A Juridical Review of the Formulation of a Data Sharing Agreement in the Digital Service Ecosystem of the Indonesian National Police Based on the Personal Data Protection Law

The acceleration of digital transformation toward realizing Police 4.0 requires the Indonesian National Police (Polri) to integrate public services and engage in massive data sharing with third parties, including government ministries/agencies and private partners. However, this system interconnectivity triggers cyber risks and serious threats of personal data breaches, as confirmed by various nationwide data breach incidents. Unlike prior studies that generally focus on general compliance review of the Personal Data Protection Law (UU PDP) or macro-level government data governance, this research specifically fills a research gap concerning the contractual instruments governing the legal relationship between Polri and third parties in technology-based public data sharing. This research analyzes the legal gap resulting from the absence of internal technical regulations adopting the Data Protection by Design principle in the development of police service applications, as well as the inadequacy of conventional Cooperation Agreements (Perjanjian Kerja Sama/PKS) and Non-Disclosure Agreements (NDA). Based on interviews with three vendors and an analysis of the contract documents they provided, these existing instruments are limited to confidentiality provisions and fail to accommodate compliance clauses in accordance with Law Number 27 of 2022 concerning Personal Data Protection (UU PDP), such as purpose limitation, mandatory notification of personal data protection failures, cyber compliance audit rights, and indemnification clauses. This research aims to address two main issues: first, how aligned the application development and data exchange mechanisms in Polri's digital service ecosystem are with the UU PDP, and what this implies for the allocation of legal liability between Polri as the Personal Data Controller and private vendors as Personal Data Processors within the police data-sharing scheme; and second, how an ideal Data Sharing Agreement (DSA) clause formulation should be structured to ensure compliance with the UU PDP. Employing a normative juridical research method through statutory and conceptual approaches, both issues are analyzed comprehensively. The results of this research formulate a standardized and binding Data Sharing Agreement (DSA) to ensure legal certainty, mitigate legal liability and reputational risks for Polri as an institution, and provide optimal protection of the privacy rights of the public as data subjects.