Based on the PDP Law,  processing of personal data includes:

1. obtaining and collection;
2. processing and analyzing;
3. storing;
4. correction and updates;
5. displaying, announcing, transferring / transmitting, distributing or disclosure / providing access to; and / or
6. deletion or removal.

The PDP Law further mandates that personal data controllers are required to record all processing activities, which will commonly be referred to as the Records of Processing Activities (“ROPA”). There is no model template published by the relevant authority yet. However, some associations such as the Indonesian Association of Personal Data Protection Practitioners (Asosiasi Praktisi Pelindungan Data Pribadi Indonesia (APPDI)), the Indonesian Employers' Association (Asosiasi Pengusaha Indonesia (APINDO)), and the ISACA Indonesia Chapter, have collaborated in creating a ROPA template which may in the meantime serve as a guideline for personal data controllers to ensure compliance with their obligations under the PDP Law.

With the enactment of the PDP Law, the lawfulness of processing personal data has been extended and is largely similar with the GDPR, which is currently as follows:

• consent: the data subject has given explicit consent to the processing of his / her personal data for one or more specific purposes as have been conveyed by the data controller to the data subject;
• contractual obligation: processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject upon entering into a contract;
• legal obligation: processing is necessary for compliance with a legal obligation to which the controller is subject;
• vital interest: processing is necessary in order to protect the vital interests of the data subject ("vital interest of the data subject" relates to the survival of the data subject such as when the processing is necessary for serious medical treatment);
• public interest: processing is necessary for the performance of a task carried out in the public interest, public service or the exercise of official authority vested in the data controller in accordance with prevailing laws and regulations; and / or
• legitimate interest: processing is necessary for the purposes of other legitimate interests with due regard to the purpose, needs and balance of interest of rights of the data controller and the data subject.

The current Draft Implementing Regulation to PDP Law (version of August 31st, 2023) suggests some further guidance containing the criteria and / or restrictions with regard to each lawful basis.

The PDP Law also re-emphasizes the principles of personal data protection that are set out in the General Data Protection Regulations, which include:

• personal data collection shall be conducted in a limited and specific manner, and be legally valid and transparent;
• personal data processing shall be conducted in accordance with its purpose;
• personal data processing shall be conducted by guaranteeing the rights of the personal data subject (such as the right to be informed, right to rectification, right of access, right to erasure, right to withdraw consent, right to object to automated decision, right to restrict processing and right to data portability);
• personal data processing shall be conducted accurately, completely, not misleading, up to date, can be accounted for, and by taking into account the purpose of processing of the personal data;
• personal data processing shall be conducted by protecting the security of personal data from loss, misuse, unauthorized access and disclosure, as well as the alteration or destruction of personal data;
• personal data processing shall be conducted by notifying the purpose of collection, processing activities, and failure of personal data protection;
• personal data processing shall be destroyed and / or deleted except if it is still in the retention period in accordance with the necessity based on the laws and regulations; and
• processing of personal data shall be carried out responsibly and shall be verifiable in a clear manner.

There are, however, partial exemptions for some provisions in the PDP Law, mostly with regard to a data subject's rights and data controller’s obligations in relation to the application of a data subject’s rights (such as: rectification, providing access, maintaining confidentiality, termination, erasure, destruction, breach notification), which can be deviated from if the purpose of the data processing is: 

1. for the interests of national defence and security;
2. for the interest of law enforcement processes (such as investigation or prosecution);
3. for the public interest in the context of state administration (citizenship administration, social security, taxation, customs and e-licensing); 
4. for the interests of supervision of the financial services sector, monetary sector, payment system sector, and financial system stability sector (namely those that fall under the supervision of the Indonesian Central Bank / BI, the Indonesian Finansial Services Authority / OJK, and Indonesia's Deposit Insurance Agency / LPS); or
5. for statistical purposes and scientific research,

and provided that those exemptions are only undertaken in the framework of implementing a law / legislative requirement.