Data Processing Agreement in Indonesia: Template, Key Clauses and Local Law (2026)

A data processing agreement, often called a DPA, is the contract that governs how one party processes personal data on behalf of another. In Indonesia this agreement now has a real statutory backbone: the Personal Data Protection Law (Law No. 27 of 2022, the PDP Law), Indonesia's first comprehensive data protection statute. If your business shares personal data with a vendor, or processes data for a customer, a DPA is how you allocate the duties and liability the law creates. This guide explains the local law, the clauses a DPA should contain, and a template outline. It is general information, not legal advice. ## What law governs data processing in Indonesia? The main instrument is the PDP Law (Law No. 27 of 2022), enacted on 17 October 2022 with a two-year transition period that ended on 17 October 2024. Before it, data protection was spread across the Electronic Information and Transactions Law (Law No. 11 of 2008, as amended) and Government Regulation No. 71 of 2019 on the operation of electronic systems, along with sector rules. Those instruments still matter, especially GR 71 of 2019 for electronic system operators, but the PDP Law is now the central framework. The PDP Law borrows the familiar European structure. It distinguishes a data controller, who determines the purpose and controls processing, from a data processor, who processes data on the controller's behalf and on its instructions. The controller is in principle responsible for the processor's processing, but a processor that acts outside the controller's instructions becomes responsible for that processing itself. This split is exactly what a DPA is designed to document. ## When do you need a DPA in Indonesia? You need a DPA whenever one party processes personal data on behalf of another. Common examples: a company using a cloud or SaaS vendor, a payroll or HR outsourcer, an analytics provider, or a marketing agency handling customer lists. The controller must be able to show that its processors are bound by obligations that mirror the law, and the contract is the evidence of that. ## Key clauses a DPA should contain | Clause | Purpose | | --- | --- | | Roles and definitions | Identify who is controller and who is processor, and define personal data, processing and data subject | | Scope and purpose | Describe the data, categories of data subjects, and the limited purposes of processing | | Processor duties | Process only on documented instructions, keep records, cooperate with the controller | | Security measures | Technical and organisational safeguards appropriate to the risk | | Confidentiality | Bind personnel who access the data to confidentiality | | Sub-processors | Prior authorisation, and flow-down of equivalent obligations | | Data subject rights | Assist the controller to respond to access, correction, deletion and objection requests | | Breach notification | Notify the controller without undue delay so statutory notice duties can be met | | Cross-border transfer | Conditions for sending data outside Indonesia | | Audit and compliance | Allow the controller to verify compliance | | Return or deletion | Return or delete data at the end of the service, subject to retention rules | | Liability and indemnity | Allocate responsibility for breaches of the DPA | ## Data subject rights to support The PDP Law grants individuals a set of rights, including the right to information about processing, to access and obtain a copy of their data, to correct inaccurate data, to erase or delete data, to withdraw consent, to object to certain processing, and to seek compensation. A processor's DPA obligations should include practical help so the controller can honour these within the timeframes the law expects. ## Breach notification The PDP Law requires notification of a personal data breach. The controller generally must notify both the affected data subjects and the supervisory authority within a short window after becoming aware of the breach. A DPA should require the processor to alert the controller quickly and with enough detail for the controller to meet that duty, so build a defined notice period and an information checklist into the clause. ## Cross-border data transfer The PDP Law permits transfers of personal data outside Indonesia where the receiving country has a comparable or higher level of protection, or where adequate and binding safeguards are in place, or with the data subject's consent. A DPA involving an offshore processor should state the legal basis for transfer and the safeguards relied on, so the transfer does not become the weak point in an otherwise compliant arrangement. ## A note on language Where an Indonesian party is involved, Article 31 of Law No. 24 of 2009 calls for an Indonesian-language version of the agreement. For a DPA signed with an Indonesian counterparty, prepare a bilingual Indonesian and English document and execute both versions, naming the version that prevails, rather than relying on English alone. ## A template outline you can adapt 1. Parties, roles and definitions 2. Subject matter, nature and purpose of processing 3. Categories of data and data subjects 4. Processor obligations and documented instructions 5. Security measures 6. Confidentiality of personnel 7. Sub-processors and flow-down 8. Assistance with data subject rights 9. Personal data breach notification 10. Cross-border transfer conditions 11. Audit and demonstration of compliance 12. Return and deletion of data 13. Liability and indemnity 14. Term, governing law and language ## Common mistakes to avoid - Treating a generic European DPA as sufficient without mapping it to the PDP Law.

• Leaving sub-processor authorisation and flow-down out of the contract.
• No defined breach notice period, so the controller cannot meet its own deadline.
• Ignoring cross-border transfer conditions for an offshore processor.
• Relying on an English-only document with an Indonesian party. ## Keeping data terms consistent across contracts Most organisations do not sign one DPA. They sign many, each slightly different: different breach windows, different sub-processor lists, different transfer bases. Keeping those consistent, and knowing which version is the signed one, is the real operational burden. It is the same across every contract: draft, review for risky terms, track the dates, keep versions straight. Teams increasingly do that in one connected workspace instead of scattered files. Adira is an AI contract workspace that drafts, reviews per-clause risk, and tracks obligations and renewals in one place. Adira is India-first today, and deeper non-India jurisdiction support, including Indonesia, is on its roadmap, so confirm PDP Law specifics with local counsel. This article is general information and not legal advice.