Processing and consent

What the GDPR provides. GDPR Article 4(2) defines processing as any operation performed on personal data and gives an open list, running from collection and storage through disclosure to erasure, so nothing turns on whether a given activity is named. Article 5(1) binds all processing to six principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; and integrity and confidentiality.

Article 5(2) adds accountability, making the controller responsible for compliance and able to demonstrate it. Lawful bases are not in Article 5 at all; they are the closed list in Article 6.

The eight principles in UU Pasal 16 ayat (2) reach much of GDPR Article 5 by a different arrangement. Limits, specificity, lawfulness and transparency are folded into huruf a, and retention and erasure into huruf g. Two of the eight have no GDPR principle behind them: guaranteeing the subject's rights at huruf c, and notifying purpose, activities and breach at huruf f.

The GDPR carries both as duties, in GDPR Article 13, GDPR Article 14, GDPR Article 33 and GDPR Article 34, rather than as principles binding every act of processing. The item that is not there is fairness. In EU practice fairness is the hook that catches processing which is lawful and transparent yet still exploits an imbalance or a designed-in nudge, and EDPB Guidelines 03/2022 are built on it.

Huruf c and huruf h are the nearest equivalents in the statute, but both point at compliance with rules stated elsewhere rather than at the quality of a design that complies, so the statute has no open standard of the GDPR Article 5(1)(a) kind for a regulator to reach for.

The regulation comes closest: PP Pasal 60 ayat (2) requires transparent processing to be carried out honestly and in good faith, and its elucidation, open-ended with antara lain, reaches deceit and misleading information and the fulfilment of rights and duties. Ayat (1) also differs in kind from GDPR Article 4(2).

The GDPR list is open on its face because it reads such as, while ayat (1) enumerates six activities and PP Pasal 8 repeats the same six, so on the more natural reading the burden of arguing that an unnamed activity is processing falls the opposite way in Jakarta, even if letter b is wide enough to absorb most of it.

The lawful bases that the tracker's existing note assigns here are real but misfiled: they sit at UU Pasal 20, not at Pasal 16.

What the GDPR provides. The GDPR has no article on cameras or other visual capture devices. Video surveillance is reached through the general apparatus: a lawful basis under GDPR Article 6, in practice legitimate interests under GDPR Article 6(1)(f), the purpose limitation and minimisation principles at GDPR Article 5(1)(b) and (c), and notice at the point of collection under GDPR Article 13.

Where footage is processed to identify a person by biometric means it becomes a special category under GDPR Article 9(1) and needs a condition under GDPR Article 9(2). Systematic monitoring of a publicly accessible area on a large scale triggers an impact assessment under GDPR Article 35(3)(c).

Indonesia legislates the device, the GDPR legislates the processing. UU Pasal 17 ayat (1) huruf a fixes a closed purpose list before any balancing happens, while GDPR Article 6(1)(f) sets no purpose list and leaves the answer to the three limb test the Court applied under the predecessor Article 7(f) in C-13/16 and restated for the common areas of a residential building in C-708/18.

The signage duty at UU Pasal 17 ayat (1) huruf b is a statutory rule with its own addressee, and PP Pasal 19 fixes its minimum content and its placement; in the EU the same outcome is assembled from GDPR Article 13 plus the layered notice method in EDPB Guidelines 3/2019, which binds only through GDPR Article 13.

Huruf c is the sharpest departure, because a flat ban on using the device to identify a person meets a GDPR that conditions biometric identification under GDPR Article 9(2) rather than forbidding it. The EU route tests scope and basis case by case instead of switching a function off, as C-212/13 shows for whether the rules reach a camera that also films public space.

The failure modes therefore differ: an operator outside the huruf a purpose list is in breach whatever the balance of interests, while an EU operator with an accepted purpose can still be in breach of GDPR Article 35 for never having run an assessment, where the monitoring is systematic, on a large scale and of a publicly accessible area.

UU Pasal 17 ayat (2) is where the comparison stops working, since in the EU law enforcement video is not an exception inside the GDPR at all: GDPR Article 2(2)(d) puts it outside the Regulation and into Directive 2016/680, so the Indonesian carve-out stays inside one regulator's remit where the EU one does not.

What the GDPR provides. GDPR Article 26(1) makes two or more controllers joint controllers where they jointly determine the purposes and means of processing, and requires them to fix their respective compliance responsibilities in a transparent arrangement, in particular for data subject rights and the information duties at GDPR Article 13 and Article 14. That arrangement may designate a contact point for data subjects.

GDPR Article 26(2) requires the essence of the arrangement to be made available to the data subject. GDPR Article 26(3) lets the data subject exercise rights against each controller whatever the arrangement says between them.

The three limbs of UU Pasal 18 ayat (2) carry the components of GDPR Article 26(1) in reversed order: huruf a is the arrangement on roles and responsibilities, huruf b is the joint element, and huruf c is the contact point sentence. The match at huruf b is not exact.

Huruf b pairs tujuan yang saling berkaitan with cara pemrosesan Data Pribadi yang ditentukan secara bersama, so joint determination attaches to the means limb while the purposes limb asks only that the purposes be interrelated. GDPR Article 26(1) requires joint determination of both.

The reversal matters, because GDPR Article 26(1) opens with joint determination as the fact that creates the status and treats the arrangement as the duty that follows, where UU Pasal 18 ayat (2) puts the agreement first among the syarat minimal, and PP Pasal 11 ayat (3) then prescribes what that agreement must contain.

Two smaller things change as well: the contact point is permissive in GDPR Article 26(1) and mandatory in huruf c, and GDPR Article 26(2), the duty to make the essence of the arrangement available to the subject, has no counterpart in the statute, although PP Pasal 63 supplies one by requiring joint controllers to tell the subject which controllers are involved, how their purposes interrelate, how processing is carried out and who the joint contact point is.

GDPR Article 26(3) has no counterpart at either level, so nothing tells a subject that the parties' allocation cannot be raised against a claim brought against one of them. UU Pasal 18 ayat (1) then says processing dapat dilakukan by two or more controllers, which reads as a status the parties elect and constitute by agreement.

In EU law it is a factual status found on conduct: C-210/16, C-25/17 and C-40/17 applied it under Directive 95/46 Article 2(d) to parties who had no arrangement and resisted the label, and C-683/21 ruled under GDPR Article 4(7) and Article 26(1) that classification as joint controllers requires neither an arrangement on purposes and means nor an arrangement on the terms of joint control.

So a missing agreement is a breach of GDPR Article 26(1) by parties who are already joint controllers, never a reason they are not.

What the GDPR provides. GDPR Article 4(7) defines a controller functionally, as the natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of processing. GDPR Article 4(8) defines a processor as the body that processes on behalf of the controller.

The same definition lets Union or Member State law name the controller, or the criteria for naming it, where that law sets the purposes and means. International organisations sit in a separate definition at GDPR Article 4(26) and appear in the Regulation mainly as transfer recipients under Chapter V.

Both texts reach much the same set of addressees by different routes. GDPR Article 4(7) gets there inside a definition, listing entity types and then attaching the test of who determines purposes and means, so the entity list never does work on its own.

UU Pasal 19 is a standalone operative article that lists three categories and leaves the functional test to UU Pasal 1 angka 4 and angka 5, which is why the article read alone invites the reading that the role follows the entity type, a reading C-210/16, C-40/17 and C-683/21 foreclose in the EU. The material difference is the addressee.

UU Pasal 19 huruf c makes an Organisasi Internasional a controller or processor bearing the duties of the statute, while the GDPR never names one as an addressee and uses GDPR Article 4(26) to define it as a transfer destination under Chapter V, though the words other body in GDPR Article 4(7) are open enough to catch one that determines purposes and means.

Naming Badan Publik also does work the GDPR cannot do in one instrument, since GDPR Article 2(2) puts activities outside Union law and law enforcement processing outside the Regulation and sends the latter to Directive 2016/680, so the EU splits public bodies across two regimes where Indonesia keeps them in one.

What the GDPR provides. GDPR Article 6(1) makes processing lawful only where one of six bases applies: consent, necessity for a contract or for pre-contractual steps, a legal obligation, vital interests, a task in the public interest or official authority, and legitimate interests. The second subparagraph of GDPR Article 6(1) bars public authorities from relying on legitimate interests in the performance of their tasks.

GDPR Article 6(3) requires the legal obligation and public task bases to rest on Union or Member State law. GDPR Article 6(4) adds a compatibility test where data collected for one purpose are used for another, except where the further use rests on consent or on a Union or Member State measure.

UU Pasal 20 ayat (2) huruf a to f is the six limb list of GDPR Article 6(1)(a) to (f) in the same order, and the transposition shows in the detail.

Huruf b carries both contract performance and pre-contractual steps taken at the data subject's request, huruf c and huruf e carry the peraturan perundang-undangan anchor that answers GDPR Article 6(3), and huruf f writes the balancing factors into the statute where GDPR Article 6(1)(f) states the balance as an override clause.

Huruf d protects the vital interests of the Subjek Data Pribadi only, while GDPR Article 6(1)(d) also covers another natural person, which in the EU is what makes the basis usable in an emergency involving a third party. PP Pasal 46 supplies that case by regulation and goes further, to threats to property, but only where the subject's consent is hard to obtain.

Huruf a sets valid explicit consent as the general standard, where the GDPR asks only for an unambiguous indication under GDPR Article 4(11) and reserves explicit consent to GDPR Article 9(2)(a), GDPR Article 22(2)(c) and GDPR Article 49(1)(a), so Indonesia applies at the front door a test the GDPR keeps for sensitive data, profiling and transfers.

Nothing corresponds to the second subparagraph of GDPR Article 6(1), so the restraint on public bodies had to be built in the PP rather than read off the statute.

That is a difference of instrument more than of outcome, because the EU bar reaches only processing in the performance of their tasks, so a public body acting outside its tasks may still rely on GDPR Article 6(1)(f) subject to the balance that C-13/16 and C-621/22 govern, which is close to where PP Pasal 55 lands.

What the GDPR provides. GDPR Article 13 makes the controller give the data subject a fixed set of information when personal data are collected from them, whatever the lawful basis.

The list covers the identity and contact details of the controller and the data protection officer, the purposes and the legal basis, any legitimate interests relied on, the recipients, transfers outside the EU, the retention period, the data subject rights including withdrawal of consent and complaint to a supervisory authority, whether providing the data is statutory or contractual, and the existence of automated decision making.

GDPR Article 14 imposes the same duty where the data came from someone else, with a time limit and narrow exemptions. GDPR Article 12(1) governs delivery: concise, transparent, intelligible, easily accessible, in clear and plain language.

The trigger differs on the face of both texts. UU Pasal 21 ayat (1) switches on only where processing rests on consent under UU Pasal 20 ayat (2) huruf a, so a controller relying on contract or legal obligation owes nothing under this article.

GDPR Article 13 is switched on by collection and is indifferent to the basis, and C-201/14 caught a transfer between two public bodies acting on statutory duties rather than on consent, on the collecting side under the analogue of GDPR Article 13 and on the receiving side under the analogue of GDPR Article 14.

The lists then diverge on placement as much as on content: controller identity and the withdrawal right are not absent from Indonesian law but sit elsewhere, as rights at UU Pasal 5 and UU Pasal 9, while recipients, cross-border transfers and the route to a complaint have no counterpart in the notice content at all.

UU Pasal 21 ayat (2) runs the other way and is stricter, requiring notice before any change to that information, where GDPR Article 13(3) requires prior information only for further processing for a new purpose. What follows from a failure to inform is closer than it looks.

In Indonesia the stated consequence is administrative sanction under UU Pasal 57 ayat (1), which lists Pasal 21, and no provision says the consent falls with it. In the EU the failure is a discrete GDPR Article 13 breach that leaves processing on GDPR Article 6(1)(b) or (c) intact, but where the basis is consent the informed limb of GDPR Article 4(11) is engaged and the consent itself is exposed.

Indonesia has the same exposure through the sadar limb of PP Pasal 32 ayat (2), so neither side treats an uninformed consent as sound.

What the GDPR provides. GDPR Article 4(11) defines consent as a freely given, specific, informed and unambiguous indication of the data subject's wishes, made by a statement or a clear affirmative action. GDPR Article 7(2) deals with consent buried in a wider written declaration: the request must be clearly distinguishable from the other matters, in an intelligible and easily accessible form, in clear and plain language, and any part of the declaration that infringes the Regulation is not binding.

GDPR Article 7(3) gives an unconditional right to withdraw at any time, as easily as consent was given, with notice of that right before consent is taken. GDPR Article 7(4) requires utmost account to be taken of whether a contract has been made conditional on consent to processing that is not necessary for it.

UU Pasal 22 ayat (4) is GDPR Article 7(2) transposed limb by limb: huruf a is clearly distinguishable from the other matters, huruf b is an intelligible and easily accessible form, huruf c is clear and plain language.

What sits around it is not from the GDPR, since ayat (1) to (3) impose a form requirement, written or recorded, with electronic and non-electronic given equal force, where the GDPR is form neutral and C-673/17 and C-61/19 turned not on form but on whether the act was affirmative and specific.

The remedy also parts company, because UU Pasal 22 ayat (5) voids the consent as a whole where GDPR Article 7(2) makes only the infringing part of the declaration non-binding, so the Indonesian sanction is heavier but blunter and takes the lawful basis down with it. The two conditions that do the most work in the EU sit outside this article rather than outside the statute.

Withdrawal is a standalone right at UU Pasal 9, and the pre-consent notice that GDPR Article 7(3) folds into the consent test is supplied by UU Pasal 21 ayat (1) huruf g read with PP Pasal 33 ayat (2), which requires the information before consent is obtained.

PP Pasal 37 then requires the controller to ensure withdrawal at any time through a mechanism it provides, alongside the consent mechanism at PP Pasal 34. What Indonesia does not state is the equivalence test, that withdrawal must be as easy as giving consent.

The conditionality rule at GDPR Article 7(4) arrives at PP Pasal 35 ayat (1), which keeps goods and services available and undiminished where consent is refused unless the service itself requires the processing, and C-252/21 shows the weight the EU rule carries, where a dominant platform's position is an important factor in whether consent was freely given rather than a bar to valid consent.

What the GDPR provides. The GDPR has no rule voiding contract terms. The nearest thing is the second sentence of GDPR Article 7(2), under which any part of a written declaration that infringes the Regulation is not binding, which bites on the consent language rather than on the contract.

GDPR Article 7(4) then requires account to be taken of whether performance of a contract has been made conditional on consent to processing that is not necessary for that contract. GDPR Article 6(1)(b) supplies the separate answer that processing genuinely necessary to perform a contract needs no consent at all.

Both provisions reach consent folded into a contract, but UU Pasal 23 is the wider of the two, because it voids any clause containing a request for processing that does not carry valid explicit consent, whether or not the consent was buried. UU Pasal 23 voids the clause itself, batal demi hukum, so the sanction lands in contract law and the term is treated as never having existed.

GDPR Article 7(2) renders only the offending part of the declaration non-binding and leaves the fate of the contract to national civil law, which is why the EU judgments strike at the consent and not the agreement: C-61/19 dealt with a contract clause ticked by the controller before signature and a separate form the customer had to sign in order to refuse copying of identity documents, and C-252/21 with terms of service that folded consent into acceptance.

PP 33/2026 does not repeat the nullity, and reaches contract terms by two narrower routes instead, PP Pasal 44 on clauses shifting responsibility to the data subject and PP Pasal 65 on exoneration clauses in the privacy notice. The premise is where the two regimes part.

UU Pasal 23 assumes a contract term requesting processing needs explicit consent to be valid, while GDPR Article 6(1)(b) and EDPB Guidelines 2/2019 hold the opposite, that where processing is objectively necessary to perform the contract asking for consent is itself the error, because consent that cannot be refused without losing the contract is not freely given.

Read literally, UU Pasal 23 therefore pushes against UU Pasal 20 ayat (2) huruf b, a collision the GDPR avoids by keeping the two bases apart, with the further rule that a controller cannot move from consent to another basis supplied by EDPB Guidelines 05/2020 paragraph 123 rather than by the Regulation.

What the GDPR provides. GDPR Article 7(1) provides that where processing is based on consent, the controller must be able to demonstrate that the data subject has consented. It allocates the burden of proof rather than prescribing any record. GDPR Article 5(2) carries the same idea across every principle as accountability, so the controller must be able to show compliance generally and not only on consent. Neither provision fixes a form, a retention period or an evidential standard.

The mechanism comes from GDPR Article 7(1): consent is something the controller must prove, not something the data subject must disprove. Two things change on the way across. GDPR Article 7(1) is conditional, opening with where processing is based on consent, while UU Pasal 24 opens with dalam melakukan pemrosesan Data Pribadi and drops the condition.

The implementing text closes that gap, because PP Pasal 36 ayat (1) repeats the duty word for word inside the explicit consent paragraph and ayat (2) says it is discharged in the interest of accountability, so the duty reads as a consent duty rather than one owed under every basis in UU Pasal 20 ayat (2).

And GDPR Article 7(1) asks the controller to be able to demonstrate, a standing capability tested if challenged, where wajib menunjukkan bukti reads as a duty to produce. The content of the GDPR duty has been built by the Court rather than the text: C-61/19 held a controller cannot discharge it with a pre-completed contractual clause, and C-673/17 that a pre-ticked box leaves nothing to verify because there was no act to record.

The wider accountability hook is not missing on the Indonesian side, because UU Pasal 16 ayat (2) huruf h already requires processing to be bertanggung jawab dan dapat dibuktikan secara jelas. The difference is reach rather than price: GDPR Article 5(2) runs across every principle and every basis, which is what lets a supervisory authority put the burden on the controller in the far larger set of cases where consent is not the basis at all.

What the GDPR provides. GDPR Article 8 governs one narrow case: consent as the lawful basis for offering an information society service directly to a child. Consent is valid on its own from age 16, and a member state may set a lower floor down to 13.

Below the applicable age the controller needs consent given or authorised by the holder of parental responsibility, and must make reasonable efforts to verify that this happened, taking account of available technology. Article 8(3) leaves national contract law on a child's capacity untouched.

The two provisions meet only at the edges. GDPR Article 8 is a condition on consent, so a controller relying on Article 6(1)(b) contract or Article 6(1)(f) legitimate interests never reaches it, and children are then protected through the balancing test and Recital 38 rather than through a parental gate.

UU Pasal 25 attaches to the processing itself and not to a lawful basis, so on its face the parental consent duty survives whichever basis in Pasal 20 the controller picks, although PP Pasal 38 sits inside the explicit consent paragraph of the regulation, which is an argument the other way. The verification limb does not diverge.

PP Pasal 38 ayat (4) requires the controller to verify the parental consent dengan mempertimbangkan teknologi yang tersedia, which is the GDPR Article 8(2) formula. What Indonesia adds sits upstream of it: PP Pasal 38 ayat (1) makes the controller take steps to identify the child, qualified by disesuaikan dengan tujuan pemrosesan, where the GDPR leaves age assurance to be inferred from Article 8(2).

The sharper divergence is the age line. GDPR Article 8(1) fixes 16 with a member state floor of 13, while neither UU Pasal 25 nor PP Pasal 38 states an age and both defer to other legislation, so the Indonesian gate has no threshold on the face of the instrument and no equivalent of Article 8(3), which preserves national contract law on a child's capacity. Enforcement sits at UU Pasal 57 ayat (1), which lists UU Pasal 25 ayat (2).

What the GDPR provides. The GDPR names no class of data subject with a disability and lays down no rule for that class. Its nearest duties are general: GDPR Article 12(1) requires information and communications to the data subject to be concise, transparent, intelligible and easily accessible in clear and plain language, and lets the information be given orally at the subject's request where identity is proven by other means.

GDPR Article 7(2) requires that, where consent sits inside a written declaration covering other matters, the request be clearly distinguishable, intelligible and easily accessible. Capacity to consent, and who may act for an adult who lacks it, is left to member state civil law, since GDPR Article 8 reaches only children.

GDPR Article 12(1) and UU Pasal 26 ayat (2) address the same problem from opposite ends. The EU duty is owed to every data subject, and the Regulation raises protection by category of data rather than by class of subject, so much of what UU Pasal 26 covers reaches the GDPR through Article 9(1) as data concerning health, in principle prohibited unless a condition in Article 9(2) applies.

Accessibility for a disabled user is then reached by applying the general Article 12(1) standard, and a failure is a transparency infringement. UU Pasal 26 names the class and puts the communication method upstream of the consent in ayat (3), so a method that did not reach the subject is a defect in the consent itself and not only in the notice.

That decides who has to prove what: an EU controller defends its notice as intelligible in general, while an Indonesian controller has to show the method it used for this subject, with PP Pasal 39 ayat (1) requiring steps to identify the person, ayat (2) and ayat (3) requiring communication through means that are easy to understand and use, and ayat (6) requiring a dedicated accessibility route for exercising rights.

Sanction comes from UU Pasal 57 ayat (1), which lists UU Pasal 26 ayat (3). Capacity is where both instruments stop. GDPR Article 8(3) leaves general contract law to the member states, and UU Pasal 26 ayat (3) sends guardianship to ketentuan peraturan perundang-undangan, so on each side the capacity question is answered under general civil law and before a court rather than by the data protection regulator.