September 2025
On 30 July 2025, the Constitutional Court issued a ruling that clarified the interpretation of Article 53 paragraph (1) of Law No. 27 of 2022 on Personal Data Protection (“PDP Law”) through Constitutional Court Decision No. 151/PUU-XXII/2024, which became effective on the same date. The Constitutional Court provided guidance to support the proper understanding and application of the threshold criteria for data controllers and data processors in appointing a Personal Data Protection Officer (DPO).
The judgment was rendered following an application for a constitutional review of Article 53 paragraph (1) of the PDP Law. The applicants challenged the use of the conjunction “and” contained in the article, arguing that it created cumulative conditions for appointing a DPO, which could undermine the protection of personal data.