensees, which do not have their own networks; Treasury center businesses operated in accordance with Thailand’s exchange control regulations; and Certain intragroup administrative, human resources, and information technology management services. Telecommunications Services Foreign-owned businesses providing telecommunications services under a type 1 telecommunications license may now operate without obtaining an FBL. This may streamline market entry for qualifying telecommunications and digital infrastructure businesses. The exemption applies only to the FBA licensing requirement. Operators must continue to comply with applicable requirements under the Telecommunications Business Act and the regulations of the National Broadcasting and Telecommunications Commission, and the change does not affect foreign ownership restrictions applicable to type 2 or type 3 telecommunications businesses. Treasury Center Businesses The ministerial regulation also exempts qualifying treasury center businesses from the FBL requirement. This may facilitate centralized treasury functions in Thailand, including liquidity management, foreign exchange management, and intragroup funding arrangements. Treasury center operations remain subject to applicable requirements of the Bank of Thailand and other competent authorities. Intragroup Administrative, HR, and IT Services Certain administrative, human resources, and information technology management services provided between affiliated entities are also exempt, provided the relevant entities satisfy prescribed ownership or management criteria. The exemption is available where the service provider and recipient are related through specified ownership
Read More