Minimising unnecessary restrictions on cross-border data flows? Indonesia’s position and challenges post personal data protection act enactment

In the era of massive digital development, data plays an essential role as a ‘fuel’ in reshaping and creating new opportunities in the digital landscape, especially in the digital economy. The significance of data for Indonesia can be seen from the amount of data created, collected, and analysed in various sectors. However, Indonesia also faces problems of data breaches that happened in recent years, which harm society and need immediate attention. This article examined Indonesia’s data and cross-border data flow regulatory and institutional frameworks and its implementation challenges, especially with the recent enactment of a comprehensive Personal Data Protection Act (PDP Act), mainly inspired by the EU GDPR. This article shows that Indonesia is moving to less restrictive data-flow regulations than the previous regulatory regime but is still between the prescriptive and restrictive spectrum of data-flow regulation. This article argues that the enactment of the PDP Act can be momentum for Indonesia to evaluate the current regulatory framework to ensure that Indonesia’s regulation is not providing unnecessary restrictions that lead to complexity of implementation and will hinder from benefiting the utilisation of data.