Article 40 Indonesian Data Protection Law 2020

Notification in the event of failure of protection of personal data

(1) In the event of any failure of personal Data protection, the personal Data controller is obliged to provide notice in writing at least 3 x 24 (three times twenty Four) hours to:
a. Personal Data owner; Dan
b. Minister.
(2) Written notice as referred to in paragraph (1) concerning:

a. Personal Data disclosed;
b. When and how the personal Data is revealed; Dan
c. Remedies and remedies for the disclosure of personal data by the personal Data controller.
(3) In certain cases, the personal Data controller must notify the public about the failure of the personal Data protection.