Legal Protection for the Personal Data in Indonesia and Malaysia

Rapid globalization in Indonesia has led to the growth of the information technology sector, which has an impact on individuals and global economic growth. However, the country does not have comprehensive laws protecting personal data, resulting in scattered laws and regulations across various sectors. The Personal Data Protection Act (PDPA) is a global law that mandates consent before collecting and processing personal data. Malaysia and Indonesia have similar PDPAs, which adopt principles from the European Union Data Protection Directive, OECD guidelines and the APEC Framework. However, there are differences in implementation. Malaysia’s PDPA focuses on commercial transactions and the private sector, while Indonesia’s PDPA covers both the public and private sectors. Meanwhile, the Malaysian government is preparing a revision of the Malaysian PDPA to cover both the public and private sectors, which is administered by the Commissioner of the Department of Personal Data Protection and only applies to the private sector. Indonesia and Malaysia have also implemented various laws regulating personal data protection in addition to the PDPA. PDPA Indonesia regulates personal data protection in public and private sectors, but no agency oversees implementation. Institutions must have independence, expertise, transparency, and collaborate with other government agencies. Policies, administrative consequences, and law enforcement collaboration are essential.