Amelia Sabrina
Policy Analyst at the National Institute of Public Administration Republic of Indonesia
Fellow of the Salzburg Global Asia Pacific Leadership Forum and Indonesia School of Internet Governance (ID SIG)
\
On the 20th of February, President Prabowo Subianto and Donald Trump signed the Agreement on Reciprocal Trade (ART) between Indonesia and the United States. Among its provisions is Article 3.2 on Data Transfers, which states that Indonesia will allow cross-border personal data transfers to the US and acknowledges the US as an adequate jurisdiction for Indonesian consumers’ data protection.
When personal data is stored and managed across borders and/or by foreign entities, it enters a different legal world. The adequacy principle means that protection standards are at least the same as those in other countries.
While cross-border data transfers between Indonesian consumers and US companies may already be occurring without the emphasis and protections afforded by the clause, the adequacy agreement under the ART is unlikely to change the situation.
Digital sovereignty does not always mean that we have to localise personal data in our own jurisdictions or control over digital infrastructure; what matters is the agency and leverage to enforce data protection even when the data resides abroad.
Indonesia, with its current limited enforcement capacity, risks becoming only a data supplier rather than a rule-shaper. If not addressed, this situation might threaten our digital sovereignty.
We are encountering significant challenges and risks. Indonesia has yet to fully operationalise its Personal Data Protection (PDP) Law, making the procedures and standards of “adequacy” uncertain. Even this situation is already delayed by a year beyond the transition period mandated in the bill.
Additionally, the contrasting landscape of privacy policies in the US may further complicate the future of adequate data protection. Unlike the EU, the US has a quite fragmented landscape when it comes to privacy policies, leading to variations in data protection oversight. The federal law applies to only a few domains, while each state may have a different level of data protection.
While ensuring adequate data protection in cross-border personal data transfers to the US is challenging, it is not entirely impossible. An example of this is the EU-US cross-border data transfer policy, which utilises the latest Data Protection Framework.
It’s important to note that Indonesia’s PDP Law is similar to the European Union’s General Data Protection Regulation (GDPR), though it currently lacks the same level of maturity and enforcement tools. Therefore, if the PDP Law and/or this adequacy data protection becomes operational, it is crucial to prioritise institutional readiness.
The timing of the cross-border data transfer agreement with the US for Indonesia is also striking. This development comes at a time when the debate of digital sovereignty is gaining increasing attention around the world.
As digital infrastructure and AI development become concentrated in a few powerful technology ecosystems, many countries are reconsidering how much control they actually have over their data. As a result, several governments are taking steps to reduce reliance on foreign technology platforms and strengthen their own digital ecosystems.
Just this January, the French government announced that it will drop Microsoft Teams and Zoom from its government activities, citing growing concerns over data privacy, security, and dependence on foreign platforms. It was one of several cases of a broad trend emerging across Europe, with several countries actively seeking to reduce their reliance on technology services from US-based companies, driven by a desire to enhance data sovereignty and support local tech solutions.
Indonesia and Vietnam are also exploring data localisation measures to strengthen regulatory control and digital sovereignty; this recognition of US data protection adequacy in the ART appears to pull in a different direction.
This dynamic is further complicated by the broader direction of US policy, which tends to prioritise innovation and the free flow of data over restrictive regulation. The United States has recently pushed against digital sovereignty initiatives in foreign countries related to personal data processing, especially in AI. Reports indicate that the Trump administration has ordered diplomats to resist ‘burdensome’ regulations by foreign countries that govern how American technology companies manage foreign users’ data.
Taken together, these developments reflect a more assertive stance by the Trump administration at a time when many countries are seeking stronger oversight of how US companies collect, process, and store their citizens’ personal information.
To understand what is at stake when we talk about digital sovereignty, we must acknowledge the structural imbalance in today’s digital ecosystem. No country or even region currently matches the combined technological and financial weight of the US and China in frontier AI development. As of May 2025, the United States accounts for roughly 75 per cent of global GPU cluster performance, followed by China’s at 15 per cent. Advanced semiconductor design, hyperscale cloud infrastructure, and frontier AI models remain concentrated in a handful of companies headquartered in those two powers.
This asymmetry matters because data does not float in a vacuum. When Indonesian personal data is processed through global cloud infrastructure, many of which are operated by US firms, it becomes embedded in systems governed by foreign jurisdictions, compliance standards, and strategic priorities.
The ART promises that Indonesian consumers’ data will receive equivalent treatment. But equal treatment on paper is not the same as equal power in practice. Enforcement mechanisms and regulatory interpretation will ultimately depend on US institutional frameworks.
Balancing trade, innovation, and data protection is not optional; it is strategic. Indonesia needs digital trade to grow its economy and must embrace openness to remain competitive, including in exercising digital sovereignty.
But, are we actually in control? At this moment, the answer is uncomfortable.
The ART should therefore be seen as a wake-up call. Before expanding cross-border commitments, Indonesia must urgently strengthen its own foundations: fully operationalise the PDP Law, empower an independent, well-resourced data protection authority, build technical capacity to audit cross-border data transfers, and ensure transparency in dispute-resolution mechanisms. The agency in our digital sovereignty requires the ability not only to sign agreements but also to shape, monitor, and, if necessary, contest how those agreements are implemented.
Without these, the promise of adequate data protection remains largely aspirational both within jurisdictions and abroad, especially the ART.
Обовʼязково поділіться своїми думками з автором, залишивши коментар нижче
Увійдіть або зареєструйтеся, щоб продовжити розмову