UU PDP (Law No. 27 of 2022 on Personal Data Protection (Indonesia)) — Definition & Context in B2B Laptop Rental

Indonesia's personal data protection law, enacted 17 October 2022 with a two-year transition period through October 2024. UU PDP requires every data controller that processes personal data of Indonesian citizens to: implement data protection from the design stage (privacy by design), appoint a DPO (Data Protection Officer) if processing data at large scale or in sensitive categories, obtain explicit consent from data subjects, and report data breaches within 14 × 24 hours to the supervisory authority and affected data subjects. Penalties: maximum 6 years imprisonment and/or IDR 6 billion fine for serious violations (sensitive data categories), IDR 5 billion for other violations. Corporate laptops storing employee, customer, or partner personal data fall within UU PDP scope — mandatory encryption, access control, and documented data sanitization procedures at unit return are required.