Prohibitions + offences + final provisions

What the GDPR provides. The GDPR names no prohibition of this kind. It makes processing unlawful unless a legal basis in Article 6(1) applies, and Article 5(1)(a) requires lawfulness, fairness and transparency. Article 4(2) counts collection, use and disclosure by transmission as processing, so all three acts fall inside the regulation, but the duty runs to the controller and the processor rather than to any person, and Article 2(2)(c) puts purely personal or household activity outside scope.

Article 84 leaves other penalties, criminal ones included, to each member state.

UU Pasal 65 and GDPR Article 6(1) both make unauthorised handling of another person's data unlawful, but they pick different addressees. Article 6(1) binds whoever determines purposes and means, so a rogue employee acting outside instructions is often not the regulated party at all, and the event is handled as the controller's problem under Articles 32 and 33.

A natural person can still be caught, because the household exclusion in Article 2(2)(c) is read narrowly, as in C-212/13, but only where he is himself a controller. UU Pasal 65 binds Setiap Orang, defined at UU Pasal 1 angka 7 as orang perseorangan atau korporasi, and asks whether the data is bukan miliknya and whether the act is melawan hukum, whoever the person is.

The GDPR leaves criminal punishment to the member states, and Article 84 requires them to lay down other penalties for infringements of the Regulation. Germany did so in BDSG paragraph 42, which punishes knowingly transferring non publicly accessible data on a large number of people for commercial purposes, and separately processing or fraudulently obtaining such data for enrichment or to cause harm.

That second limb sits close to the UU wording. The comparison to draw is therefore not GDPR against UU but national criminal codes against UU, and any regulation level mapping will keep reporting a gap that the member state layer has already filled.

What the GDPR provides. The GDPR has no offence of fabricating data about another person, but it does not leave the fabricator outside its scope. Recording personal data is processing under Article 4(2), so a person who writes down invented data about another is a controller of it under Article 4(7) and needs a legal basis under Article 6(1), unless Article 2(2)(c) puts the act in the purely personal or household sphere.

Article 5(1)(d) requires personal data to be accurate and, where necessary, kept up to date, and Article 16 gives the data subject a right to rectification without undue delay against the controller. Article 4(12) treats alteration of personal data, accidental or unlawful, as a personal data breach, but only where it follows a breach of security.

The GDPR reaches the forger. What differs is what it can do to him. A person who records invented data about another is processing personal data under Article 4(2), and outside the household sphere in Article 2(2)(c) he is its controller under Article 4(7), so he needs a legal basis under Article 6(1) and is bound by Article 5(1)(a) and Article 5(1)(d).

What the GDPR lacks is a criminal grip: his exposure is an administrative fine and a rectification claim under Article 16, not a prosecution. UU Pasal 66 states the wrong as an offence with two limbs, intent to benefit and risk of loss to another, and asks nothing about whether the forger is a controller. The second real difference is the trigger for a controller who receives the forged record.

Article 4(12) reaches it only where there was a breach of security, so a forged form filed with a bank is a data quality problem under Article 5(1)(d) and not a notifiable breach under Article 33. In Europe the criminal charge is forgery or fraud under the ordinary criminal code, a field the Regulation does not occupy, so the comparison worth drawing in the tracker is UU Pasal 66 against those codes rather than against the GDPR.

What the GDPR provides. GDPR Article 83 sets administrative fines and nothing else. Article 83(4) caps a fine at 10 million euro, or in the case of an undertaking 2 per cent of total worldwide annual turnover of the preceding financial year, whichever is higher, and Article 83(5) sets the same structure at 20 million euro or 4 per cent.

Where the addressee is not an undertaking the turnover limb does not apply and the fixed sum is the whole ceiling. Article 83(2) makes the intentional or negligent character of the infringement one of eleven factors going to whether a fine is imposed and how large it is, and Article 84 leaves other penalties, imprisonment included, to member state law.

Both provisions punish the same conduct, so the divergence is in the currency of the sanction. UU Pasal 67 fixes absolute ceilings, kategori IV or Rp200.000.000,00 for all three acts since UU 1/2026 Lampiran I No. 137 replaced the enacted Rp5.000.000.000,00 and Rp4.000.000.000,00, and pairs each with four or five years of imprisonment.

GDPR Article 83 has no custodial option, and its ceiling floats with turnover only where the addressee is an undertaking, so against an individual defendant the European cap is a flat figure too. That does not make the systems close on corporate exposure.

Setiap Orang at UU Pasal 1 angka 7 covers orang perseorangan atau korporasi, and UU Pasal 70 ayat (3) multiplies the threatened maximum by ten for a Korporasi, which puts a fixed multiple of a fixed sum against a ceiling set on the worldwide turnover of the whole undertaking. Fault sits differently.

Dengan sengaja dan melawan hukum is an element of the offence under UU Pasal 67, whereas under Article 83 fault is a condition of the fine that C-807/21 confirmed is required, and C-683/21 held it is met where the controller could not have been unaware of the infringing nature of its conduct, without needing to know that conduct was unlawful.

The internal ranking is worth stating on its own terms: mengungkapkan carries a shorter term than memperoleh and menggunakan, so the UU treats disclosure as the lighter wrong, where Article 83 draws no ranking between infringement types beyond its two bands and leaves the rest to the Article 83(2) factors.

What the GDPR provides. The GDPR provides no criminal penalty for creating false personal data, and Article 84 leaves that to member state law. It reaches the conduct as an administrative matter instead. Recording invented data about another person is processing under Article 4(2), so the fabricator is a controller under Article 4(7) unless Article 2(2)(c) puts the act in the personal or household sphere.

They then lack a legal basis under Article 6(1) and breach the accuracy duty in Article 5(1)(d). Infringement of Articles 5 and 6 falls in the higher band under Article 83(5)(a), and refusal to rectify under Article 16 falls in the same band under Article 83(5)(b). Nothing in the regulation converts any of this into imprisonment.

UU Pasal 68 and GDPR Article 83 both attach a sanction to false personal data, and they differ on addressee, currency and who starts the process. The GDPR is not confined to the controller holding the record. A fabricator who records the data is himself a controller under Article 4(7), and the Article 83(5) band is open against him for breach of Article 5(1)(d) and Article 6(1).

What he does not face is a custodial term, because Article 83 knows only fines, and any prosecution comes from the ordinary criminal law of the member state rather than from the Regulation. Set the internal ranking against Article 83.

UU Pasal 68 carries six years and a kategori V fine against the five years and kategori IV of UU Pasal 67, as UU 1/2026 Lampiran I No. 137 re-graded them, so manufacture outranks misappropriation, while Article 83(5) puts an accuracy breach and an unlawful disclosure in the same band and leaves any ranking to the Article 83(2) factors.

For a European group the consequence is that Indonesian exposure starts with a public prosecutor and European exposure with a supervisory authority or a data subject's complaint, and only the Indonesian route ends in imprisonment.

What the GDPR provides. The GDPR has no additional penalty riding on a sanction and no confiscation power. What it does allow is a fine alongside corrective measures: Article 83(2) says administrative fines shall be imposed in addition to, or instead of, the measures in Article 58(2)(a) to (h) and (j).

Financial benefit enters only indirectly, because Article 83(2)(k) makes gains made or losses avoided from the infringement a factor in setting the fine, so profit is absorbed into the amount rather than confiscated separately. Compensation is a separate track under Article 82, claimed by the data subject against the controller or processor before the courts identified by Article 79(2), which Article 82(6) adopts. The fine is a public sanction and the compensation is private, and neither depends on the other.

Both systems want the same two results, that the offender keeps no gain and the victim is made whole, and both reach them by unconnected routes. UU Pasal 69 lets the criminal court order perampasan keuntungan and pembayaran ganti kerugian as pidana tambahan in the same judgment, so one proceeding can do all of it, although the power is discretionary and it needs a conviction under Pasal 67 or Pasal 68 first.

Under the GDPR the supervisory authority folds the gain into the fine under Article 83(2)(k) and cannot award compensation, while the data subject must bring a separate Article 82 claim. That claim is not a substitute penalty. C-300/21 held that an infringement alone gives no right to compensation without proved damage, and C-667/21 held that Article 82 fulfils a compensatory function and not a dissuasive or punitive one.

So the European route can end with a proven infringement and no payment to the person harmed. The cost of the Indonesian design is that quantum is fixed by a criminal court applying general sentencing law, with nothing in the statute to structure it. The comparator is not Article 83(2), which structures fines, but the domestic rules on the extent of compensation that C-300/21 leaves to the national courts subject to equivalence and effectiveness.

What the GDPR provides. GDPR fines are addressed to the controller or processor, and Article 4(7) and Article 4(8) both allow that addressee to be a natural or a legal person. Where the addressee forms part of an undertaking, the ceilings in Article 83(4) to (6) are calculated on the economic unit rather than on the fined entity, the competition law concept imported by C-807/21 and settled in C-383/23.

Article 83(7) lets member states decide whether public authorities can be fined at all. The regulation gives no power to reach directors, controlling persons or beneficial owners, and no corporate sanction beyond fines and the corrective measures in Article 58(2).

The two texts agree that a corporation is sanctionable and disagree about who else is. UU Pasal 70 ayat (1) reaches pengurus, pemegang kendali, pemberi perintah and pemilik manfaat alongside the Korporasi, so a beneficial owner behind a shell can be named in the sentence.

GDPR Article 83 has no such reach, and C-807/21 moved in the opposite direction: a legal person can be fined without the infringement being attributed to an identified natural person, so the regulation removed the need to look behind the entity instead of building a route through it.

On quantum the UU multiplies a statutory maximum by ten, an absolute figure, while Article 83(4) to (6) scale to the worldwide turnover of the whole undertaking.

The additional penalties in UU Pasal 70 ayat (4), pembekuan usaha, pencabutan izin and pembubaran Korporasi, have only partial analogues in Article 58(2): a ban on processing under Article 58(2)(f) stops the data activity, it does not revoke a licence or dissolve the company, because the supervisory authority is a data regulator and not a corporate one.

The difference is jurisdictional rather than doctrinal, and it is the reason a European group will find its Indonesian exposure sitting with people the GDPR never names.

What the GDPR provides. The GDPR says almost nothing about how a fine is collected. Article 83(8) subjects the supervisory authority's exercise of its powers under that Article to appropriate procedural safeguards in accordance with Union and Member State law, including effective judicial remedy and due process.

Article 83(9) covers member states whose legal systems provide no administrative fines, allowing the competent supervisory authority to initiate the fine and the national courts to impose it, with the fine still effective, proportionate and dissuasive. Article 84(1) leaves other penalties, criminal ones included, to member state law, and requires member states both to lay those rules down and to take all measures necessary to ensure that they are implemented.

Neither Article sets a payment period, a seizure procedure or any consequence of non-payment.

UU Pasal 71 puts in the statute what the GDPR leaves to national law. The one month to pay from a putusan that has berkekuatan hukum tetap, the single one-month extension, penyitaan and pelelangan by the jaksa, and substitute imprisonment where the assets fall short, are all matters the regulation does not itself regulate. Article 83(8) supplies only a floor of procedural safeguards, effective judicial remedy and due process.

Article 83(9) shows the regulation contemplating court-imposed fines where a member state has no administrative fining power, but it stops at imposition and says nothing about recovery. Article 84(1) does reach the enforcement stage, since member states must take all measures necessary to ensure that the penalties they lay down are implemented, but it prescribes no mechanism and sets no ceiling.

The substitute custodial term in UU Pasal 71 ayat (4) has no counterpart in the regulation, because an Article 83 fine is administrative and there is no custodial ceiling to convert into. The limit on comparison should be stated in the tracker. Under the GDPR, recovery is a national collection question answered differently in each member state.

Under UU Pasal 71 it is a sentencing question answered by the same judge in the same judgment, with ayat (5) putting the length of the substitute term in the putusan itself.

What the GDPR provides. The GDPR has no substitute sanction. Article 58(2)(f) lets a supervisory authority impose a temporary or definitive limitation, including a ban, on processing, and Article 58(2)(j) lets it order the suspension of data flows to a recipient in a third country or to an international organisation.

Both are corrective powers aimed at the unlawful processing itself, and Article 83(2) provides that a fine may be imposed in addition to, or instead of, the measures in Article 58(2)(a) to (h) and (j). Article 84(1) leaves other penalties to member state law. Nothing in the regulation converts an unpaid fine into an operational restriction.

UU Pasal 72 answers a question the GDPR does not ask: what happens when a Korporasi cannot pay. Its answer, pembekuan of part or all of the business for up to five years, is the corporate mirror of the substitute imprisonment in UU Pasal 71 ayat (4), and it is a sanction for non-payment rather than for the data offence.

The nearest GDPR instrument, the processing ban in Article 58(2)(f), looks similar in effect and differs in every trigger: it responds to the infringement itself, comes from the supervisory authority rather than a court, bites on processing rather than on the business as a whole, and carries no maximum duration in the text. On the European side an unpayable fine is moderated rather than converted, and only just.

Article 83(1) requires each fine to be effective, proportionate and dissuasive in the individual case, and Guidelines 04/2022 paragraph 140 lets a supervisory authority reduce a fine for inability to pay as a derivative of proportionality, in exceptional circumstances and on objective evidence that payment would irretrievably jeopardise the economic viability of the undertaking. The caps in Article 83(4) to (6) are ceilings tied to turnover, not a means test.

The exposure profile that results is different in kind: a European fine that cannot be paid stays a debt owed to the state, an Indonesian one becomes a licence to operate problem fixed by the sentencing judge.

What the GDPR provides. GDPR Article 82(1) gives any person who has suffered material or non-material damage from an infringement a right to compensation from the controller or processor, with processor liability limited by Article 82(2). Article 82(6) provides that proceedings for that compensation are brought before the courts competent under the law of the Member State referred to in Article 79(2), so the forum is set by national procedural law.

Article 83 puts the punitive power elsewhere, in administrative fines imposed by the supervisory authority. Article 84 leaves other penalties, criminal ones included, to member state law, so the GDPR itself creates no offence and no compensation order attached to a criminal sentence.

UU Pasal 73 works by extension. It carries the enforcement machinery of Pasal 71 and Pasal 72, the payment window, penyitaan and pelelangan, substitute imprisonment and pembekuan, over to the additional penalty of paying ganti kerugian, so a compensation order is collected the way a criminal fine is collected and by the same judgment. The GDPR splits the two functions across two provisions.

In C-667/21 the Court held that compensation under Article 82(1) is exclusively compensatory, so it cannot carry the punitive weight the Indonesian additional penalty gives it, and in C-300/21 it held that infringement alone is not enough, because the claimant must show damage and a causal link.

Punishment sits in Article 83, where C-807/21 allowed a fine on a legal person without first attributing the breach to a named natural person, subject to proof of intent or negligence.

So Indonesia settles victim compensation and corporate punishment in one criminal proceeding and enforces both by one route, while the EU runs an uncapped compensation claim under Article 82 alongside a capped administrative fine under Article 83, leaving the forum for the claim to member state law under Article 82(6) and Article 79(2). Article 84 is what leaves the Indonesian construction open to a member state without supplying it.

What the GDPR provides. GDPR Article 99 has two paragraphs. Article 99(1) brought the Regulation into force on the twentieth day after publication in the Official Journal, 24 May 2016. Article 99(2) deferred its application to 25 May 2018, so no controller was bound by the substantive obligations and no supervisory authority could enforce them before that date, with Directive 95/46 still governing. From 25 May 2018 the Regulation applied in full, with no grace period of any kind.

Both instruments buy two years, in different places. GDPR Article 99(2) suspends the application of the Regulation, so before 25 May 2018 there was no obligation to be late with, while UU Pasal 76 brings the statute into force on promulgation and Pasal 74 then lays a two-year duty of adjustment on Pengendali Data Pribadi, Prosesor Data Pribadi and other parties.

The Indonesian window therefore runs against compliance rather than against the statute, which was in force throughout. The second difference is what the two years were used for. The EU also carried its old instruments across by savings clauses, since Article 45(9) kept the Directive-era adequacy decisions in force and Article 46(5) kept prior transfer authorisations valid, so transfers had a footing on the first day of application.

Completeness was still not total, because several member states had not passed the statutes filling the GDPR's openings by 25 May 2018. The Pasal 74 clock expired in October 2024 with the implementing regulation not yet made, and the regulation that followed on 16 July 2026 hands the detail of 34 of its articles to Peraturan Lembaga not yet issued.

From 16 January 2027 PP Pasal 223 bridges part of the second gap: until the Peraturan Lembaga on processing is set, controllers and processors carry out processing so far as it does not conflict with the PP.

That leaves a position no EU controller was in, bound by a statute in force for longer than the regime around it has been complete, which is why the Indonesian compliance question is about which arrangements are defensible in the absence of a rule rather than about the calendar.

What the GDPR provides. GDPR Article 94(1) repeals Directive 95/46 with effect from 25 May 2018, and Article 94(2) provides that references to the repealed Directive are read as references to the GDPR, with references to the Article 29 Working Party read as references to the EDPB.

Article 95 keeps the ePrivacy Directive as the special rule in one field only, providing that the GDPR imposes no additional obligations on natural or legal persons in relation to processing connected with the provision of publicly available electronic communications services in public communication networks in the Union, in matters for which they are already subject to specific obligations with the same objective under Directive 2002/58.

Beyond that, national law operates only where the GDPR opens a door to it, and on the conditions that door sets. Article 6(3) is the door for legal bases specified by national law. Article 23(1) is the door for restrictions on Articles 12 to 22 and Article 34, and it requires a legislative measure that respects the essence of the fundamental rights and is necessary and proportionate to one of the listed objectives.

Same problem, opposite default. UU Pasal 75 is a savings clause, so pre-existing personal data rules keep running unless they conflict with the statute, and PP Pasal 224 repeats the formula for the regulation. The GDPR has no general savings clause of that kind.

Article 94 repeals its own predecessor outright on a fixed date and supplies only a mapping rule for stale cross-references, and it operates on an EU directive rather than on national sectoral law. Where national law operates under the GDPR it is because the Regulation invited it, in Article 6(3), Article 23 and the other opening clauses, and on the terms of the invitation.

The Court has run that test on statutes older than the GDPR, holding in C-439/19 that Article 10 covers penalty points data and that Articles 5(1), 6(1)(e) and 10 together preclude a national law obliging their disclosure to any member of the public who asks, without a specific interest being shown, and holding in C-184/20 that a national conflict of interest law supplying a legal basis through Article 6(3) still has to satisfy proportionality.

Article 95 is the one place the EU does what Pasal 75 does, and it is drafted as a named carve-out for a single instrument in a single sector rather than as a general survival rule. So the practical difference is the starting point. In Indonesia the older sectoral rule continues on its own terms until a conflict with the statute is identified.

In the EU an older national rule in the same field operates only where the GDPR leaves room for it, and is disapplied where it conflicts.

What the GDPR provides. GDPR Article 99(1) sets entry into force at the twentieth day following publication in the Official Journal, which was 24 May 2016. Article 99(2) sets a separate and later date of application, 25 May 2018. The formula that the Regulation is binding in its entirety and directly applicable in all Member States closes the Regulation after Article 99(2) rather than forming part of it.

Being a regulation it needed no national transposition step between those dates, although Member States had to legislate where the GDPR requires it, such as the reconciliation with freedom of expression under Article 85(1), and wherever they wished to use its optional openings. The two dates are the main transition device but not the only one, since Article 45(9), Article 46(5) and Article 96 preserve Directive-era adequacy decisions, transfer authorisations and pre-24 May 2016 international agreements beyond 25 May 2018.

GDPR Article 99 separates two dates that UU Pasal 76 keeps together. In Indonesia entry into force and application are one moment, promulgation, and the runway is moved into Pasal 74 as a compliance duty on controllers rather than as a suspension of the statute, so the statute itself got no runway and the supervisory institution got none either.

A runway technique does reappear one level down, since PP Pasal 225 gives the implementing regulation six months from promulgation on 16 July 2026, so 16 January 2027, where the draft at RPP Pasal 245 would have taken effect on promulgation. That is one deferred date rather than the GDPR's split between force and application.

The reason for the GDPR's own gap is institutional, because 25 May 2018 was also the day Directive 95/46 fell away under Article 94(1) and the day the supervisory authority each Member State must provide for by law under Article 54 had to be operating. Member states also had to have legislated where the Regulation requires it, and could not rely on its optional openings until they did.

The two years were therefore as much for the regulators as for controllers, which is the part Pasal 76 never bought, and PP Pasal 225 is now buying it for the regulation rather than for the law.