UKOMNAS PDPA common mistakes
UKOMNAS PDPA · Understand the traps and how to avoid them.
Treating the UU PDP as if it were the GDPR: answering questions about lawful bases, DPO appointment thresholds, or breach notification deadlines from memory of EU rules rather than from the Indonesian statute.
Most English-language study material available online is GDPR-oriented, and candidates often prepare from generic privacy courses. They then default to GDPR concepts (e.g., 'legitimate interest' as a standalone basis, 72-hour notification, mandatory DPO for all public bodies) that do not map cleanly onto UU No. 27/2022.
What to do instead
Rebuild a one-page comparison table from the actual statute: enumerate the lawful bases under Article 20, the DPO triggers under Article 53, and the notification timing under Article 46. For every practice question, ask 'which instrument is this testing?' before selecting an answer. Deliberately drill the places where GDPR intuition gives the wrong answer.
Confusing the roles of Controller (Pengendali Data Pribadi), Processor (Prosesor Data Pribadi), and the data subject when attributing obligations, and answering that the processor bears primary accountability for a breach or for responding to rights requests.
Candidates learn the definitions but not the allocation of duties. Because processors perform the operational work, it feels intuitive that they carry the operational obligation. Candidates also overlook that the controller remains accountable even when processing is outsourced.
What to do instead
For each obligation in the statute (notification, rights fulfilment, DPIA, record-keeping), write 'who owes this duty?' next to it. Practice by sketching a three-column table: controller duty, processor duty, joint/contractual duty. Test yourself with scenario stems where a vendor suffers the breach and confirm the controller still notifies.
Treating consent as the default or only lawful basis, and accepting vague, bundled, or implied consent as valid - for example, approving a scenario where consent is buried in general terms and conditions or inferred from silence.
Consent is the most familiar concept and is over-represented in training materials. Candidates also carry over a 'notice plus continued use equals consent' habit from consumer software, which conflicts with the requirement for explicit, specific, informed consent in Indonesian law.
What to do instead
Memorise the consent validity elements and apply a checklist to every consent scenario: freely given, specific, explicit where required, informed, and withdrawable as easily as given. Practise identifying the correct alternative basis when consent is invalid or unavailable (e.g., contract performance, legal obligation, vital interests).
Answering data subject rights questions with a generic 'reasonable time' or GDPR-derived one-month deadline instead of the statutory response period, and missing that some rights are qualified or subject to exceptions.
Candidates memorise the list of rights but not the procedural mechanics - timelines, format of response, grounds for refusal, and extension conditions. Under exam pressure they substitute the familiar GDPR figure.
What to do instead
Build a rights matrix: right, statutory basis, response timeline, permitted refusal grounds, and any extension rule. Include the interaction with other laws (e.g., sectoral retention obligations) that can lawfully limit a request. Rehearse with short scenario stems that hinge on the deadline or on a valid exception.
Skipping or misplacing the DPIA: answering that a DPIA is required for every processing activity, or conversely that it is optional and can be replaced by a generic privacy notice.
Candidates know DPIA exists but not its trigger conditions, its position before processing begins, and its relationship to consultation with the supervisory authority. The absence of a crisp threshold in memory leads to all-or-nothing answers.
What to do instead
Learn the high-risk triggers and the sequence: identify processing, screen for high risk, conduct assessment, consult where residual high risk remains, document and review. Practise classifying ten short processing descriptions as 'DPIA required / not required' and justify each in one sentence.
Treating security as a checklist of named technologies (encryption, firewall, pseudonymisation) rather than a risk-based obligation, and selecting 'implement all technical measures' as the safe answer.
Security questions reward specificity, so candidates reach for technology names. But the statute imposes a proportionality and risk-assessment duty, and exam distractors often include over-broad or contextually inappropriate measures that a risk-based reading would reject.
What to do instead
Frame every security answer around the risk assessment first: nature of data, sensitivity, scale, likelihood and severity of harm, then proportionate technical and organisational measures. Practise rejecting 'one-size-fits-all' options and choosing the measure matched to the stated risk profile.
Handling breach scenarios by notifying everyone immediately - the supervisory authority, all data subjects, and the media - without assessing the risk of harm or the statutory notification conditions and recipients.
Candidates conflate 'transparency is good' with the legal test. They also import the GDPR 72-hour reflex and forget that the content and audience of notification depend on the assessed risk to data subjects.
What to do instead
Learn a fixed incident sequence: detect, contain, assess risk of harm, decide who must be notified and within what period, notify with prescribed content, document the incident regardless, then remediate. Drill scenarios that differ only in severity and confirm your notification decision changes accordingly.
Assuming personal data may not leave Indonesia at all, or that a transfer is lawful simply because the recipient is contractually bound, without working through the statutory transfer conditions in order.
Cross-border transfer rules are layered and conditional, and candidates often remember only the headline restriction. They then either over-restrict (answer 'prohibited') or under-analyse (answer 'contract is enough') rather than applying the sequence of conditions and the adequacy assessment.
What to do instead
Write the transfer conditions as an ordered decision tree and memorise the order. For each branch, note what evidence is needed (adequacy finding, appropriate safeguards, consent or contract necessity). Practise with scenarios where the first condition fails and a later one must be examined.
Describing the DPO role as the sole owner of compliance, or as a purely technical IT security function, and answering that the DPO personally decides processing purposes or signs off business decisions.
Organisational roles are taught loosely, and candidates merge the DPO with the CISO, the legal counsel, or the controller's management. The independence and advisory nature of the role, and its monitoring versus decision-making distinction, get lost.
What to do instead
Learn the DPO mandate as a set of verbs: inform, advise, monitor, cooperate with the authority, act as contact point. Contrast this with the controller's decision-making duties. Practise questions that ask 'who decides?' and 'who monitors?' and confirm the DPO advises and monitors but does not decide the purposes of processing.
Approving audit and accountability answers that stop at 'document the policy' - omitting records of processing, evidence of training, review cycles, and the demonstration burden that accountability imposes.
Candidates equate compliance with having written documents. They miss that accountability requires demonstrable, current evidence and continuous monitoring, and that a stale or unimplemented policy is a finding, not a control.
What to do instead
For each governance topic, list the artefact plus the evidence of operation: policy plus training records, RoPA plus review dates, DPIA plus sign-off and re-assessment trigger. Practise writing findings in audit format - criterion, condition, cause, effect, recommendation - so accountability is framed as demonstrable evidence.