<![CDATA[This article examines the normative construction of Article 56 of Law Number 27 of 2022 on Personal Data Protection, which regulates the requirements for cross-border personal data transfers. The study is motivated by the increasing transfer of personal data within the digital ecosystem, which may weaken the protection of data subjects’ rights if it is not supported by clear legal norms. This study aims to analyze the normative construction of Article 56 and the implications of its normative ambiguity for legal certainty and the legal protection of data subjects. This study employs a normative legal research method using statutory, conceptual, and limited comparative approaches. The findings show that Article 56 establishes three requirements for cross-border personal data transfers, namely an equivalent or higher level of protection, adequate and binding protection, and the consent of the data subject as a last resort. However, this provision does not yet provide clear normative parameters regarding the standard of equivalent protection, the form of adequate and binding safeguards, or the limits on the use of consent. Therefore, Article 56 needs to be clarified in order to provide legal certainty and ensure the protection of data subjects’ rights in cross-border personal data transfers.]]>
Copyrights © 2026
