By KYN AI Advisory Team — AI implementation specialists, Singapore
Indonesia's Personal Data Protection Law (Law No. 27 of 2022, "UU PDP") applies to an AI agent that handles customer data in the same way it applies to any other processing: you need a lawful basis, a stated purpose, security, a contract with each processor, and a process for people to exercise their rights. The transition period has ended, so treat the Law as in force. Implementing rules and the supervisory agency are still developing, so build to the Law's text and re-check the detail each quarter.
This is a practical checklist, not legal advice. Confirm points that affect you with a qualified Indonesian lawyer and with Komdigi, the ministry responsible for communications and digital affairs.
What does the PDP Law cover?
The Law covers personal data of individuals, which it divides into general data (name, gender, nationality, religion, marital status, and data that combines to identify a person) and specific data (health, biometric, genetic, criminal records, children's data, personal financial data and other data set by law). Specific data carries higher duties, including an impact assessment.
It applies to processing in Indonesia, and to processing outside Indonesia that has legal consequences in Indonesia or for Indonesian data subjects. A Singapore company running an agent on Indonesian customers' data should assume the Law reaches it.
The Law uses three roles.
- Data subject: the person the data is about.
- Data controller: decides the purpose and means of processing. Usually your company.
- Data processor: processes on the controller's behalf. Your agent vendor, cloud provider and model provider can each be processors.
Your company stays accountable as the controller for processing the vendor does for you.
What is the lawful basis for an agent to use customer data?
The Law lists several bases: explicit consent, performance of a contract, a legal obligation, protection of vital interests, a public task, and legitimate interests. Consent has formal requirements. It must be explicit, given for stated purposes, and be provable.
For agents, the common cases:
| Agent task | Likely basis | Note | |---|---|---| | Replying to a customer's own enquiry | Contract or the customer's request | Keep to the matter raised | | Sending an invoice reminder | Contract | Keep records of the obligation | | Marketing messages | Consent | Record consent with date and wording | | Profiling customers to score or rank them | Consent or a documented interest | Check the Law's automated decision rules | | Using chat history to tune the agent | A new purpose | Needs its own basis |
The Law gives data subjects a right to object to decisions made solely by automated processing, including profiling, that have legal consequences or a significant effect on them. If an agent ranks customers or decides eligibility, keep a person in the loop. See human approval gates.
What rights must your system support?
A data subject can ask to:
- be informed about the purpose and use of their data;
- access and obtain a copy of their data;
- correct inaccurate data;
- delete data, or end processing;
- withdraw consent;
- object to automated decisions;
- claim redress for a violation.
An agent system multiplies the places to search: CRM, files, drafts, logs, prompts at the model provider and backups. Build one request procedure.
- Hold a single identifier across systems.
- Keep logs keyed by that identifier.
- Provide an export function for access requests.
- Provide a deletion routine that covers every copy, with a log entry as proof.
- Record the date of each request and each response.
What do you need in the contract with a vendor?
The controller must have a basis for engaging a processor, and the processor must act only on the controller's instructions. A contract should include:
- the subject matter, duration and purpose of processing;
- the types of data and the categories of people;
- security measures;
- a duty to notify you promptly of a breach;
- conditions for sub-processors, with a list;
- return or deletion of data at the end;
- audit or information rights.
Ask the same questions of the model provider and the cloud provider. For a checklist, see where AI agent data is stored: questions for vendors and what questions a company should ask an AI vendor about security.
What about sending data out of Indonesia?
The Law allows transfer abroad when the receiving country has an equivalent or higher level of protection, and otherwise requires adequate and binding safeguards or the data subject's consent. A model call to a provider outside Indonesia is a transfer.
Steps for an agent system:
- Identify where each processor handles the data, including the model provider.
- Check whether the destination meets the Law's test, or put a binding agreement in place.
- Send less. Remove fields the task does not need.
- Keep the record of the assessment.
Where you can, choose a cloud region in Southeast Asia and a model service inside your own cloud account. See self-hosted vs cloud AI models. Sector rules, such as those for financial services and for electronic system operators, may add data location duties on top of the PDP Law, so check your sector.
What happens when there is a breach?
The Law requires a controller to notify the data subjects and the supervising authority in writing within a short fixed period after a failure of protection. Practitioners commonly describe the period as 3 x 24 hours, and the detail depends on the implementing regulation, whose status has been changing. Treat 72 hours as your planning limit and confirm the current figure with counsel and with Komdigi.
To meet a deadline that short, you need three things in place before an incident:
- Detection: alerts on odd agent behaviour, such as a read-only agent attempting to write.
- Scope: a log that shows what each account touched. See access logging for AI agents.
- Owner: a named person who decides, with a template notice in Bahasa Indonesia.
How much of this is settled?
Be precise about uncertainty.
- Fact: the PDP Law, Law No. 27 of 2022, has been enacted and its transition period has ended.
- Uncertain: the implementing regulation and the independent supervisory agency have been moving through drafting and issuance. Reports on their status differ, so check the current state before relying on a specific procedure or fine.
- Recommendation: build to the Law's text, keep your records complete, and revisit the checklist each quarter.
The Law sets criminal and administrative sanctions for violations. Verify the current scale of fines and penalties against the text of the Law and its regulations before you rely on any figure.
A checklist for Indonesian customer data
- [ ] Each use of data maps to a lawful basis and a stated purpose.
- [ ] Consent records show date, wording and channel.
- [ ] Specific data is flagged, with an impact assessment where required.
- [ ] Rights requests have a procedure and an owner.
- [ ] Every processor has a written contract with the clauses above.
- [ ] Transfers abroad are identified and covered.
- [ ] Bahasa Indonesia notices and consent text exist.
- [ ] Logs name the actor for every action.
- [ ] A breach procedure exists, with a Bahasa template.
- [ ] Outbound messages, money and deletions wait for a named person.
Where KYN fits
KYN builds systems in a cloud account in the client's name, so the client controls where customer data sits and who can reach it. Named accounts, one restricted account per user per session, agent accounts of their own and row-level security limit access. Every action is logged with the actor, and outbound messages, money, filings and deletions wait for a named person. We build English and Bahasa Indonesia interfaces from the start for Indonesian clients.
The first 14 days are a review of your stack and interviews with your team, including a map of the customer data your tools hold. A full build ships in under 90 days. See finance, integrations and security.
Frequently asked questions
Does the PDP Law apply to a company based in Singapore?
It can. The Law reaches processing outside Indonesia that has legal consequences for Indonesian data subjects or inside Indonesia. If your agent handles Indonesian customers' data, plan to comply, and confirm the scope with counsel.
Can an AI agent make decisions about customers on its own?
For decisions with legal or similarly significant effects, the Law gives people a right to object to solely automated processing. Keep a named person in the decision. Let the agent prepare the case, and let the person decide.
Do I need consent to message an existing customer?
For marketing, record explicit consent. For service messages about a contract the customer has with you, such as an invoice, the contract can be the basis. Keep the two apart in your system.
Checked 30 October 2026.
Curious whether Marketing agents fits your business? Talk to KYN on WhatsApp — no forms, just a conversation.
