Territorial Scope
What is the territorial reach of the data privacy and cybersecurity laws?

Last review date: 13 January 2025

☒  applies to organizations located in the jurisdiction

☒  applies to organizations located outside of the jurisdiction offering goods or services to data subjects in the jurisdiction

☒  applies to organizations located outside of the jurisdiction engaged in the monitoring of the behavior of data subjects located in the jurisdiction

☒  other

The EIT Law applies to Indonesians, foreign individuals or legal entities that conduct electronic transactions:

  • In Indonesia
  • Outside Indonesia but with legal impacts in Indonesia
  • Having legal impacts outside Indonesia but are detrimental to the interests of Indonesia

The PDP Law applies to every person, entity, public institution, and international organization that processes personal data in Indonesia or outside of Indonesia but with legal impacts in Indonesia and/or on Indonesian data subjects outside of Indonesia. However, we have yet to see how the extraterritorial scope will be implemented in practice.