Last review date: 13 January 2025

Yes. Under the PDP Law, a data controller may transfer personal data to other data controllers and/or data processors outside the jurisdiction of Indonesia so long as any of the following can be fulfilled:

• The country of domicile of the data controller and/or the data processor that receives the transfer of personal data has a level of personal data protection that is equal to or higher than that regulated under this law.
• The data controller must ensure that there is an adequate and binding personal data protection measure by the offshore data recipient.
• The data controller must obtain the approval of the data subject.

Transfers of personal data to third countries are only permissible if there is a legal basis for the processing/transfer and one of the following applies:

☒  approved adequate/whitelisted jurisdictions

Although regulated, kindly note that to date, the Indonesian authority has yet to issue a list of countries that are considered to have similar or higher personal data protection standards in Indonesia.

☒  derogations, such as consent, contract performance, necessity to establish, exercise or defend legal claims

Please see separate question for information on data localization provisions that are not restricted to personal data.