On 30 September 2026, Transport Minister Dudy Purwagandhi told DPR Commission V that the government accepted a DPR proposal in the third amendment to Indonesia's Traffic and Road Transport Law (UU LLAJ, Law 22/2009). The proposal would regulate steering-system technology and autonomous vehicle (AV) development, alongside vehicle categories and power sources. The minister said he hopes to finish in 2026 so the law can apply from 2027. The reporting we reviewed on the revision does not mention data provisions. That silence matters, because a vehicle with automated driving is also a mobile sensor platform.
What the bill is, and is not, doing
The case for putting AVs into the traffic statute is strong. Law 22/2009 predates automated driving, and a statute that is silent on who is responsible when no human steers invites either legal uncertainty or ad hoc ministerial permits. IDX Channel reports that Commission V and the government began deliberating the bill on 30 September 2026, and quotes a member saying autonomous vehicles "perlu pengaturan di masa yang akan datang" (need regulation in future). The same report's detailed areas of concern are accident statistics, road funds, online-transport taxation and electronic enforcement (ETLE). Data governance is not among them.
That is understandable. A traffic law is built around licensing, vehicle standards and liability. But AV operation continuously produces camera imagery, location traces, and sensor logs that can identify drivers, passengers and pedestrians. Nothing in the reporting suggests the bill will say who owns or may access that data, how long it is retained, or when it may leave Indonesia. By default, those questions fall to the Personal Data Protection Law.
The default regime: Law 27/2022
The PDP Law was enacted on 17 October 2022. Its cross-border rule, Article 56, is a tiered test. A controller may transfer data abroad if the destination country offers equal or higher protection. If not, the controller must ensure adequate and binding protection. If neither holds, it needs the data subject's consent. A summary of the Constitutional Court record sets out those same three paragraphs.
The strongest argument for leaving it there is that a technology-neutral data law should govern all sectors consistently. Sector-specific data rules fragment compliance, and a premature AV data code could freeze today's architecture into law. That argument has real force.
It weakens, though, once you look at how much of Article 56 is still unbuilt. On 19 January 2026 the Constitutional Court, in Case 137/PUU-XXIII/2025, rejected a challenge to Article 56, rejecting all four counts. The challenge was filed on 26 August 2025 against the backdrop of the US-Indonesia trade framework. The ruling gives certainty that the tiered design is constitutional. It does not supply the machinery to apply it.
Three gaps that an AV law will expose
No authority to assess adequacy. Commentary on the ruling in Conflict of Laws notes that the data protection authority has not yet been established or designated, though the Court stressed its role under Articles 58-61. Rajah & Tann reported in March 2026 that a draft presidential regulation to create it was awaiting presidential approval. I could not confirm whether that has since happened, and readers should check its current status.
No published transfer rulebook. The same commentary says detailed rules, such as which jurisdictions count as adequate, standard contractual terms, and treatment of pseudonymisation and encryption, still await implementing regulations. An AV manufacturer sending fleet telemetry to an overseas cloud for model training today cannot know which tier it is in.
Ambiguity over who is covered. Article 56 speaks of "controllers." The commentary flags that it is unclear whether processors, which is how many AV software vendors and cloud providers would be classed, may transfer data under it. In the AV supply chain, that is the central question rather than an edge case.
What a proportionate response looks like
The pro-innovation instinct is not to bolt on data localisation. Forcing every AV sensor log to stay onshore would raise costs, discourage the fleets and mapping services that Indonesian cities most need, and would add little privacy value if the underlying adequacy machinery still does not exist. Evidence from other regimes is that blunt localisation mostly taxes small entrants.
A better design has three parts, none requiring the traffic law to duplicate the PDP Law:
- Cross-reference, do not reinvent. The revised UU LLAJ should state that data generated by automated driving systems is personal data where it identifies a person, and is governed by Law 27/2022. That removes a litigation argument cheaply.
- Delegate narrowly. Authorise a ministerial regulation for AV event-data recorders: what incident data must be retained, for how long, and who may access it after a crash. This serves safety investigation and liability without sweeping in all telemetry.
- Sequence the dependencies. If the target is application from 2027, the data protection authority and the Article 56 implementing rules should be on the same timetable. An AV framework that arrives before them would leave operators with permission to deploy and no clarity on data.
The risk of timing
The minister's end-2026 goal is ambitious for a bill that began deliberation on 30 September. Speed is not a fault in itself; the cost of legal uncertainty for AV pilots is real. But a rushed statute that skips data will push those questions into later regulations, contract terms and enforcement discretion, which is the least predictable place for innovators and for citizens.
Indonesia does not need a separate AV privacy law. It needs the existing one to be operable, and a traffic law that says so. Sorting that out in the DPR's drafting window costs a few paragraphs. Leaving it for later will cost much more.