Indonesia court upholds data law penalties, raising alarms over press freedom and public access

Indonesia’s Constitutional Court of Indonesia has upheld the most contentious criminal provisions of the country’s Personal Data Protection Law (PDP Law), a move that has prompted strong criticism from journalists’ groups and civil society organisations, who warn that the ruling could have far-reaching consequences for freedom of expression, public oversight, and ordinary citizens’ access to information.

In its decision issued on 19 January 2026, the Court rejected in full Judicial Review Petition No. 135/PUU-XXIII/2025, which challenged Article 65(2) and Article 67(2) of Law No. 27 of 2022 on Personal Data Protection.

The petition was filed by the Advocacy Team for Freedom of Information and Personal Data (SIKAP), a coalition that includes the Alliance of Independent Journalists Indonesia (AJI), the Press Legal Aid Institute (LBH Pers), ELSAM, SAFEnet, and representatives from academic and arts communities.

What the PDP Law Regulates

The PDP Law is Indonesia’s first comprehensive data protection framework, intended to safeguard citizens’ right to privacy in the digital era.

It regulates the collection, processing, storage, use, and disclosure of personal data by individuals, private companies, state institutions, and foreign entities handling Indonesians’ data, even if they operate outside the country.

The law distinguishes between general personal data, such as names, addresses, dates of birth, and identity numbers, and specific personal data, which includes health information, biometric and genetic data, financial records, criminal histories, and children’s data.

Personal data controllers and processors must have a lawful basis for processing, comply with principles such as purpose limitation and data minimisation, and ensure data security.

In theory, the law aligns Indonesia with global data protection standards. In practice, critics argue that its criminal provisions are insufficiently precise and lack safeguards for public-interest activities.

Criminal Sanctions at the Centre of the Dispute

Article 65(2) of the PDP Law states that any person is prohibited from unlawfully disclosing personal data that does not belong to them. Article 67(2) imposes criminal penalties for violations, including imprisonment of up to four years and/or a fine of up to Rp4 billion, or roughly US$235,000 at the current exchange rate of Rp17,000 per US dollar.

Crucially, the law does not explicitly define what constitutes “unlawful” disclosure in contexts such as journalism, academic research, whistle-blowing, or artistic expression. Nor does it provide explicit exemptions for disclosures made in the public interest.

According to SIKAP, this legal ambiguity gives law enforcement wide discretion and creates the risk of selective or arbitrary prosecution.

AJI: A Direct Threat to the Public’s Right to Know

In its press release following the ruling, AJI said the Constitutional Court had failed to recognise the public’s right to information as an inseparable part of human rights.

 The organisation argued that the Court missed an opportunity to provide a proportional interpretation of the law that would balance privacy protection with freedom of expression.

“By rejecting the petition in its entirety, the Court has chosen to preserve criminal provisions that are vague and elastic,” AJI said.

“These provisions can easily be used to silence journalistic work, academic research, artistic expression, and the public’s right to know.”

AJI stressed that the petitioners were not seeking to weaken personal data protection. Instead, they asked the Court to clarify the scope of the law so that it could not be misused to criminalise legitimate reporting or public-interest disclosures.

Similar jurisprudence in other countries, AJI noted, has affirmed that the right to privacy cannot be used to conceal information that directly affects the public interest.

Implications for Journalists and Citizens

Journalists’ groups warn that investigative reporting in Indonesia frequently involves publishing personal data, such as names, financial links, or official communications, particularly in cases involving corruption, abuse of power, or conflicts of interest. Without clear exemptions, reporters may face criminal exposure even when acting in good faith and in the public interest.

The concern extends beyond the media. Legal experts say activists, researchers, whistle-blowers, and ordinary citizens could also be affected. Sharing documents, photographs, or identities on social media—common practices in exposing wrongdoing—could potentially fall foul of the law.

Low public literacy around data protection further heightens the risk. Many Indonesians may not fully understand what constitutes personal data under the law, increasing the likelihood of inadvertent violations.

Government’s Position

The government has repeatedly denied that the PDP Law threatens press freedom.

During earlier hearings, Alexander Sabar, Director General of Digital Space Supervision at the Ministry of Communication and Digital Affairs, argued that the criminal provisions are intended to ensure accountability in personal data processing, not to restrict journalism or academic work.

He said disclosures remain lawful if they comply with data protection principles and have a legal basis under the PDP Law, and that existing laws—such as the Press Law and the Public Information Disclosure Law—continue to protect journalistic activities.

Long-Standing Drafting Criticisms

Legal scholars have also criticised the PDP Law’s drafting process and substance.

Concerns include the omission of certain sensitive data categories, such as sexual orientation and political views, from the definition of specific personal data, and unclear enforcement mechanisms for foreign entities.

Civil society groups have also pointed to Indonesia’s past use of other digital laws, particularly the Electronic Information and Transactions (ITE) Law, to prosecute journalists and activists, arguing that this history amplifies fears of misuse.

A Defining Moment for Digital Rights

With the Constitutional Court’s ruling now final, the interpretation and enforcement of the PDP Law will largely be left to lawmakers and law enforcement agencies.

For citizens, the law promises stronger privacy protection, but also introduces significant legal uncertainty over what information can be disclosed, shared, or reported.

AJI warned that without clearer safeguards, personal data protection risks becoming a pretext to restrict criticism and erode democratic space.

“This decision places freedom of expression and the public’s right to information in an increasingly vulnerable position,” the organisation said, calling on the government and parliament to urgently review and clarify the law to prevent abuse.