Between Trade and Trust: Rethinking Indonesia–US Cross-Border Personal Data Transfer

Indonesia’s recent decision to recognise the United States as an adequate jurisdiction for personal data protection – made under a new bilateral trade deal – permits the transfer of Indonesian personal data to US private entities without additional safeguards. This move, taken before Indonesia’s Personal Data Protection Authority (PDPA) is established and before adequacy criteria are formally defined, raises concerns over legal legitimacy and data governance. Given persistent systemic risks in the US – ranging from corporate misuse and cybersecurity vulnerabilities to expansive surveillance powers and fragmented privacy laws – the decision appears premature. To safeguard privacy while supporting trade interests, Indonesia should complete its domestic data protection framework, clarify adequacy criteria, and temporarily recalibrate its adequacy determination until more robust bilateral governance mechanisms are in place.