Transfer + sanctions + the institution + disputes

What the GDPR provides. The GDPR governs movement inside the Union by forbidding restriction of it. Article 1(3) provides that the free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to processing, and Article 1(1) states free movement alongside protection as an object of the Regulation.

A disclosure from one controller to another inside the Union is only processing: it needs a legal basis under Article 6(1), and where it serves a new purpose it must clear the compatibility test at Article 6(4) or rest on consent or a legislative measure. Each controller answers for its own processing under Article 5(2) and Article 24, and restrictions on movement begin only at Chapter V, at the external border.

The GDPR does address this movement, and it addresses it from the other end. Article 1(3) bars member states from restricting or prohibiting free movement inside the Union for reasons connected with data protection, and Article 1(1) sets free movement beside protection as an object rather than a concession, so the EU has built no body of law on what a domestic transfer requires and the question dissolves into Article 6(1), Article 6(4) and the receiving controller's own compliance.

A disclosure between two EU controllers is still a regulated event. It is regulated as processing, not as a transfer. That is the difference UU Pasal 55 ayat (1) makes, giving a domestic disclosure a heading of its own, although the paragraph is permissive and imposes nothing by itself.

UU Pasal 55 ayat (2) binds the sending and the receiving controller together, which is not joint control in the Article 26 sense, since neither the arrangement at Article 26(1) nor the transparency at Article 26(2) is present and the two are successive independent controllers.

The EU answer for that pair is Article 5(2) and Article 24, under which each controller is separately accountable for its own processing and no transfer rule is engaged at all.

That is why the absent PP section leaves so little behind: PP 33/2026 opens its transfer chapter at Pasal 160 and confines it to transfers out of Indonesia, so with no implementing detail ayat (2) reduces to a restatement that both parties are bound by the Law, which they already were.

What the GDPR provides. Chapter V builds a three-step cascade. Article 45 lets a transfer proceed with no further authorisation where the Commission has decided that a third country ensures an adequate level of protection, assessed against the rule of law, enforceable rights, an effective and independent supervisory authority and international commitments, subject to periodic review and a list published in the Official Journal.

Absent adequacy, Article 46 requires appropriate safeguards giving enforceable rights and effective remedies, through standard contractual clauses, binding corporate rules under Article 47, approved codes or certification. Failing both, Article 49 permits a transfer only under narrow derogations, the first of which is explicit consent given after the data subject has been informed of the possible risks of the transfer arising from the absence of an adequacy decision and appropriate safeguards.

Article 44 holds the chapter together by requiring that the level of protection is not undermined, onward transfers included, and Article 48 addresses orders from third country authorities.

The three rungs sit in Chapter V's order, ayat (2) against Article 45, ayat (3) against Article 46 and ayat (4) against Article 49(1)(a), but only the first two rungs do the same work. Article 45 says adequate, and it took Schrems I to read that as essentially equivalent to the level guaranteed inside the EU, where ayat (2) writes setara atau lebih tinggi into the statute and arrives at the same standard without the litigation.

Who applies that standard is the first divergence, and the PP moves Indonesia closer to the EU than the statute is: Article 45 makes adequacy a central Commission act with a published list a controller may rely on, UU Pasal 56 ayat (2) puts the judgment on the controller, and PP Pasal 167 and Pasal 168(2) hand it back to the Lembaga with a country list and three criteria that read like a compressed Article 45(2).

The third rung is the larger divergence in the statute, because Article 49 consent is a derogation, construed restrictively, tied to information about the specific risks and unfit for repetitive or large-scale flows, while UU Pasal 56 ayat (4) makes consent the ordinary fallback whenever the first two limbs fail.

PP Pasal 173 ayat (2) closes most of that route: a transfer on consent must be non-repetitive, concern a limited number of subjects and be notified to the Lembaga, the conditions GDPR Article 49(1) sets for its compelling legitimate interests derogation, so a regular flow cannot use consent to pass an unfavourable country list.

Chapter V also carries an onward-transfer rule at Article 44 and a rule at Article 48 on foreign authority orders, and UU Pasal 56 has neither, so a chain that leaves the first recipient runs out of statutory text at the border.

The regulation adds little: PP Pasal 160 ayat (4) says only that an onward transfer stays subject to the laws and regulations, and PP Pasal 162 ayat (2) huruf i has the controller weigh the chance of one.

What the GDPR provides. GDPR Article 83 sets the conditions for administrative fines. Article 83(4) caps one tier at 10 million euro or, for an undertaking, 2 per cent of total worldwide annual turnover of the preceding financial year, whichever is higher, and Article 83(5) caps the other at 20 million euro or 4 per cent on the same basis.

Article 83(2) requires due regard to eleven listed factors at points (a) to (k) in deciding whether to fine and how much, including gravity, degree of responsibility and financial benefit gained, and it makes the fine imposable in addition to or instead of the other corrective measures in GDPR Article 58(2), the fine itself being point (i) of that list of ten.

Article 83(8) subjects the exercise to procedural safeguards including effective judicial remedy, and Article 84 leaves further penalties, criminal ones included, to member state law.

The gap is wider than 2 per cent against 4 per cent. Article 83(4) and (5) fix an alternative maximum, so the cap on an EU fine never falls below 10 million euro however small the turnover, while UU Pasal 57 ayat (3) states a percentage ceiling with no monetary alternative and PP Pasal 185 ayat (3) lets the figure be set at Rp0,00 or 0 per cent.

Neither system sets a minimum. The EU base is larger than it reads: with Recital 150, and as held in C-807/21, turnover is that of the whole undertaking in the competition law sense rather than the fined entity, where PP Pasal 185 ayat (1) takes the annual revenue or receipts of the Pengendali or Prosesor itself. The variabel pelanggaran is not a narrower revenue base.

PP Pasal 185 ayat (2) defines it as a ten-point severity measure covering impact, duration, type of data, number of subjects affected, how the breach came to light, cooperation during examination, business scale, ability to pay, compliance record and any further variable the Lembaga sets, so it is the Indonesian answer to the eleven Article 83(2) factors and reads closely against them.

The difference is where each list sits and what it must survive. Article 83(2) is in the Regulation and its arithmetic is contestable on the face of the instrument, while UU Pasal 57 ayat (5) defers the method of imposition to a Peraturan Pemerintah, and neither instrument carries anything answering to Article 83(8), which subjects the exercise to procedural safeguards including effective judicial remedy, so a challenge falls back on general administrative law.

C-683/21 adds a threshold the Indonesian text never states: a fine requires wrongful conduct, intentional or negligent, so breach of a listed pasal is not by itself enough in the EU.

What the GDPR provides. GDPR Article 51 requires each member state to provide for one or more independent public authorities to monitor application of the Regulation. GDPR Article 52 requires each authority to act with complete independence, to remain free from external influence direct or indirect, to neither seek nor take instructions from anybody, and to have its own staff, its own budget and its own premises.

GDPR Article 53 sets the appointment route for the members, which may run through the parliament, the government, the head of state or an independent body, provided the procedure is transparent, and GDPR Article 53(4) limits dismissal to serious misconduct or loss of eligibility. GDPR Article 54(1) requires member state law to fix the establishment of the authority itself, the qualifications, the appointment procedure and a term of no less than four years.

UU Pasal 58 ayat (3) and ayat (4) do two different things and neither would survive under the GDPR untouched. Constitution by presidential instrument is not what GDPR Article 53(1) permits, because that provision lets the head of state appoint the members while GDPR Article 54(1)(a) requires the establishment of the authority itself to be provided by law.

Responsibility to the President is the harder problem, because GDPR Article 52(1) and (2) demand complete independence, and the Court read the equivalent wording in C-518/07 to exclude even the general state scrutiny Germany applied to its Land authorities supervising processing outside the public sector, then in C-614/10 to exclude structural links to the supervised administration.

C-288/12 adds that a fixed term cannot be cut short by restructuring the body, an exposure that cannot even be tested here because UU Pasal 58 fixes no term. The sequencing is the real divergence: GDPR Article 54(1) puts establishment, qualifications, appointment procedure and a term of at least four years into binding law, with dismissal confined by GDPR Article 53(4) to serious misconduct, all of it before the authority starts work.

UU Pasal 58 does no more than say a lembaga carries out the function, leaves its constitution to the President and defers every one of those terms to a Peraturan Presiden not yet made, and each supervision, sanction and dispute provision in PP 33/2026 is addressed to a body whose independence terms are still unwritten.

What the GDPR provides. GDPR Article 57(1) lists the tasks of a supervisory authority in twenty two limbs at points (a) to (v). They include monitoring and enforcing the Regulation, promoting public awareness, advising the parliament and government, handling complaints lodged by data subjects and investigating them to the extent appropriate, and encouraging codes of conduct and certification.

Article 57(3) requires the tasks to be performed free of charge for the data subject, and Article 57(4) allows a fee or a refusal only for a manifestly unfounded or excessive request, with the burden of showing that character on the authority. GDPR Article 78(2) backs the complaint limb with a judicial remedy against the authority that fails to handle a complaint or to report progress within three months.

The four limbs of UU Pasal 59 cover policy, supervision, administrative enforcement and out of court dispute facilitation. Huruf b tracks GDPR Article 57(1)(a), which makes monitoring and enforcement the first task, and huruf c is the enforcement half of that same limb read with GDPR Article 58(2).

Huruf a has no dedicated counterpart, because the Regulation sets the substantive policy itself and gives the authority an advisory role at GDPR Article 57(1)(c), awareness limbs at GDPR Article 57(1)(b) and (d), a catch-all at GDPR Article 57(1)(v) and the power to issue opinions at GDPR Article 58(3)(b).

That is how EU authorities publish guidance without holding a policy-making mandate, and it is a different constitutional position from perumusan dan penetapan kebijakan. What is absent matters more than what is present: GDPR Article 57(1)(f) makes handling a complaint a duty owed to the complainant, and GDPR Article 78(2) converts that duty into a remedy by letting the data subject sue the authority that does not handle the complaint or report progress within three months.

In UU 27/2022 complaint handling appears only as a power, at UU Pasal 60 huruf i for receiving a complaint and huruf j for examining it, and neither gives an individual a right to have their complaint dealt with or sets a clock.

The limb the Indonesian text adds, fasilitasi penyelesaian sengketa di luar pengadilan at huruf d, is not an Article 57 task at all, and amicable settlement exists in EU practice only because the EDPB built it into the cooperation procedure and because some member state laws provide for it.

C-768/21 marks the outer edge of the enforcement limb, holding that an authority which establishes a breach need not use a corrective power where that action is not appropriate, necessary or proportionate, so an enforcement mandate on its own never tells you when the body must act.

What the GDPR provides. GDPR Article 58 splits the authority's powers into three sets. Article 58(1) gives investigative powers, including ordering the provision of information, carrying out audits, and obtaining access to premises and equipment. Article 58(2) gives ten corrective powers. They run from a warning, through an order to comply with a subject request and an order to rectify or erase, to a temporary or definitive ban on processing and suspension of flows to a third country.

Article 58(3) adds advisory and authorisation powers, Article 58(4) subjects every one of these powers to appropriate safeguards including effective judicial remedy and due process, and Article 58(5) lets the authority bring legal proceedings.

The lettered list in UU Pasal 60 reaches many of the same places by a route of its own: huruf j to huruf n answer most of GDPR Article 58(1), huruf c and huruf g answer part of GDPR Article 58(2), and huruf f, read with PP Pasal 170 and PP Pasal 171 ayat (3), answers the authorisation powers at GDPR Article 58(3)(g) to (j) rather than any corrective power.

Three asymmetries decide the grade. GDPR Article 58(2)(c) lets the authority order a controller to comply with a data subject request, which turns an individual right into an enforceable supervisory order.

UU Pasal 60 has no dedicated equivalent, and the nearest route is indirect: huruf i receives the complaint, huruf j examines it, and huruf g supplies a general power to order follow-up to the result of supervision, so a refused access request under UU Pasal 7, against the controller's duty at UU Pasal 32, reaches an order only through the supervision limb and never as a remedy the subject can invoke.

In the other direction huruf k and huruf m let the Lembaga compel the attendance of any person, any public body and any expert, which GDPR Article 58(1) does not reach. Huruf d has the Lembaga assist law enforcement on suspected offences under the same statute.

The GDPR splits that function between Article 58(5), which requires the authority to be able to bring infringements to the judicial authorities, and Article 84, which leaves the offences themselves to member state law. The clause with no Indonesian counterpart at all is GDPR Article 58(4): in the EU each power carries its safeguards with it, while UU Pasal 61 sends the procedure elsewhere.

C-311/18 shows what happens when one of these powers hardens into a duty, the authority being required, where no valid adequacy decision is in force, to suspend or prohibit a transfer the clauses cannot support, and C-645/19 shows the limits on a single authority acting alone in a cross border case.

What the GDPR provides. The GDPR has no single article on how a supervisory authority exercises its powers. GDPR Article 58(4) requires the exercise of each power to be subject to appropriate safeguards laid down in Union and member state law, including effective judicial remedy and due process.

The procedure the Regulation writes for itself is the cooperation and consistency machinery at GDPR Articles 60 to 67, covering the lead authority, mutual assistance, joint operations and binding dispute resolution by the Board. GDPR Article 78(1) completes the picture by giving each natural or legal person a remedy against a legally binding decision of an authority concerning them, and GDPR Article 78(3) puts those proceedings before the courts of the member state where the authority is established.

Both instruments leave procedure to be filled in, but they leave different things and at different levels. GDPR Article 58(4) delegates only the safeguards, delegates them to law, and keeps the powers themselves and the cooperation machinery in a directly applicable Regulation.

UU Pasal 61 delegates the tata cara for the whole of UU Pasal 60 to a Peraturan Pemerintah, and PP 33/2026 discharges it across the supervision, sanctions and dispute chapters rather than in one place, pushing further detail down to Peraturan Lembaga. That is a two step delegation. On the safeguards side the outcome is closer to the GDPR than the UU alone suggests.

UU 27/2022 says nothing about challenging the Lembaga's own decisions, but PP Pasal 197 supplies the route: a written keberatan to the pimpinan Lembaga within 14 days of notification, a decision within 14 days, the objection deemed granted if that period passes, no suspensive effect, and a gugatan to the pengadilan tata usaha negara if the objection is refused.

That is the functional analogue of GDPR Article 78(1) and GDPR Article 78(3), with two differences worth stating. The Indonesian route runs through the authority first and is time barred at 14 days, where GDPR Article 78(1) is a direct right of action against a legally binding decision.

And PP Pasal 197 ayat (1) names only a Pengendali or Prosesor that has been sanctioned, where GDPR Article 78(1) is open to each natural or legal person concerned by the decision and GDPR Article 78(2) adds a remedy for the complainant whose complaint is not handled.

What the GDPR provides. GDPR Article 50 is the external cooperation article. It requires the Commission and the supervisory authorities to take appropriate steps to develop international cooperation mechanisms, to provide international mutual assistance in enforcement including notification, complaint referral and investigative assistance, to engage stakeholders, and to promote the exchange of legislation and practice including on jurisdictional conflicts with third countries.

The duties are addressed to the Commission and to the authorities, not to member state governments. GDPR Article 48 sets the limit on the same relationship from the receiving side: a judgment of a court or a decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may be recognised or enforceable only if it is based on an international agreement, such as a mutual legal assistance treaty.

That is expressly without prejudice to other grounds for transfer in Chapter V, so Article 48 does not by itself forbid the disclosure. The controller still has to find a Chapter V ground, and EDPB Guidelines 02/2024 treat the Article 49 derogations as the narrow route where no agreement is in force.

The addressee differs and that changes what the article can do. UU Pasal 62 ayat (1) places international cooperation on the Pemerintah, dealing with foreign governments and international organisations, which is treaty making rather than case work, while GDPR Article 50 places it on the authorities that hold the file. Indonesia does have the authority level limb.

It sits at UU Pasal 60 huruf e, confined to suspected cross border breaches, and PP Pasal 178 ayat (1) adds the two limbs that answer GDPR Article 50(a) and (b), developing cooperation procedures and mutual assistance, with the detail deferred to a Peraturan Lembaga. Article 50 is in any case the soft half of the EU scheme.

The binding machinery, mutual assistance under Article 61 with a one month deadline and a provisional measure if it lapses, and the lead authority procedure under Article 60, applies only between member state authorities, so neither instrument reaches a foreign regulator by right. Article 48 shows the asymmetry from the other end and UU Pasal 62 carries no equivalent limit on responding to foreign legal process.

The nearest Indonesian control is not in this article at all but at UU Pasal 56, which conditions any transfer out of the jurisdiction on an equivalent or higher level of protection, on adequate and binding safeguards, or on consent, and which binds the Pengendali rather than the state.

What the GDPR provides. The GDPR gives the public no role in supervision. What it has instead runs one way. Article 57(1)(b) and (d) make awareness raising a task of the supervisory authority, addressed to the public and to controllers. Article 80(1) lets a data subject mandate a not for profit body to lodge a complaint and bring proceedings for them, and Article 80(2) lets member states allow such bodies to act with no mandate.

Article 35(9) is the only participatory hook in the processing rules, and it is soft: the controller shall seek the views of data subjects on an intended processing operation where appropriate.

UU Pasal 63 has no close GDPR counterpart, but the GDPR does address civil society, so this is a divergence rather than a subject the Regulation ignores. The GDPR channels civil society into litigation rather than into supervision.

Article 80 makes an association the representative of individuals, and C-319/20 held that Article 80(2) does not preclude national law letting a consumer body sue with no mandate, provided the processing is liable to affect the rights of identified or identifiable persons, with C-757/22 extending that to breach of the information duties in Article 12(1) and Article 13(1)(c) and (e).

UU Pasal 63 ayat (2) names pendidikan, pelatihan, advokasi, sosialisasi and pengawasan, which is participation in the supervisory function itself and not standing to enforce anything. It also binds nobody: masyarakat dapat berperan is permissive. On the authority side the contrast is narrower than a straight reading suggests.

UU Pasal 59 carries no general public awareness duty of the Article 57(1)(b) kind, but Pasal 59 huruf a makes the Lembaga set policy and strategy yang menjadi panduan bagi Subjek Data Pribadi, Pengendali Data Pribadi, dan Prosesor Data Pribadi, and Pasal 60 huruf h requires publication of supervision results, so part of that work has a home.

The operative content of the participation article is deferred: PP Pasal 179 ayat (3) sends pelaksanaan peran masyarakat to a Peraturan Lembaga, so until that instrument is made the article confers no instrument on the public and requires nothing of them.

What the GDPR provides. The GDPR gives the data subject three routes and lets them run together. Article 77 is a complaint to a supervisory authority in the member state of residence, work or alleged infringement. Article 78 is a judicial remedy against the authority, both against its binding decisions and where it fails to handle a complaint or to report progress within three months.

Article 79 is a direct action against the controller or processor, with Article 79(2) allowing the data subject to sue in the courts of their own habitual residence unless the defendant is a public authority acting in its public powers, and Article 82 supplying compensation for material and non material damage.

UU Pasal 64 ayat (1) lists arbitration, the courts and other alternative dispute resolution, where the GDPR opens instead with the GDPR Article 77 complaint, which is not a dispute between two parties but a request that the regulator act. PP Pasal 200 repeats the three routes and adds no gate. Mediation sits one step to the side.

PP Pasal 206 ayat (1) says the Lembaga's own facilitation mengutamakan Mediasi, but that facilitation is reached only where verification of a report found no criminal and no administrative element under PP Pasal 205, and PP Pasal 206 ayat (3) huruf b excludes it where the parties have already fixed a mechanism by contract. So mediation is a preference inside one optional channel, not a precondition to court or arbitration.

On the EU side C-132/21 held that GDPR Articles 77(1), 78(1) and 79(1) may be exercised concurrently and independently, with the relationship between them left to member state procedural autonomy, which is the benchmark any future gating rule would be measured against. Arbitration is the sharper divergence, though not because the GDPR forbids it.

GDPR Article 79(1) states the judicial remedy without prejudice to any available administrative or non judicial remedy, so the Regulation neither designates arbitration nor rules it out, and what it does fix is the court forum, GDPR Article 79(2) letting the data subject sue where they live unless the defendant is a public authority acting in the exercise of its public powers.

UU Pasal 64 ayat (1) names arbitration in the statute but adds no forum rule of its own and does not displace the agreement requirement in the arbitration law, so the practical exposure is a dispute clause in a standard contract rather than anything the article itself does. The question that dominates the EU case law is missing here.

C-300/21 held that an infringement alone does not sound in compensation and that damage must be proved, while ruling out any national seriousness threshold for non material damage, where UU Pasal 12 ayat (1) leaves both quantum and threshold to the general law. Ayat (3) on electronic evidence and ayat (4) on closed hearings have no GDPR counterpart, because the Regulation leaves procedure to national law subject only to equivalence and effectiveness.