Indonesia PDP Law (UU 27/2022): what it means for hosting your website or app outside Indonesia

A practical guide for Indonesian businesses, developers and agencies deciding where to host customer data. Based on the text of Law No. 27 of 2022 on Personal Data Protection. Status as of 30.09.2026. This is general information, not legal advice.

Short answer

1. 1UU 27/2022 does not ban hosting personal data outside Indonesia. Article 56(1) says a controller may transfer personal data to a controller or processor outside Indonesian jurisdiction, under the conditions of the Law.
2. 2Those conditions come in three steps (Art. 56(2)-(4)): first, the receiving country has an equal or higher level of protection; if not, adequate and binding protection must apply; if neither holds, you need the consent of the data subject.
3. 3The Law follows your activity, not your server: under Article 2 it also covers acts outside Indonesia that have legal effect in Indonesia or on Indonesian citizens abroad.
4. 4The grace period ended: Article 74 gave two years from promulgation on 17 October 2022, so adjustment was due by 17 October 2024.
5. 5Responsibility stays with you as controller. A hosting provider does not certify legal compliance on your behalf.

What the Law says

Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi (UU PDP) was enacted and promulgated on 17 October 2022 and entered into force on the date of promulgation (Art. 76).

Scope. Article 2(1) applies the Law to any person, public body and international organisation that performs a legal act within Indonesian jurisdiction, and also outside it where the act has legal effect in Indonesia or on a data subject who is an Indonesian citizen abroad.

Transfers abroad (Art. 56). A controller may transfer personal data to another controller or to a processor outside Indonesian jurisdiction. It must ensure that the country where the recipient is domiciled has a level of protection equal to or higher than the Law (Art. 56(2)). If that is not met, it must ensure adequate and binding protection (Art. 56(3)). If neither is met, it must obtain the data subject's consent (Art. 56(4)). Article 56(5) leaves further detail to a Government Regulation. The Law contains no list of approved countries.

Security and processors. The controller must protect the data with technical and operational measures and set the security level according to the nature and risk of the data (Art. 35), and must prevent unauthorised access using a reliable, safe and accountable security system (Art. 39). A processor acts on the controller's instructions, and the processing remains the controller's responsibility (Art. 51(1) and (3)). A processor needs the controller's written approval before involving another processor (Art. 51(5)). The security duties of Articles 35 to 39 also bind processors (Art. 52).

Breaches and sanctions. After a failure of personal data protection, the controller must give written notice to the data subject and to the institution within 3 x 24 hours (Art. 46(1)). Breaches of many provisions, including Articles 46(1), 51 and 56(2) to (4), attract administrative sanctions: a written warning, suspension of processing, erasure of data and/or an administrative fine of at most 2 percent of annual income or revenue linked to the violation (Art. 57).

Implementing rules. The Law promised a Government Regulation on transfers. Indonesian legal databases and press report that Government Regulation No. 33 of 2026 was issued on 16 July 2026 and takes effect six months after promulgation. We did not read its text and cannot describe its transfer rules. The same reports describe the supervisory authority as not yet established; we could not confirm its status on an official source. Check both before you rely on this page.

Real-world examples

Common mistakes

• Reading Article 56 as a ban. The text permits transfers and sets an order of conditions.
• Skipping the order of conditions. Consent under Art. 56(4) is the last step, used only when the first two are not met.
• Assuming a foreign server puts you outside the Law. Article 2(1)(b) looks at legal effect in Indonesia or on Indonesian citizens.
• Having no breach procedure. Article 46 requires written notice within 3 x 24 hours to the data subject and to the institution.

How 4hosting helps

Our datacenter is in the EU, in Frankfurt, not in Indonesia. We say this plainly so that you can name the destination country accurately in your own records. We offer a data processing agreement (DPA) under GDPR Article 28 and standard contractual clauses for transfers, which gives you a written record of the processor relationship. Whether those documents satisfy Article 56 for your data is a judgement for you and your lawyer.

Every plan includes monthly DevOps, CyberSecurity and Programming hours (from cPanel Advanced upwards; VPS plans include 1 to 8 hours). You can use them for server hardening, backups and WAF rules. 4hosting is not a compliance certifier and does not sign legal compliance for you. Migration is free. See the plans for what is included.

Frequently asked questions

See also

• 4hosting for Indonesia
• GDPR compliance at 4hosting
• Contact us about your setup