The Urgency of Establishing an Independent Supervisory Authority in Personal Data Protection: A Comparative Study of Indonesia and France

Abstract

The enactment of Law No. 27 of 2022 concerning Personal Data Protection (PDP Law) and Government Regulation No. 33 of 2026 has strengthened Indonesia’s personal data protection framework while raising questions about the independence and effectiveness of external supervision. This study aims to comparatively analyze personal data protection supervision in Indonesia and France and to identify institutional principles for strengthening Indonesia’s supervisory authority. Employing normative legal research with statutory, comparative, and conceptual approaches, it examines PDP Law, Government Regulation No. 33 of 2026, Loi n° 2024–449 SREN, the GDPR, and the CNIL framework through qualitative descriptive-analytical and comparative legal methods. The findings show that Indonesia’s framework now provides compliance supervision and administrative sanctions, including fines of up to 2% of annual revenue, but places the external supervisory authority under the President pursuant to Article 58 of the PDP Law, risking conflict of interest in supervising public entities. The CNIL demonstrates institutional independence through pluralistic composition, protection from hierarchical intervention, separation of investigative and sanctioning functions, adversarial procedures, and judicial review. Based on this comparison, the study underscores the urgency of redesigning Indonesia’s supervisory authority to ensure impartial and effective enforcement while remaining compatible with the national constitutional and administrative-law framework.