Every finding in the comparative names the draft articles it compares against the
enacted ones, and the two pane diff compares exactly those. If a clause moved to an article a
finding does not name, the diff strikes it through as deleted when it in fact survives.
That is the worst failure this deliverable can have, because the page is read as
evidence of what was removed. This page is the record of what that check found and what was done
about it.
I am just scared that perhaps the articles are scattered. For example, the
original article in article seventy, seventy one, seventy two, which was within the same item, and
then the change one is in article seventy three.
Shown as deletedA draft clause with no counterpart among the
named enacted articles, but a close one in an article the finding never cites.8
Shown as newThe mirror. An enacted clause that was already in the
draft, in an article the finding does not name.6
Pairing offsetA named draft article whose closest enacted twin is
absent from the finding, which is the case of seventy two answering to seventy three.12
46findings put through a full reading
48articles added to comparisons
6claims found wrong and rewritten
27examined and left alone
The claims that were wrong
Each of these told a deletion story about something that moved or changed hands.
Every rewrite was put to a second reader whose instruction was to refute it, and every one came back
refuted on some point, so the corrected wording is what is published. The old title is struck
through above the new one.
Claim rewrittenCross-border transfer · title, what_changed, analysis, takeaway
Merger agreement no longer must cover deletion or return of data
Destruction of transferred data moves from the transfer agreement to the notice to subjects
What changed, as it now reads
RPP Pasal 144 ayat (2) put the deal mechanics in the agreement itself. Huruf b limited the new controller's access to the duration of the transaction, huruf c limited the use of that access to the decision whether to proceed, huruf d bound the new controller to destroy or return everything if the transaction failed, and huruf e bound the old controller to destroy what it had transferred. PP 33/2026 Pasal 134 ayat (2) carries none of the four. Only huruf a survives, as PP Pasal 134 ayat (2) huruf d. The old controller's destruction undertaking reappears outside the agreement, at PP Pasal 133 ayat (3) huruf g, as mandatory content of its notification to data subjects.
Why.
The old controller's destruction undertaking at RPP Pasal 144 ayat (2) huruf e survives at PP Pasal 133 ayat (3) huruf g in changed legal form, as a pernyataan inside the notification to data subjects rather than a required term of the agreement between the two controllers. The current title reads as a deletion of the destruction duty, so it is rewritten to say where the duty went.
The add list stays empty because PP Pasal 133 runs to 3395 characters and breaches the panel length cap, so the survival is carried in the rewritten what changed and analysis instead.
The adversarial check refuted the first draft and its corrections were taken.
Undercount of the dropped clauses. The what_changed names only three RPP requirements (the purpose limit, the failed transaction return, the old controller's destruction) and says PP Pasal 134 ayat (2) 'carries none of the three'. RPP Pasal 144 ayat (2) huruf b also disappears and is never mentioned: 'pemberian akses Data PribadiPengendali Data Pribadi lama kepada Pengendali Data Pribadi baru diberikan sepanjang transaksi berlangsung', a duration limit on the new controller's access.
Your view
Claim rewrittenCross-border transfer · what_changed, analysis, takeaway
RPP Pasal 188 ayat (1) said the rules wajib memuat persyaratan paling sedikit the four listed items. PP Pasal 171 ayat (1) says they paling sedikit memuat those items, dropping wajib and dropping persyaratan, and renames peraturan perusahaan as peraturan korporasi. The chapeau re-anchors the rules, from RPP Pasal 185 ayat (2) huruf c to PP Pasal 169 ayat (1) huruf c. The draft delegation at RPP Pasal 188 ayat (4) has no counterpart in the enacted article, which ends at ayat (3).
Why.
The two provisions are not different objects, one sits inside the other. PP Pasal 171 ayat (1) locates peraturan korporasi yang mengikat inside Pasal 169 ayat (1) huruf c, and PP Pasal 172, the next article, delegates pelaksanaan Pelindungan Data Pribadi yang memadai dan bersifat mengikat, which the finding itself treats as the Pasal 165 ayat (2) limb that an incomplete set of rules would breach.
The enacted text delegates by route where the draft delegated by instrument, so RPP Pasal 188 ayat (4) is absorbed, not deleted, and striking it says no delegation reaches binding corporate rules.
The adversarial check refuted the first draft and its corrections were taken.
Check 1 fails. PP Pasal 172 does not contain the clause the recast needs. Its object is "pelaksanaan Pelindungan Data Pribadi yang memadai dan bersifat mengikat", a route. It never names peraturan korporasi yang mengikat, which RPP Pasal 188 ayat (4) names in terms. The containment claim rests entirely on PP Pasal 169 ayat (1) huruf c, which the brief does not quote. The proposal concedes this.
Under the evidence rules that is verdict "unsettled", not "recast", with add lists empty.
Your view
Claim rewrittenCross-border transfer · what_changed, analysis, takeaway
Consent-route obligations restated as tetap rather than wajib
What changed, as it now reads
RPP Pasal 190 ayat (1) said that on a consent-based transfer the controller wajib melaksanakan kewajiban sesuai dengan ketentuan peraturan perundang-undangan. PP Pasal 173 ayat (1) says the controller tetap melaksanakan those obligations, and it attaches the duty to dalam mendapatkan persetujuan rather than to the transfer itself, with the cross-reference now running to PP Pasal 165 ayat (3) where the draft pointed to RPP Pasal 189. The draft delegation at RPP Pasal 190 ayat (3) reappears as a standalone article at PP Pasal 174, rewritten to name pelaksanaan persetujuan untuk transfer Data Pribadi ke luar wilayah hukum Negara Republik Indonesia.
Why.
Both provisions govern the same object, consent as the basis for transferring personal data out of the jurisdiction. RPP Pasal 190 ayat (3) delegates transfer Data Pribadi berdasarkan persetujuan, and PP Pasal 174 delegates pelaksanaan persetujuan untuk transfer Data Pribadi ke luar wilayah hukum Negara Republik Indonesia, sitting directly after Pasal 173, the enacted consent article the finding already cites.
The clause moved out of the ayat and became a standalone article. Striking it as deleted states that the consent route lost its Peraturan Lembaga hook, which the enacted text contradicts.
The adversarial check refuted the first draft and its corrections were taken.
The core verdict survives. PP Pasal 174 does contain the clause in substance: "Ketentuan lebih lanjut mengenai pelaksanaan persetujuan untuk transfer Data Pribadi ke luar wilayah hukum Negara Republik Indonesia diatur dalam Peraturan Lembaga." It governs the same object as RPP Pasal 190 ayat (3), consent as a route for transfer out of the jurisdiction, and it sits immediately after PP Pasal 173, the enacted consent article.
Retention policy moves into records and gains a legal basis item
Retention definition moves to Pasal 1 and the policy document gains a legal basis item
What changed, as it now reads
RPP Pasal 101 carried four things: the definition of masa retensi at ayat (1), the rule at ayat (2) that a period resting on a legal obligation is set by legislation, the bar at ayat (3) on using data held on that footing for other purposes, and the retention policy document at ayat (4) and ayat (5) with nine minimum contents. PP 33/2026 splits them. The definition sits at PP Pasal 1 angka 23, differing from the draft only in reading adalah for merupakan. The document sits at PP Pasal 75, without the harus of RPP Pasal 101 ayat (4), and with a tenth item at huruf j requiring dasar hukum pengaturan where the Masa Retensi arises from a legal obligation.
Why.
RPP Pasal 101 ayat (1) survives verbatim in substance at PP Pasal 1 angka 23, so striking it out states the law falsely. The change is one of legal form: an operative ayat inside the retention article became a defined term governing the whole instrument, which is why this is recast and not a plain relocation.
Per the panel rule I do not add PP Pasal 1, which is the definitions article and far over the length limit; the move is stated in the analysis instead and the add lists stay empty. The finding's own claim about Pasal 75 stands, so the rewrite keeps it and corrects only the deletion reading.
The adversarial check refuted the first draft and its corrections were taken.
Overreach on huruf j, and internally inconsistent. PP Pasal 75 ayat (2) huruf j reads 'dasar hukum pengaturan, jika Masa Retensi karena kewajiban hukum sesuai dengan ketentuan peraturan perundang-undangan'. The requirement is conditional on the retention period arising from a legal obligation.
Your view
Claim rewrittenScope and definitions · title, what_changed, analysis, takeaway
Six lifecycle duty articles deleted from the processing chapter
Lifecycle duties dropped from the processing chapter, correction duty recast as a right
What changed, as it now reads
RPP Pasal 10 to Pasal 15 attached a Pengendali Data Pribadi harus checklist to each of the six processing stages listed in RPP Pasal 9. PP 33/2026 keeps the enumeration at Pasal 8 and attaches no checklist to it. One item survives in changed form. RPP Pasal 13 huruf a put memfasilitasi Subjek Data Pribadi untuk melengkapi, memperbarui, dan/atau memperbaiki kesalahan dan/atau ketidakakuratan Data Pribadi on the Pengendali Data Pribadi as a duty, and PP Pasal 70 states that same conduct as a right of the Subjek Data Pribadi over data tentang dirinya, qualified by sesuai dengan tujuan pemrosesan Data Pribadi.
Why.
Case 1 and case 3 are the same move at clause and article level: RPP Pasal 13 huruf a survives at PP Pasal 70, converted from a controller duty into a subject right. The headline claim that all six duty articles disappear therefore reads as a deletion that did not happen, which is why this is recast rather than relocation, and PP Pasal 70 is added because it is a single short sentence.
Case 2 is coincidental: RPP Pasal 14 huruf b imposes compliance with cross border transfer criteria, while PP Pasal 174 is the standard ketentuan lebih lanjut diatur dalam Peraturan Lembaga deferral aimed at the consent mechanism, so the shared vocabulary is a drafting formula and Pasal 174 is not added.
The adversarial check refuted the first draft and its corrections were taken.
Analysis contradicts the quoted draft text. It says the conduct is now on the subject's initiative "rather than the controller's own motion". RPP Pasal 13 huruf a reads memfasilitasi Subjek Data Pribadi untuk melengkapi, memperbarui, dan/atau memperbaiki, so the draft duty was already discharged on the subject acting. There was no own-motion duty to lose.
Your view
Claim rewrittenScope and definitions · what_changed, analysis, takeaway
The rule making a data requester a controller is deleted
What changed, as it now reads
RPP Pasal 16 ayat (3) deemed any party requesting personal data to be a controller. PP Pasal 10 lists the three parties to processing that the Regulation governs and carries no such deeming rule. The other limb survives: the rule in RPP Pasal 16 ayat (2) sits in the definitions at PP Pasal 1 angka 6, so it is not deleted.
Why.
The flagged clause is RPP Pasal 16 ayat (2), not the requester rule. It survives verbatim as PP Pasal 1 angka 6, so showing it struck through as deleted is false. PP Pasal 1 is the definitions article and is far past the length bar, so it stays out of the panel and the survival is stated in the analysis instead.
The finding's headline holds on its own limb: PP Pasal 10 lists only the three parties and carries no deeming rule for a party requesting data, so RPP Pasal 16 ayat (3) has no enacted counterpart in the text before me.
The adversarial check refuted the first draft and its corrections were taken.
Relocation overreach in what_changed. "it moved into the definitions at PP Pasal 1 angka 6" asserts a movement the brief cannot establish, because RPP Pasal 1 is not reproduced anywhere in it. If the draft's own definitions article already carried the same definition, nothing moved and RPP Pasal 16 ayat (2) was an in-place restatement that was simply not repeated. All the brief supports is that the substance survives in PP Pasal 1 angka 6.; Textual inaccuracy in the analysis.
Your view
Articles added after a full reading
The clause survives in these articles, so naming them stops the comparison striking
it out. The claim itself was left alone in each case.
Added
To this finding
Theme
PP Pasal 131
Ban on third-party access without accepting terms is deletedRPP Pasal 143 ayat (2) survives almost word for word as PP Pasal 131 ayat (6). Both fix the relationship between the Pengendali Data Pribadi lama and the Pengendali Data Pribadi baru as a Pengendali Data Pribadi Bersama until the.
Cross-border transfer
PP Pasal 135
Duty to destroy transferred data survives only as a notice lineBoth flagged clauses answer to PP Pasal 135, which the finding does not name. RPP Pasal 146 ayat (2) reappears at PP Pasal 135 ayat (2) word for word apart from a broken space in the extraction, and RPP Pasal 146 ayat (1) answers to PP.
Cross-border transfer
PP Pasal 174
Consent-route obligations restated as tetap rather than wajibBoth provisions govern the same object, consent as the basis for transferring personal data out of the jurisdiction.
Cross-border transfer
RPP Pasal 200
Supervision orders now carry a set deadline and action planPP Pasal 181 ayat (1) reproduces RPP Pasal 200 huruf g word for word once the opening words Lembaga berwenang are set aside.
Sanctions and enforcement
RPP Pasal 80
Nullity of the contract replaced by loss of the basisPP Pasal 67 ayat (2) huruf a repeats RPP Pasal 80 ayat (2) almost word for word. Both confine the purpose of processing to a specific purpose stated to the subject secara eksplisit dan tegas, so the two provisions govern the same object.
Lawful bases and consent
PP Pasal 44
Pre contract requests must now be written or recordedRPP Pasal 56 ayat (3) survives at PP Pasal 44. The two sentences are identical except that the enacted text closes with sesuai dengan ketentuan peraturan perundang-undangan. The legal form does not change.
Lawful bases and consent
PP Pasal 64
Notice before collection becomes notice before processingRPP Pasal 77 ayat (2) survives in substance at PP Pasal 64, which keeps the same 30 day deadline for data obtained indirectly and reads on the same fact pattern (Data Pribadi didapatkan secara tidak langsung).
Subject rights
RPP Pasal 114
Duty to run an electronic channel becomes a rule on the subjectPP Pasal 21 ayat (3) huruf a repeats RPP Pasal 114 ayat (3) almost word for word, so the reply by the same channel rule should not read as enacted invention.
Subject rights
PP Pasal 15
Controller instruction to a processor need no longer be writtenRPP Pasal 155 ayat (5) survives word for word at PP Pasal 15 ayat (2), and RPP Pasal 155 ayat (4) survives at PP Pasal 15 ayat (1). The enacted text moved the sub processor limbs out of the instruction article into their own article.
Controller duties
PP Pasal 143
DPO appointment triggers become alternative not cumulativeRPP Pasal 165 ayat (2) survives at PP Pasal 143 ayat (1) and RPP Pasal 165 ayat (3) survives at PP Pasal 143 ayat (2), each word for word bar the PPDP abbreviation and a spacing artefact in the extracted draft.
Controller duties
RPP Pasal 24
Minimisation restated as a three-factor testPP Pasal 58 is not new drafting and should stop displaying as an addition. The words terbatas dan spesifik, sah secara hukum, dan transparan sit in the draft at RPP Pasal 24 huruf a, where they were a principle governing pengumpulan.
Controller duties
PP Pasal 138
Processor accountability softened to harus but gains an audit dutyRPP Pasal 154 ayat (3) is struck through as deleted but the protection audit survives at PP Pasal 138 huruf e.
Controller duties
PP Pasal 115
Impact of the breach removed from the mandatory notificationThe flagged clause is RPP Pasal 124 ayat (4) huruf b, a trigger for public notification, not part of the ayat (3) notification content the finding is about.
Breach
PP Pasal 70
Lifecycle duties dropped and the correction duty recast as a rightCase 1 and case 3 are the same move at clause and article level: RPP Pasal 13 huruf a survives at PP Pasal 70, converted from a controller duty into a subject right.
Scope and definitions
Articles added mechanically
These counterparts were word for word, on containment of one and wording of at least
0.80, so they were added without a reading. Nothing was removed and no wording was altered.
Added
To this finding
Theme
RPP Pasal 143 RPP Pasal 145
Ban on third-party access without accepting terms is deleted
Cross-border transfer
RPP Pasal 143 RPP Pasal 145
Duty to destroy transferred data survives only as a notice line
Cross-border transfer
PP Pasal 172
Inter-state agreement route replaced by an authority-level instrument
Cross-border transfer
RPP Pasal 185 PP Pasal 172
Inter-state agreements stopped being a named route
Cross-border transfer
RPP Pasal 134
Processor contract terms on deletion and security parity dropped
Controller duties
RPP Pasal 230 PP Pasal 208
Parties not the authority appoint a mediator when none exists
Sanctions and enforcement
RPP Pasal 51
Child identification no longer keyed to child directed services
Lawful bases and consent
RPP Pasal 57 PP Pasal 41 PP Pasal 67
Nullity of the contract replaced by loss of the basis
Lawful bases and consent
RPP Pasal 84 RPP Pasal 89
Mandatory refusal of correction becomes a discretion without grounds
Subject rights
RPP Pasal 76
Notice before collection becomes notice before processing
Subject rights
RPP Pasal 121
Portability eligibility criteria are left to the authority
Subject rights
RPP Pasal 84 RPP Pasal 89 PP Pasal 77
Rectification refusal moves from three grounds to discretion
Subject rights
PP Pasal 79
Bar on erasure after withdrawal narrows to completed erasure
Subject rights
RPP Pasal 84 RPP Pasal 89 PP Pasal 71 PP Pasal 77
Correction right loses its facility and gains a purpose qualifier
Subject rights
PP Pasal 172
Accountability documents must now be shown to the Lembaga
Controller duties
RPP Pasal 154
Processor accountability softened to harus but gains an audit duty
Controller duties
PP Pasal 114
Public breach notice loses the unreachable subjects trigger
Breach
RPP Pasal 219 PP Pasal 177 PP Pasal 192
Supervision orders now carry a set deadline and action plan
Sanctions and enforcement
PP Pasal 103
Duty to run an electronic channel becomes a rule on the subject
Subject rights
PP Pasal 9
Minimisation restated as a three-factor test
Controller duties
What the check refused
Two proposed additions were thrown out by the second reader. An article either
contains the clause or it does not, and a corrected sentence cannot rescue one that does not.
Proposed and dropped: PP [172],
RPP []. PP Pasal 172 delegates a route, pelaksanaan Pelindungan Data Pribadi yang memadai dan bersifat mengikat, and never names peraturan korporasi yang mengikat. The add is dropped; the corrected prose says only what the quoted text supports.
RefusedSubject rights
Bar on erasure after withdrawal narrows to completed erasure
Proposed and dropped: PP [85],
RPP []. RPP Pasal 94 ayat (2) gates penghapusan and PP Pasal 85 ayat (1) gates pemusnahan. Different acts, so not the same clause. The add is dropped and no rewrite was offered, so the finding stands unchanged.
What I could not settle
The texts in front of me do not answer this one. It is left exactly as it was.
UnsettledCross-border transfer
Equivalence is now measured against the UU alone
The brief does not settle whether PP Pasal 165 ayat (4) descends from RPP Pasal 185 ayat (4). Two things are missing. First, the enacted counterpart of RPP Pasal 185, the PP article on Pelindungan Data Pribadi yang memadai dan bersifat mengikat, is not in the brief, and the finding's own analysis places related enacted material at Pasal 171.
If that article carries its own non-derogation clause, RPP Pasal 185 ayat (4) already has a successor there and PP Pasal 165 ayat (4) is a fresh provision, not a relocation. Second, PP Pasal 165 ayat (4) is transcribed in broken word order and cut off mid clause at ayat (1), ayat (2), dan, so neither the identity of the Lembaga nor the scope of the power can be read from the text supplied.
Examined and left alone
Indonesian statutory drafting reuses a small set of formulas, so unrelated
provisions match easily. Each of these was read in full and found to be shared wording rather than a
relocation. They are listed so you can overrule me.
Outcome
Finding and the reason
Theme
no change
Scope list drops authority powers and adds supervisionPP Pasal 4 huruf d is a heading in the scope list of the Regulation. RPP Pasal 14 huruf b is a duty on the controller, one of five conditions that apply when personal data is displayed, announced, transferred, disseminated or disclosed under RPP Pasal 9 huruf.
Scope and definitions
no change
Refused compensation goes to court not to the authorityBoth flagged pairs share compensation chapter vocabulary and govern different objects. PP Pasal 108 ayat (1) puts a duty on the controller to assess a compensation request; RPP Pasal 118 ayat (1) puts a duty on the controller to provide a communication medium.
Subject rights
no change
Cameras in public places gain a purpose and identification limitRPP Pasal 33 subjects processing through visual devices to the regulation, and PP Pasal 17 ayat (5) carries that rule inside the article the finding already names.
Controller duties
no change
Threatened public interest limb removed from public task basisRPP Pasal 63 is the enabling clause of the public task basis, and its substance sits in PP Pasal 49 ayat (1), which the finding already cites: the same three limbs, kepentingan umum, pelayanan publik, pelaksanaan kewenangan.
Lawful bases and consent
no change
Vital interests loses its third condition and widens to any partyRPP Pasal 60 does one thing, it makes the vital interests basis available, and that statement reappears in the opening line of PP Pasal 46, which the finding cites.
Lawful bases and consent
no change
Public task notice moves to the start of processingEvery ayat of RPP Pasal 66 maps onto PP Pasal 51, which the finding cites: the notice duty into ayat (1), the timing into ayat (2), the deferral into ayat (3), the public announcement fallback into ayat (4).
Lawful bases and consent
no change
Mandatory refusal of correction becomes a discretion without groundsBoth flags run on the 3 x 24 jam deadline formula and nothing else. RPP Pasal 84 reappears almost word for word in PP Pasal 71 ayat (1), and RPP Pasal 89 reappears in PP Pasal 77 ayat (1) and ayat (3), including the access contents list.
Subject rights
no change
Rectification refusal moves from three grounds to discretionBoth flagged clauses land in articles the finding already names. RPP Pasal 84 reappears word for word at PP Pasal 71 ayat (1), and RPP Pasal 89 ayat (1) reappears at PP Pasal 77 ayat (1), and the finding declares PP Pasal 71 and PP Pasal 77.
Subject rights
no change
Correction right loses its facility and gains a purpose qualifierThe flagged pair is identical to the pair in finding 59 and resolves the same way. RPP Pasal 84 is carried into PP Pasal 71 ayat (1) and RPP Pasal 89 ayat (1) into PP Pasal 77 ayat (1), both declared here alongside PP Pasal 70.
Subject rights
no change
Protection audit moves from optional to a mandatory minimumPP Pasal 141 binds the Prosesor Data Pribadi and RPP Pasal 154 bound the Pengendali Data Pribadi, so the two govern different duty bearers and the high containment score reflects parallel drafting of an accountability list.
Controller duties
no change
Consultation trigger becomes disjunctive not cumulativeThe two clauses share the standard deferral formula and govern different objects. PP Pasal 122 ayat (2) defers the impact assessment regime, penilaian dampak Pelindungan Data Pribadi, to a Peraturan Lembaga, while RPP Pasal 184 ayat (4) defers the adequacy.
Controller duties
no change
Seven transfer duties drop from wajib to harus and move to Part OneRPP Pasal 192 ayat (2) delegates pelaksanaan transfer Data Pribadi sebagaimana dimaksud pada ayat (1), meaning the seven execution duties.
Cross-border transfer
no change
Internal and external audit programme deleted and delegatedAll three flagged clauses are contents of the internal processing policy under RPP Pasal 135 ayat (2), which governs what a controller writes for its own staff and for parties processing on its instruction.
Controller duties
no change
Investigator duty to delete data after use is replaced by a labelPP Pasal 157 ayat (2) and RPP Pasal 179 ayat (2) share the pelindungan dan keamanan formula but bind different actors over different acts.
Controller duties
no change
The fine ceiling held and a door to zero openedThe flagged pair shares only the standard delegation formula. RPP Pasal 225 ayat (3) delegates the penghitungan variabel pelanggaran, the arithmetic of the fine, while PP Pasal 189 ayat (5) delegates the tata cara pengaduan atau pelaporan dugaan terjadinya.
Sanctions and enforcement
no change
Parties not the authority appoint a mediator when none existsPP Pasal 207 ayat (6) delegates the tata cara pendaftaran Lembaga Mediasi, the registration of mediation institutions. RPP Pasal 184 ayat (4) delegates the tata cara penilaian tingkat Pelindungan Data Pribadi yang dianggap setara atau lebih tinggi, the.
Sanctions and enforcement
no change
Alternative basis carve out on withdrawal is deletedThe wording score is driven by a notification formula the drafters reuse across every data subject right, memberitahukan telah dilaksanakan ... kepada Subjek Data Pribadi. The objects differ.
Lawful bases and consent
no change
Legal obligation list turns from exhaustive to illustrativeThe flagged match pairs RPP Pasal 59 huruf a with the definition of Lembaga at PP Pasal 1 angka 15, and the only shared text is the drafting formula about something diatur dalam Undang-Undang.
Lawful bases and consent
no change
Public body processing rulebook replaced by a two item policyBoth flagged matches are shared drafting formulas on unrelated subjects. PP Pasal 50 ayat (3) delegates preparation of the policy document to a Peraturan Lembaga, and RPP Pasal 131 ayat (6) delegates technical operational security measures and security level.
Lawful bases and consent
no change
Honest and good faith processing demoted to a transparency riderThe single flagged case pairs PP Pasal 60 huruf a with RPP Pasal 28 huruf a on the shared phrase about Data Pribadi yang diproses.
Lawful bases and consent
no change
Added clauses need only avoid conflict with the UURPP Pasal 187 ayat (5) and PP Pasal 48 share only the standard delegation sentence used throughout the instrument, ketentuan lebih lanjut mengenai a subject diatur dengan Peraturan Lembaga.
Cross-border transfer
no change
Processor contract terms on deletion and security parity droppedPP Pasal 128 and RPP Pasal 203 ayat (3) share the delegation formula and nothing else. RPP Pasal 203 sits with the supervisory authority and delegates the conduct of pengawasan kepatuhan carried out by the Lembaga PDP, alongside its powers to coordinate with.
Controller duties
no change
Erasure of unlawfully obtained data no longer needs a court rulingThe only overlap is the formula pelaksanaan sanksi administratif. RPP Pasal 223 ayat (2) uses it in the objection procedure, stating that lodging an objection does not suspend a sanction already imposed, which is a procedural rule about enforcement timing.
Subject rights
no change
Bar on erasure after withdrawal narrows to completed erasureRPP Pasal 94 has four ayat and three already have named counterparts: ayat (1) at PP Pasal 79 ayat (1), ayat (3) at PP Pasal 83, ayat (4) at PP Pasal 79 ayat (2).
Subject rights
no change
Periodic verification becomes mandatory not a controller judgementThe only overlap is the formula bekerja sama dengan Pengendali Data Pribadi. RPP Pasal 147 huruf b sits in the dissolution notification duty and requires a controller being wound up to tell subjects which other parties process data with it.
Controller duties
no change
Disclosure gateway for camera recordings is deletedThe disclosure gateway in RPP Pasal 36 has no counterpart anywhere in the brief, and neither flagged case touches it, because both run the other way and match clauses of PP Pasal 17 to draft articles the finding does not name.
Controller duties
no change
One word left the incident documentation dutyRPP Pasal 125 ayat (1) huruf h did not move to PP Pasal 41. The draft item is a content requirement for breach documentation, the risk of impact from disclosure of personal data on the data subject, while PP Pasal 41 ayat (1) huruf d is a precondition for.
Breach
The evidence case by case
What the scan still flags after all of the above, with both texts and the pairing
drawn out. These are the cases behind every decision on this page.
Shared formulashown as deleted · RPP Pasal 134, 135 against PP Pasal 127, 128
Internal and external audit programme deleted and delegated
RPP Pasal 135 h.
“pembagian tugas pihak yang terlibat dalam pemrosesan data Pengendali Data Pribadi;”
“pembagian kewajiban dan tanggung jawab Pengendali Data Pribadi lama, Pengendali Data Pribadi baru, dan pihak yang terlibat dalam pemrosesan Data Pribadi.”
The two provisions share drafting language and nothing else.
Same shared phrase, different chapters.
Your view
Shared formulashown as deleted · RPP Pasal 134, 135 against PP Pasal 127, 128
Internal and external audit programme deleted and delegated
RPP Pasal 135 i.
“kewajiban pihak yang terlibat dalam pemrosesan data Pengendali Data Pribadi;”
“pembagian kewajiban dan tanggung jawab Pengendali Data Pribadi lama, Pengendali Data Pribadi baru, dan pihak yang terlibat dalam pemrosesan Data Pribadi.”
The two provisions share drafting language and nothing else.
Same shared phrase, different chapters.
Your view
Shared formulashown as deleted · RPP Pasal 134, 135 against PP Pasal 127, 128
Internal and external audit programme deleted and delegated
RPP Pasal 135 j.
“tanggung jawab pihak yang terlibat dalam pemrosesan data Pengendali Data Pribadi;”
“pembagian kewajiban dan tanggung jawab Pengendali Data Pribadi lama, Pengendali Data Pribadi baru, dan pihak yang terlibat dalam pemrosesan Data Pribadi.”
The two provisions share drafting language and nothing else.
Same shared phrase, different chapters.
Your view
Relocationpairing offset · RPP Pasal 33 against PP Pasal 17
Cameras in public places gain a purpose and identification limit
RPP Pasal 33
“Dalam hal pemasangan alat pemroses atau pengolah data visual, Pengendali Data Priba di dan Prosesor Data Pribadi wajib melaksanakan pemrosesan Data Pribadi berdasarkan Peraturan Pemerintah ini.”
“(1) Pengendali Data Pribadi dan/atau Prosesor Data Pribadi sebagaimana dimaksud dalam Pasal 1 7 ayat (2) memastikan perekaman dilakukan secara konsisten dan memastikan Pelindungan Data Pribadi sesuai dengan ketentuan dalam Peraturan Pemerintah ini. (2) Pengendali Data Pribadi dan/atau Prosesor Data Pribadi hanya dapat menempatkan dan menggunakan alat pemroses atau pengolah data visual sebagaimana dimaksud pada ayat (1) untuk memantau area yang dituju sesuai dengan tujuan pemantauan.”
It survives in an article this finding does not name.
RPP Pasal 33 answers to PP Pasal 18 rather than the PP Pasal 17 the finding names. Another off by one.
Your view
Your callshown as new · RPP Pasal 155 against PP Pasal 15, 139
Controller instruction to a processor need no longer be written
“Penunjukan Prosesor Data Pribadi lain oleh Prosesor Data Pribadi diatur dalam perjanjian tertulis dengan memperhatikan tingkat Pelindungan Data Pribadi yang setara sesuai yang disepakati dalam perjanjian antara Pengendali Data Pribadi dan Prosesor Data Pribadi.”
RPP Pasal 22 (4) · match 0.89, wording 0.88
“Penunjukkan Prosesor Data Pribadi lainnya oleh Prosesor Data Pribadi diatur dalam perjanjian tertulis dengan memperhatikan tingkat Pelindungan Data Pribadi yang setara s esuai yang disepakati dalam perjanjian antara Pengendali Data Pribadi dan Prosesor Data Pribadi.”
I could not settle this from the two texts.
No verdict recorded for this case.
Your view
Your callshown as new · RPP Pasal 155 against PP Pasal 15, 139
Controller instruction to a processor need no longer be written
“Pemrosesan Data Pribadi oleh Prosesor Data Pribadi lain merupakan tanggung jawab Pengendali Data Pribadi.”
RPP Pasal 20 (4) · match 1.00, wording 0.76
“Pemrosesan Data Pribadi sebagaimana dimaksud pada ayat (2) merupakan tanggung jawab Pengendali Data Pribadi.”
I could not settle this from the two texts.
No verdict recorded for this case.
Your view
Relocationpairing offset · RPP Pasal 179 against PP Pasal 158
Investigator duty to delete data after use is replaced by a label
RPP Pasal 179
“(1) Dalam rangka pemrosesan Data Pribadi yang diberikan Pengendali Data Pribadi dan/atau Prosesor Data Pribadi untuk kepentingan pemeriksaan dalam perkara tindak pidana sebagaimana dimaksud dalam Pasal 178, penyelidik, penyidik, penuntut umum, atau hakim wajib melakukan pemrosesan Data Pribadi seara spesifik dan proporsional sesuai dengan tujuan permintaan Data Pribadi dengan menjamin hak Subjek Data Pribadi. (2) Penyelidik, p enyidik, penuntut umum, atau hakim dalam melakuk an pemrosesan terhadap Data Pribadi sebagaimana dimaksud pada ayat (1) wajib melindungi dan memastikan keamanan Data Pri”
“(1) Untuk kepentingan penanganan dalam perkara tindak pidana Pelindungan Data Pribadi, Pengendali Data Pribadi dan/atau Prosesor Data Pribadi memberikan Data Pribadi yang diproses atas permintaan Data Pribadi dari penyidik, penuntut umum, atau hakim sebagaimana dimaksud dalam Pasal 155. (2) Pemberian Data Pribadi sebagaimana dimaksud pada ayat (1) dilaksanakan dengan memastikan pelindungan dan keamanan Data Pribadi yang diberikan sesuai dengan ketentuan peraturan perundang-undangan.”
It survives in an article this finding does not name.
RPP Pasal 179 answers to PP Pasal 157, not the PP Pasal 158 the finding names.
Protection audit moves from optional to a mandatory minimum
RPP Pasal 154
“(1) Pengendali Data Pribadi wajib bertanggung jawab atas pemrosesan Data Pribadi dan menunjukkan pertanggungjawabannya dalam pemenuhan kewajiban pelaksanaan prinsip Pelindungan Data Pribadi. (2) Pertanggungjawaban dalam pemenuhan kewajiban pelaksanaan prinsip Pelindungan Data Pribadi sebagaimana dimaksud pada ayat (1) dilakukan dengan paling sedikit: a. mendokumentasikan seluruh kegiatan pemrosesan Data Pribadi, termasuk yang dilakukan oleh Prosesor Data Pribadi; b. merespon permintaan informasi dari Lembaga PDP; dan c. menunjukkan pemenuhan kepatuhan dan bukti dokumentasi seluruh kegiatan pem”
“(1) Prosesor Data Pribadi harus bertanggung jawab atas pemrosesan Data Pribadi dan menunjukkan pertanggungjawaban dalam pemenuhan kewajiban sesuai dengan ketentuan peraturan perundang undangan. (2) Dalam melaksanakan pertanggungjawaban sebagaimana dimaksud pada ayat (1), Prosesor Data Pribadi harus: a. mendokumentasikan seluruh kegiatan pemrosesan Data Pribadi; b. merespons permintaan Informasi dari Lembaga; c. menunjukkan pemenuhan kepatuhan dan bukti dokumentasi seluruh kegiatan pemrosesan Data Pribadi; dan d. melakukan audit.”
The two provisions share drafting language and nothing else.
RPP Pasal 154 is controller accountability, PP Pasal 141 is processor accountability. The two are drafted in parallel, which is what the match is picking up.
Your view
Shared formulashown as new · RPP Pasal 129 against PP Pasal 122
Consultation trigger becomes disjunctive not cumulative
“Ketentuan lebih lanjut mengenai penilaian dampak Pelindungan Data Pribadi diatur dalam Peraturan Lembaga. (1)”
RPP Pasal 184 (4) · match 0.86, wording 0.59
“Ketentuan mengenai tata cara penilaian tingkat Pelindungan Data Pribadi yang dianggap setara atau lebih tinggi sebagaimana dimaksud pada ayat (1) diatur lebih lanjut dalam Peraturan Lembaga PDP.”
The two provisions share drafting language and nothing else.
Two different deferral clauses, one on impact assessment and one on adequacy.
“(1) Pengendali Data Pribadi wajib melakukan pemrosesan Data Pribadi secara terbatas dan spesifik. (2) Pemrosesan Data Pribadi harus dilakukan seminimal mungkin dalam menggunakan Data Pribadi dengan tetap relevan dan memadai untuk mencapai tujuan pemrosesan Data Pribadi.”
“(1) Pengendali Data Pribadi wajib mengakhiri pemrosesan Data Pribadi dalam hal: a. telah mencapai Masa Retensi; b. tujuan pemrosesan Data Pribadi telah tercapai; atau c. terdapat permintaan dari Subjek Data Pribadi. (2) Pengakhiran pemrosesan Data Pribadi sebagaimana dimaksud pada ayat (1) dilakukan sesuai dengan ketentuan peraturan perundang-undangan.”
The two provisions share drafting language and nothing else.
PP Pasal 80 ends processing; the finding is about minimisation.
Processor accountability softened to harus but gains an audit duty
RPP Pasal 163
“Prosesor Data Pribadi wajib bertanggung jawab atas pemrosesan Data Pribadi dan menunjukkan pertanggungiawaban dalam pemenuhan kewajiban sesuai dengan ketentuan peraturan perundang-undangan.”
“(1) Dalam melakukan pemrosesan Data Pribadi, Pengendali Data Pribadi wajib menunjukkan bukti persetujuan yang telah diberikan oleh Subjek Data Pribadi. (2) Kewajiban penunjukkan bukti persetujuan sebagaimana dimaksud pada ayat (1) dilaksanakan dalam rangka akuntabilitas pemrosesan Data Pribadi.”
The two provisions share drafting language and nothing else.
PP Pasal 36 is the consent evidence duty, unrelated to processor accountability.
Your view
Recastshown as deleted · RPP Pasal 101 against PP Pasal 75
Retention definition moves to Pasal 1 and the policy document gains a legal basis item
RPP Pasal 101 (1)
“Masa retensi merupakan periode waktu pemrosesan Data Pribadi yang diperlukan untuk pencapaian tujuan pemrosesan Data Pribadi dan/atau karena kewajiban hukum lainnya.”
“Masa Retensi adalah periode waktu pemrosesan Data Pribadi yang diperlukan untuk pencapaian tujuan pemrosesan Data Pribadi dan/atau karena kewajiban hukum lainnya.”
It survives in changed legal form, so the headline needs rewording.
The retention period definition was not dropped. It moved into the definitions article, PP Pasal 1 angka 23, which is where the enacted text puts defined terms. Adding the whole of Pasal 1 to the panel would drown the slide, so this belongs in the analysis rather than the article list.
Your view
Relocationshown as new · RPP Pasal 182 against PP Pasal 165
“Lembaga pemenuhan sebagaimana ayat (3). berwenang melakukan penilaian persyaratan transfer Data Pribadi dimaksud pada ayat (1), ayat (2), dan”
RPP Pasal 185 (4) · match 0.80, wording 0.57
“Keberadaan dokumen sebagaimana diatur dalam ayat (3) tidak menghapuskan atau mengurangi kewenangan Lembaga PDP untuk melakukan penilaian mengenai pemenuhan persyaratan transfer Data Pribadi.”
It survives in an article this finding does not name.
The authority's power to assess transfer conditions is in both texts. This is the same provision that produced my earlier false claim about PP Pasal 167 having no draft twin, so it is worth naming RPP Pasal 185 in the finding and closing that question on the page.
Your view
Recastshown as deleted · RPP Pasal 144 against PP Pasal 134
Destruction of transferred data moves from the transfer agreement to the notice to subjects
RPP Pasal 144 e.
“Pengendali Data Pribadi lama akan memusnahkan Data Pribadi yang telah dialihkan kepada Pengendali Data Pribadi baru.”
“pernyataan bahwa Pengendali Data Pribadi lama akan memusnahkan Data Pribadi yang telah dialihkan kepada Pengendali Data Pribadi baru, pada saat penggabungan, pemisahan, pengambilalihan, peleburan, atau pembubaran badan hukum berakhir.”
It survives in changed legal form, so the headline needs rewording.
The destruction undertaking is not gone. It sits at PP Pasal 133 huruf g, moved out of the agreement and into the notice to the subject, and recast from a direct undertaking into a statement that the old controller will destroy the data once the corporate action closes. The finding's headline, that the agreement no longer must cover destruction, is true only of the agreement and reads as a deletion. It needs rewording.
Your view
Shared formulashown as deleted · RPP Pasal 192 against PP Pasal 161
Seven transfer duties drop from wajib to harus and move to Part One
RPP Pasal 192 (2)
“Ketentuan mengenai pelaksanaan transfer Data Pribadi sebagaimana dimaksud pada ayat (1) diatur lebih lanjut dalam Peraturan Lembaga PDP.”
“Ketentuan lebih lanjut mengenai pelaksanaan persetujuan untuk transfer Data Pribadi ke luar wilayah hukum Negara Republik Indonesia diatur dalam Peraturan Lembaga.”
The two provisions share drafting language and nothing else.
Both are the deferral formula that ends a section. The draft defers transfer implementation generally, PP Pasal 174 defers the consent route specifically, so they are not the same rule.
Your view
Shared formulashown as deleted · RPP Pasal 188 against PP Pasal 171
“Ketentuan lebih lanjut mengenai pelaksanaan Pelindungan Data Pribadi yang memadai dan bersifat mengikat diatur dalam Peraturan Lembaga. REPUBLIK. INDONESIA”
The two provisions share drafting language and nothing else.
The deferral formula again. Binding corporate rules and binding adequate protection are different objects.
Threatened public interest limb removed from public task basis
RPP Pasal 63
“Pengendali Data Pribadi dapat menggunakan dasar pemrosesan Data Pribadi berupa pelaksanaan tugas dalam rangka kepentingan umum, pelayanan publik, atau pelaksanaan kewenangan Pengendali Data Pribadi sebagaimana dimaksud dalam Pasal 44 ayat (2) huruf e.”
“(1) Pengendali Data Pribadi yang merupakan Badan Publik dapat menggunakan kepentingan yang sah lainnya sebagai dasar pemrosesan Data Pribadi. (2) Penggunaan kepentingan yang sah lainnya sebagai dasar pemrosesan Data Pribadi sebagaimana dimaksud pada ayat (1) hanya untuk tujuan pemrosesan Data Pribadi selain pelaksanaan tugas dalam rangka kepentingan umum, pelayanan publik, atau pelaksanaan kewenangan Badan Publik.”
The two provisions share drafting language and nothing else.
PP Pasal 55 governs legitimate interests for public bodies, a different basis from the public task provision the finding is about. The match runs on shared vocabulary.
Vital interests loses its third condition and widens to any party
RPP Pasal 60
“Pengendali Data Pribadi dapat menggunakan dasar pemrosesan Data Pribadi berupa pemenuhan pelindungan kepentingan vital Subjek Data Pribadi sebagaimana dimaksud dalam Pasal 44 ayat (2) huruf d.”
“Ketentuan lebih lanjut mengenai pemenuhan pelindungan kepentingan vital Subjek Data Pribadi sebagai dasar pemrosesan Data Pribadi diatur dengan Peraturan Lembaga.”
The two provisions share drafting language and nothing else.
PP Pasal 48 is the deferral clause attached to vital interests, not the basis itself.
Public task notice moves to the start of processing
RPP Pasal 66
“(1) Pengendali Data Pribadi wajib menyampaikan informasi sesuai dengan ketentuan Peraturan Pemerintah ini kepada Subjek Data Pribadi bahwa telah dilakukan pemrosesan Data Pribadi dengan dasar pemrosesan pelaksanaan tugas dalam rangka kepentingan umum atau pelayanan publik. (2) Penyampaian informasi dilakukan dalam waktu seketika setelah pemrosesan berlangsung, kecuali penyampaian informasi berpotensi mengganggu pelindungan kepentingan publik yang dilakukan melalui pemrosesan Data Pribadi Subjek Data Pribadi tersebut. (3) Dalam hal penyampaian informasi berpotensi mengganggu pelindungan kepenti”
“(1) Pengendali Data Pribadi yang merupakan Badan Publik dapat menggunakan kepentingan yang sah lainnya sebagai dasar pemrosesan Data Pribadi. (2) Penggunaan kepentingan yang sah lainnya sebagai dasar pemrosesan Data Pribadi sebagaimana dimaksud pada ayat (1) hanya untuk tujuan pemrosesan Data Pribadi selain pelaksanaan tugas dalam rangka kepentingan umum, pelayanan publik, atau pelaksanaan kewenangan Badan Publik.”
The two provisions share drafting language and nothing else.
Same shared vocabulary as the public task case above.
Your view
Your callshown as deleted · RPP Pasal 200, 204, 219 against PP Pasal 177, 181, 192
Supervision orders now carry a set deadline and action plan
RPP Pasal 200 c.
“menjatuhkan sanksi administratif atas pelanggaran Pelindungan Data Pribadi yang dilakukan Pengendali Data Pribadi dan/atau Prosesor Data Pribadi;”
“Lembaga berwenang menjatuhkan sanksi administratif kepada Pengendali Data Pribadi dan/atau Prosesor Data Pribadi atas pelanggaran administratif berdasarkan ketentuan peraturan perundang-undangan di bidang Pelindungan Data Pribadi.”
I could not settle this from the two texts.
No verdict recorded for this case.
Your view
Your callshown as deleted · RPP Pasal 200, 204, 219 against PP Pasal 177, 181, 192
Supervision orders now carry a set deadline and action plan
RPP Pasal 200 o.
“meminta bantuan hukum kepada kejaksaan dalam penyelesaian sengketa Pelindungan Data Pribadi.”
“Lembaga dapat meminta bantuan hukum kepada kejaksaan dalam penyelesaian Sengketa.”
I could not settle this from the two texts.
No verdict recorded for this case.
Your view
Shared formulashown as deleted · RPP Pasal 10, 11, 12, 13, 14, 15 against PP Pasal 8, 70
Lifecycle duties dropped from the processing chapter, correction duty recast as a right
RPP Pasal 14 b.
“mematuhi kriteria transfer Data Pribadi ke luar wilayah hukum Negara Republik Indonesia sebagaimana diatur dalam ketentuan peraturan perundang-undangan;”
“Ketentuan lebih lanjut mengenai pelaksanaan persetujuan untuk transfer Data Pribadi ke luar wilayah hukum Negara Republik Indonesia diatur dalam Peraturan Lembaga.”
The two provisions share drafting language and nothing else.
The draft item is a compliance duty, PP Pasal 174 is a deferral clause.
Your view
Your callshown as new · RPP Pasal 10, 11, 12, 13, 14, 15 against PP Pasal 8, 70
Lifecycle duties dropped from the processing chapter, correction duty recast as a right
“Subjek Data Pribadi berhak melengkapi, memperbarui, dan/atau memperbaiki kesalahan dan/atau ketidakakuratan Data Pribadi tentang dirinya sesuai dengan tujuan pemrosesan Data Pribadi.”
RPP Pasal 28 f. · match 0.89, wording 0.56
“memfasilitasi hak Subjek Data Pribadi dalam melengkapi, memperbarui, dan/atau memperbaiki kesalahan dan/atau ketidakakuratan Data Pribadi tentang dirinya sesuai dengan tujuan pemrosesan Data Pribadi dan sesuai dengan ketentuan peraturan perundang-undangan;”
I could not settle this from the two texts.
No verdict recorded for this case.
Your view
Recastshown as deleted · RPP Pasal 16 against PP Pasal 10
The rule making a data requester a controller is deleted
RPP Pasal 16 (2)
“Subjek Data Pribadi sebagaimana dimaksud pada ayat (1) huruf a merupakan orang perseorangan yang pada dirinya melekat Data Pribadi.”
“Subjek Data Pribadi adalah orang perseorangan yang pada dirinya melekat Data Pribadi.”
It survives in changed legal form, so the headline needs rewording.
The definition of the data subject moved into PP Pasal 1 angka 6 with the other defined terms. The finding is about the requester rule, which is a different limb, so the headline stands; the definition should be noted, not added to the panel.
Your view
Your callshown as new · RPP Pasal 4 against PP Pasal 4
Scope list drops authority powers and adds supervision
“transfer Data Pribadi ke luar wilayah hukum Negara Republik Indonesia;”
RPP Pasal 14 b. · match 1.00, wording 0.63
“mematuhi kriteria transfer Data Pribadi ke luar wilayah hukum Negara Republik Indonesia sebagaimana diatur dalam ketentuan peraturan perundang-undangan;”
I could not settle this from the two texts.
Both mention transfer out of Indonesian jurisdiction, one as a scope item and one as a compliance duty. Whether the scope list genuinely absorbed the duty is a reading I would rather you made.
Mandatory refusal of correction becomes a discretion without grounds
RPP Pasal 84
“Pengendali Data Pribadi wajib memperbarui dan/atau memperbaiki kesalahan dan/atau ketidakakuratan Data Pribadi paling lambat 3 x 24 (tiga kali dua puluh empat) jam terhitung sejak Pengendali Data Pribadi menerima permintaan pembaruan dan/atau perbaikan Data Pribadi.”
“(1) Pengendali Data Pribadi wajib menghentikan pemrosesan Data Pribadi dalam hal Subjek Data Pribadi menarik kembali persetujuan pemrosesan Data Pribadi. (2) Penghentian pemrosesan Data Pribadi sebagaimana dimaksud pada ayat (1) dilakukan paling lambat 3 x 24 (tiga kali dua puluh empat) jam terhitung sejak Pengendali Data Pribadi menerima permintaan penarikan kembali persetujuan pemrosesan Data Pribadi. (3) Pengendali Data Pribadi melakukan penghentian pemrosesan Data Pribadi setelah permintaan sebagaimana dimaksud pada ayat (2) terverifikasi. (4) Pengendali Data Pribadi harus memberitahukan p”
The two provisions share drafting language and nothing else.
The whole-article test is matching on the shared 3 x 24 jam deadline formula. PP Pasal 92 is the withdrawal of consent clock, not the correction clock.
Mandatory refusal of correction becomes a discretion without grounds
RPP Pasal 89
“(1) Pengendali Data Pribadi wajib memberikan akses kepada Subjek Data Pribadi dalam jangka waktu paling lambat 3 x 24 (tiga kali dua puluh empat) jam terhitung sejak Pengendali Data Pribadi menerima permintaan akses dari Subjek Data Pribadi. (2) Pemberian akses sebagaimana dimaksud pada ayat (1) sekurang-kurangnya meliputi: a. akses terhadap Data Pribadi yang diproses beserta rekam jejak pemrosesan Data Pribadi sesuai dengan jangka waktu penyimpanan Data Pribadi; dan b. informasi yang diberikan oleh Pengendali Data Pribadi terkait konfirmasi permintaan akses.”
“(1) Pengendali Data Pribadi wajib menghentikan pemrosesan Data Pribadi dalam hal Subjek Data Pribadi menarik kembali persetujuan pemrosesan Data Pribadi. (2) Penghentian pemrosesan Data Pribadi sebagaimana dimaksud pada ayat (1) dilakukan paling lambat 3 x 24 (tiga kali dua puluh empat) jam terhitung sejak Pengendali Data Pribadi menerima permintaan penarikan kembali persetujuan pemrosesan Data Pribadi. (3) Pengendali Data Pribadi melakukan penghentian pemrosesan Data Pribadi setelah permintaan sebagaimana dimaksud pada ayat (2) terverifikasi. (4) Pengendali Data Pribadi harus memberitahukan p”
The two provisions share drafting language and nothing else.
Rectification refusal moves from three grounds to discretion
RPP Pasal 84
“Pengendali Data Pribadi wajib memperbarui dan/atau memperbaiki kesalahan dan/atau ketidakakuratan Data Pribadi paling lambat 3 x 24 (tiga kali dua puluh empat) jam terhitung sejak Pengendali Data Pribadi menerima permintaan pembaruan dan/atau perbaikan Data Pribadi.”
“(1) Pengendali Data Pribadi wajib menghentikan pemrosesan Data Pribadi dalam hal Subjek Data Pribadi menarik kembali persetujuan pemrosesan Data Pribadi. (2) Penghentian pemrosesan Data Pribadi sebagaimana dimaksud pada ayat (1) dilakukan paling lambat 3 x 24 (tiga kali dua puluh empat) jam terhitung sejak Pengendali Data Pribadi menerima permintaan penarikan kembali persetujuan pemrosesan Data Pribadi. (3) Pengendali Data Pribadi melakukan penghentian pemrosesan Data Pribadi setelah permintaan sebagaimana dimaksud pada ayat (2) terverifikasi. (4) Pengendali Data Pribadi harus memberitahukan p”
The two provisions share drafting language and nothing else.
Rectification refusal moves from three grounds to discretion
RPP Pasal 89
“(1) Pengendali Data Pribadi wajib memberikan akses kepada Subjek Data Pribadi dalam jangka waktu paling lambat 3 x 24 (tiga kali dua puluh empat) jam terhitung sejak Pengendali Data Pribadi menerima permintaan akses dari Subjek Data Pribadi. (2) Pemberian akses sebagaimana dimaksud pada ayat (1) sekurang-kurangnya meliputi: a. akses terhadap Data Pribadi yang diproses beserta rekam jejak pemrosesan Data Pribadi sesuai dengan jangka waktu penyimpanan Data Pribadi; dan b. informasi yang diberikan oleh Pengendali Data Pribadi terkait konfirmasi permintaan akses.”
“(1) Pengendali Data Pribadi wajib menghentikan pemrosesan Data Pribadi dalam hal Subjek Data Pribadi menarik kembali persetujuan pemrosesan Data Pribadi. (2) Penghentian pemrosesan Data Pribadi sebagaimana dimaksud pada ayat (1) dilakukan paling lambat 3 x 24 (tiga kali dua puluh empat) jam terhitung sejak Pengendali Data Pribadi menerima permintaan penarikan kembali persetujuan pemrosesan Data Pribadi. (3) Pengendali Data Pribadi melakukan penghentian pemrosesan Data Pribadi setelah permintaan sebagaimana dimaksud pada ayat (2) terverifikasi. (4) Pengendali Data Pribadi harus memberitahukan p”
The two provisions share drafting language and nothing else.
The same 3 x 24 jam formula.
Your view
Your callshown as new · RPP Pasal 119, 120 against PP Pasal 108
Refused compensation goes to court not to the authority
“Pengendali Data Pribadi melakukan penilaian terhadap pengajuan permintaan ganti rugi sebagaimana dimaksud dalam Pasal 106.”
RPP Pasal 118 (1) · match 0.80, wording 0.69
“Pengendali Data Pribadi wajib menyia pkan media komunikasi pengajuan permintaan ganti rugi oleh Subjek Data Pribadi.”
I could not settle this from the two texts.
PP Pasal 108 assesses the compensation request; RPP Pasal 118 sets up the channel for making one. Related but not obviously the same provision, and the finding is about where a refused claim goes next. Your call whether RPP Pasal 118 belongs in the panel.
Your view
Your callshown as new · RPP Pasal 119, 120 against PP Pasal 108
Refused compensation goes to court not to the authority
“jawaban Pengendali Data Pribadi sebagaimana dimaksud pada ayat (2) menolak permintaan ganti rugi; atau”
RPP Pasal 118 c. · match 0.80, wording 0.49
“pernyataan bahwa jika Subjek Data Pribadi meminta ganti rugi di luar yang dapat dimintakan kepada Pengendali Data Pribadi, maka Pengendali Data Pribadi berhak menolak permintaan ganti rugi;”
I could not settle this from the two texts.
PP Pasal 108 assesses the compensation request; RPP Pasal 118 sets up the channel for making one. Related but not obviously the same provision, and the finding is about where a refused claim goes next. Your call whether RPP Pasal 118 belongs in the panel.
Correction right loses its facility and gains a purpose qualifier
RPP Pasal 84
“Pengendali Data Pribadi wajib memperbarui dan/atau memperbaiki kesalahan dan/atau ketidakakuratan Data Pribadi paling lambat 3 x 24 (tiga kali dua puluh empat) jam terhitung sejak Pengendali Data Pribadi menerima permintaan pembaruan dan/atau perbaikan Data Pribadi.”
“(1) Pengendali Data Pribadi wajib menghentikan pemrosesan Data Pribadi dalam hal Subjek Data Pribadi menarik kembali persetujuan pemrosesan Data Pribadi. (2) Penghentian pemrosesan Data Pribadi sebagaimana dimaksud pada ayat (1) dilakukan paling lambat 3 x 24 (tiga kali dua puluh empat) jam terhitung sejak Pengendali Data Pribadi menerima permintaan penarikan kembali persetujuan pemrosesan Data Pribadi. (3) Pengendali Data Pribadi melakukan penghentian pemrosesan Data Pribadi setelah permintaan sebagaimana dimaksud pada ayat (2) terverifikasi. (4) Pengendali Data Pribadi harus memberitahukan p”
The two provisions share drafting language and nothing else.
Correction right loses its facility and gains a purpose qualifier
RPP Pasal 89
“(1) Pengendali Data Pribadi wajib memberikan akses kepada Subjek Data Pribadi dalam jangka waktu paling lambat 3 x 24 (tiga kali dua puluh empat) jam terhitung sejak Pengendali Data Pribadi menerima permintaan akses dari Subjek Data Pribadi. (2) Pemberian akses sebagaimana dimaksud pada ayat (1) sekurang-kurangnya meliputi: a. akses terhadap Data Pribadi yang diproses beserta rekam jejak pemrosesan Data Pribadi sesuai dengan jangka waktu penyimpanan Data Pribadi; dan b. informasi yang diberikan oleh Pengendali Data Pribadi terkait konfirmasi permintaan akses.”
“(1) Pengendali Data Pribadi wajib menghentikan pemrosesan Data Pribadi dalam hal Subjek Data Pribadi menarik kembali persetujuan pemrosesan Data Pribadi. (2) Penghentian pemrosesan Data Pribadi sebagaimana dimaksud pada ayat (1) dilakukan paling lambat 3 x 24 (tiga kali dua puluh empat) jam terhitung sejak Pengendali Data Pribadi menerima permintaan penarikan kembali persetujuan pemrosesan Data Pribadi. (3) Pengendali Data Pribadi melakukan penghentian pemrosesan Data Pribadi setelah permintaan sebagaimana dimaksud pada ayat (2) terverifikasi. (4) Pengendali Data Pribadi harus memberitahukan p”
The two provisions share drafting language and nothing else.
Duty to run an electronic channel becomes a rule on the subject
RPP Pasal 38
“(1) Pengendali Data Pribadi harus menyediakan kanal permohonan pelaksanaan hak kepada Subjek Data Pribadi, baik secara elektronik dan/atau nonelektronik. (2) Pengendali Data Pribadi yang memproses Data Pribadi secara elektronik harus menyediakan kanal permohonan pelaksanaan hak secara elektronik.”
“Pelaksanaan hak Subjek Data Pribadi diajukan melalui permohonan tercatat yang disampaikan secara elektronik atau nonelektronik kepada Pengendali Data Pribadi sesuai dengan ketentuan peraturan perundang-undangan.”
It survives in an article this finding does not name.
RPP Pasal 38 answers to PP Pasal 20, one article before the PP Pasal 21 the finding names. This is the offset you described.