The PDP Law and Customer Data: What an Indonesian Business Site Needs

Indonesia's Personal Data Protection law governs how businesses may collect and use people's data. This piece covers the basic obligations for an ordinary business site, in plain language.

One note first: this is a practical explanation from the perspective of people who build sites, not legal advice. For complicated cases — health data, children's data, or data sent abroad — ask a lawyer.

Four basics#

1. State what you collect and why#

This is what a privacy page is for. Not a copied template, but a list that genuinely matches your site: what is collected, why, how long it is kept, and who else can see it.

If you use a third-party analytics tool, that belongs on the list.

2. Ask before setting tracking cookies#

This is the most commonly skipped. Cookies needed for the site to work — remembering a language choice, say — need no consent. Cookies used to follow visitor behaviour do.

The distinction is not the tool's name but whether it can recognise the same person on a later visit.

3. Provide a way to withdraw consent#

Consent that cannot be revoked is not consent. There has to be somewhere on your site where people can change their decision, and withdrawing must be as easy as giving.

4. Keep only what you need#

Data you never store cannot leak. If your contact form does not need a date of birth, do not ask for one.

What usually goes wrong on small business sites#

A copy-pasted privacy page. Many describe practices the site does not follow, or fail to mention tools it genuinely uses. Both are problems; the second is more serious.

A cookie banner that does not actually block. It is common to find a banner that appears while the tracking script has already run before any button is pressed. Then the banner is decoration.

No way to change the decision. Once "accept" is pressed, there is no route back.

What this site does#

Openly, as an example: this site uses Microsoft Clarity to see which parts confuse visitors. Clarity sets cookies and records pointer movement, so its script is not loaded at all until a visitor allows it. That decision can be changed at any time on the privacy page.

Ordinary visit counting done at the network layer uses no cookies and cannot recognise the same person, so it runs without consent.