Privacy and Data Protection Governance for Implementing Indonesia’s Personal Data Protection Law (Law No. 27/2022): A Structured Literature Review

Deni Sulaeman; Ferri Fatra; M. Galih Fikran Syah; Ilman Manarul Qori; Muharman Lubis

doi:10.62123/enigma.v4i1.188

Privacy and Data Protection Governance for Implementing Indonesia’s Personal Data Protection Law (Law No. 27/2022): A Structured Literature Review

Authors

Deni Sulaeman Information System, School of Industrial and System Engineering, Telkom University, Indonesia
Ferri Fatra Telkom University
M. Galih Fikran Syah Telkom University
Ilman Manarul Qori Telkom University
Muharman Lubis Telkom University

DOI:

https://doi.org/10.62123/enigma.v4i1.188

Keywords:

Data Governance, Personal Data Protection, Privacy Compliance, Privacy Governance, Regulatory Compliance

Abstract

Indonesia’s Law No. 27 of 2022 on Personal Data Protection (PDP Law) imposes extensive duties on controllers and processors, yet organizational governance for implementation remains unevenly documented. This structured literature review, informed by PRISMA reporting principles, synthesizes 23 governance-focused peer-reviewed publications (2022–2026) identified through a transparent purposive corpus strategy. No multi-database search was conducted in this study. Implementation is influenced by legal certainty, institutional accountability (including supervisory officer models), sector capacity, third-party ecosystem risk, rights interoperability, measurable compliance tools, and automated decision-making challenges. Privacy governance (74%), audit and compliance assessment (48%), and integrated data governance (39%) are the most frequent components; data protection impact assessment is rarely explicit. Governance structures are portrayed as prerequisites for compliance where accountability, assessment instruments, and platform intermediaries align. A seven-layer implementation framework for the PDP Law is proposed. Limitations include the purposive corpus, limited Indonesian empirical evidence, and the absence of exhaustive database screening.

Downloads

Download data is not yet available.

References

[1] R. of Indonesia, Law No. 27 of 2022 on Personal Data Protection. State Gazette of the Republic of Indonesia, 2022.

[2] H. Ketmaneechairat, M. Maliyaem, and P. Pulawalanakul, “Towards a Management System Framework for the Integration of Personal Data Protection and Data Governance: A Case Study of Thai Laws and Practices,” International Journal of Technology, vol. 15, no. 1, 2024, doi: 10.14716/ijtech.v15i1.5885.

[3] R. Guay and K. Birch, “A Comparative Analysis of Data Governance: Socio-Technical Imaginaries of Digital Personal Data in the USA and EU,” Big Data Soc., 2022, doi: 10.1177/20539517221112925.

[4] S. Peng, “Public-Private Interactions in Privacy Governance Laws,” Laws, vol. 11, no. 6, p. 80, 2022, doi: 10.3390/laws11060080.

[5] M. R. Sanfilippo, N. Apthorpe, K. Brehm, and Y. Shvartzshnaider, “Privacy Governance Not Included: Analysis of Third Parties in Learning Management Systems,” Information and Learning Sciences, vol. 124, no. 9–10, pp. 326–348, 2023, doi: 10.1108/ILS-04-2023-0033.

[6] P. Chatsuwan, T. Phromma, N. Surasvadi, and S. Thajchayapong, “Personal Data Protection Compliance Assessment: A Privacy Policy Scoring Approach and Empirical Evidence from Thailand’s SMEs,” Heliyon, vol. 9, no. 10, p. e20648, 2023, doi: 10.1016/j.heliyon.2023.e20648.

[7] C. T. Di Iorio, E. Ronchi, I. Pristas, T. Buble, N. Nicholson, and F. Carinci, “Data Protection, Interoperability and Governance Assessment Tool: Results from a Proof-of-Concept Survey,” Front. Digit. Health, vol. 7, p. 1685774, 2025, doi: 10.3389/fdgth.2025.1685774.

[8] J. Wiwoho, U. K. Pati, and A. M. Pratama, “Enabling Data Portability and Interoperability under Indonesia’s Data Protection Law,” Masalah-Masalah Hukum, vol. 53, no. 3, pp. 271–282, 2024, doi: 10.14710/mmh.53.3.2024.271-282.

[9] M. Nebbiai, “Intermediaries Do Matter: Voluntary Standards and the Right to Data Portability,” Internet Policy Review, vol. 11, no. 2, 2022, doi: 10.14763/2022.2.1639.

[10] W. Yuspin, T. Rajput, A. B. Bal, K. Wardiono, and Absori, “The Regulations of the Supervisory Officer Personal Data Protection-Based Accountability Principle,” Bestuur, vol. 12, no. 1, 2024, doi: 10.20961/bestuur.v12i1.89742.

[11] C. Novelli, F. Casolari, P. Hacker, G. Spedicato, and L. Floridi, “Generative AI in EU Law: Liability, Privacy, Intellectual Property, and Cybersecurity,” Computer Law and Security Review, vol. 52, p. 106066, 2024, doi: 10.1016/j.clsr.2024.106066.

[12] B. Hohmann and G. Kollar, “Reflections on the Data Protection Compliance of AI Systems under the EU AI Act,” Cogent Soc. Sci., vol. 11, no. 1, 2025, doi: 10.1080/23311886.2025.2560654.

[13] S. Hariansah and L. Qhistina, “Toward Algorithmic Due Process: Constitutional Challenges and Human Rights Risks in Indonesia’s Digital State,” Jurnal Pembangunan Hukum Indonesia, vol. 8, no. 1, 2026, doi: 10.14710/jphi.v8i1.25-25.

[14] F. Fitriyanti, S. Devty, S. Putri, and R. E. Thora, “Securing Personal Data in E-KYC: Vital for Digital Economy Growth,” Diponegoro Law Review, vol. 9, no. 1, pp. 104–120, 2024, doi: 10.14710/dilrev.9.1.2024.104-120.

[15] I. Rahmatullah, P. Suwadi, and H. Purwadi, “Legal Reform of Zakat Management Based on Personal Data Protection Law in Indonesia,” Mazahib, vol. 23, no. 1, 2024, doi: 10.21093/mj.v23i1.5917.

[16] R. Ayunda, “Personal Data Protection to E-Commerce Consumer: What Are the Legal Challenges and Certainties?,” Law Reform, vol. 18, no. 2, 2022, doi: 10.14710/lr.v18i2.43307.

[17] D. Sulistyaningsih, M. Ihwan, A. Setiawan, and M. S. Prabowo, “Tata Kelola Perlindungan Data Pribadi di Era Metaverse,” Masalah-Masalah Hukum, vol. 52, no. 1, pp. 97–106, 2023, doi: 10.14710/mmh.52.1.2023.97-106.

[18] F. H. Firdaus, “Perlindungan dan Kepastian Hukum bagi Pengendali Data Pribadi di Masa Depan,” Masalah-Masalah Hukum, vol. 53, no. 2, pp. 135–144, 2024, doi: 10.14710/mmh.53.2.2024.135-144.

[19] E. Priliasari, “Perlindungan Data Pribadi Konsumen dalam Transaksi E-Commerce,” Jurnal Rechts Vinding, vol. 12, no. 2, 2023, doi: 10.33331/rechtsvinding.v12i2.1285.

[20] J. Duncan, “Data Protection beyond Data Rights: Governing Data Production through Collective Intermediaries,” Internet Policy Review, vol. 12, no. 3, 2023, doi: 10.14763/2023.3.1722.

[21] C. Peukert, S. Bechtold, M. Battikas, and T. Kretschmer, “Regulatory Spillovers and Data Governance: Evidence from the GDPR,” Marketing Science, 2022, doi: 10.1287/mksc.2021.1339.

[22] H. J. Pandit, “Making Sense of Solid for Data Governance and GDPR,” Information, vol. 14, no. 2, p. 114, 2023, doi: 10.3390/info14020114.

[23] J. Breuer, R. Heyman, and R. van Brakel, “Data Protection as Privilege: Factors to Increase Meaning of GDPR in Vulnerable Groups,” Frontiers in Sustainable Cities, vol. 4, p. 977623, 2022, doi: 10.3389/frsc.2022.977623.

[24] J. Kramer, “The Death of Privacy Policies: How App Stores Shape GDPR Compliance of Apps,” Internet Policy Review, vol. 13, no. 2, 2024, doi: 10.14763/2024.2.1757.

[25] M. J. Page et al., “The PRISMA 2020 statement: An updated guideline for reporting systematic reviews,” BMJ, vol. 372, 2021, doi: 10.1136/bmj.n71.

Downloads

Published

2026-10-31

How to Cite

Deni Sulaeman, Fatra, F., Syah, M. G. F., Qori, I. M., & Lubis, M. (2026). Privacy and Data Protection Governance for Implementing Indonesia’s Personal Data Protection Law (Law No. 27/2022): A Structured Literature Review. Electronic Integrated Computer Algorithm Journal, 4(1), 8–17. https://doi.org/10.62123/enigma.v4i1.188