Medical data privacy in Indonesia: what the law says

What the law says

How Indonesia treats your health data.

The law: Law No. 27 of 2022 on Personal Data Protection (UU PDP)[S100]
The regulator: Personal Data Protection agency created by the law, reported in 2026 as still being formed[S100][S102]
Health data: Health data and information is specific personal data under Article 4(2), covering records of physical and mental health and of health services.[S100][S103]
Sending it abroad: Article 56 allows transfers to countries with equal or higher protection; where that is missing, to recipients with adequate binding safeguards; and where both are missing, with your consent.[S100][S101]
Medical records: Every health facility has had to keep electronic medical records since 31 December 2023, under Minister of Health Regulation 24 of 2022.[S103]
EU adequacy: No. Indonesia is absent from the European Commission's adequacy list, so an EU organisation sending data there needs other safeguards.[S77]
If there is a breach: Within 3 × 24 hours, in writing, to you and to the agency (Article 46).[S100]
Fines: Administrative fines of up to 2% of annual revenue (Article 57), alongside criminal penalties.[S100][S101]

Sending your records

The law protects the clinic’s copy. How it gets there is up to you.

Email and messaging apps leave a readable copy on every server they pass through, in Indonesia and at home. The safest file is the one that stays encrypted on your own phone, shown to the doctor in the room or sent by a link that expires by itself.

Try the free privacy check

Questions

Indonesia: common questions.

Is it safe to email medical records to a clinic in Indonesia?

Email is protected between mail servers only when both providers support TLS, and it stays readable on each server afterwards. Once your records reach a clinic in Indonesia, local law applies: health data and information is specific personal data under Article 4(2), covering records of physical and mental health and of health services. For a full history, use a channel where you hold the key, such as a link that expires by itself.

How does Indonesia protect health data?

Health data and information is specific personal data under Article 4(2), covering records of physical and mental health and of health services. Breaches must be reported within 3 × 24 hours, in writing, to you and to the agency (Article 46). The regulator is the Personal Data Protection agency created by the law, reported in 2026 as still being formed.

Can a clinic in Indonesia send my medical records abroad?

Article 56 allows transfers to countries with equal or higher protection; where that is missing, to recipients with adequate binding safeguards; and where both are missing, with your consent. Every health facility has had to keep electronic medical records since 31 December 2023, under Minister of Health Regulation 24 of 2022.

Keep reading

More on Indonesia, and elsewhere.

Sources are numbered in the text and listed in full in the reference list.

Medical data privacy in Indonesia.