Data Protection Officer under UU PDP: When You Must Appoint One

UU PDP does not require every organization to appoint a Data Protection Officer. Article 53 sets three conditions, and appointment becomes mandatory for a data controller or processor if any one of them applies.

The first is processing personal data for the purposes of public services. The second is where the core activity of the controller has a nature, scope or purpose that requires regular and systematic monitoring of personal data on a large scale. The third is where the core activity consists of large-scale processing of specific personal data, or personal data relating to criminal offences.

Read carefully, these triggers catch more Indonesian organizations than people assume. Any government body or agency delivering public services falls within the first. A bank, insurer, telco or health provider processing at scale will usually fall within the second or third, because financial data, health data and biometric data are all classified as specific personal data.

The law uses the phrase pejabat atau petugas yang melaksanakan fungsi Pelindungan Data Pribadi, meaning an officer or official performing the personal data protection function. In practice, Indonesian organizations and the market call this role the DPO, borrowing the GDPR term.

One caution worth noting for anyone searching in Indonesian: the abbreviation DPO is heavily overloaded in Bahasa Indonesia and most commonly refers to Daftar Pencarian Orang, the police wanted-persons list. When writing internal policy or job descriptions, spelling out the full function avoids genuine confusion.

The naming matters less than the substance. What the supervisory authority will look for is whether the function exists, whether the person performing it is competent, and whether they have the standing to raise problems.

Article 53 requires that the person is appointed on the basis of professionalism, knowledge of law and personal data protection practice, and the ability to carry out their duties. This is a competency requirement, not a formality that can be met by adding a line to an existing job description.

In smaller organizations the function is often combined with an existing compliance, legal or information security role. That is workable, provided the person genuinely has the knowledge and the time. The failure mode to avoid is appointing someone nominally, with no budget, no authority and no route to the board.

A recurring practical problem is conflict of interest. A DPO function sitting inside the team that owns the largest personal data processing activity will struggle to challenge it. Reporting lines should allow the function to escalate independently.

The core duties centre on informing and advising the organization on its obligations, monitoring compliance with the law and with internal policy, advising on data protection impact assessments, and acting as the contact point for both data subjects and the supervisory authority.

In day-to-day terms, this means maintaining a view of what personal data the organization holds and why, reviewing new processing activities before they launch, handling data subject requests, and coordinating breach notification within the 3x24 hour window UU PDP sets.

Breach notification is where the role is most exposed. A DPO who has not rehearsed the notification path, or who cannot get incident facts quickly from the security team, will not meet the deadline. The function only works if it is wired into incident response, not bolted alongside it.

The gap most Indonesian organizations hit is not appointing the DPO, it is giving that person anything to work with. A DPO cannot demonstrate that staff handle personal data correctly without training records, and cannot demonstrate that the workforce is resilient to social engineering without measurement.

Awareness evidence is one of the most frequently requested artefacts in a data protection review, because it is one of the few controls that produces a measurable, per-person trail. Completion rates alone are weak evidence. Behavioural measurement, such as phishing simulation results trended over time and broken down by department, is considerably stronger.

Claro gives the data protection function that evidence directly: bilingual awareness training and phishing simulation with per-user risk scoring, department-level reporting, and exports mapped to UU PDP, OJK and ISO 27001 expectations.