Establishing Indonesia’s Personal Data Protection Agency: Comparative Administration Sanctions Enforcement from Ireland, Australia, and Singapore

In the digital era, technological advancements have enabled governments and corporations to streamline services and expand market reach, often leading to the collection and transfer of personal data without the knowledge of data subjects. This poses significant risks to constitutional rights. Indonesia’s Law Number 27 of 2022 concerning Personal Data Protection (PDP Law) aims to address these risks, yet frequent data breaches indicate ineffective enforcement of administrative sanctions due to the absence of an independent authority. This study analyzes the urgency of establishing a Personal Data Protection Agency in Indonesia, evaluates current sanctions under the PDP Law, and compares the enforcement mechanisms of data protection agencies in Ireland, Australia, and Singapore. Using a normative legal approach with qualitative methods, the research finds that these countries’ independent agencies effectively enforce data protection laws and administrative sanctions. The study reveals significant enforcement shortcomings in Indonesia, underscoring the need for a dedicated authority to prevent violations and protect personal data rights. By adopting best practices from Ireland, Australia, and Singapore, Indonesia can enhance its data protection framework. Immediate action by the President to establish this authority through a Presidential Regulation is crucial for safeguarding personal data in the digital age.