LLMs and Customer Data: What the PDP Law Requires

Sending customer data to an LLM, whether through chat or through an API, can count as personal data processing under Indonesia's PDP Law (Law No. 27 of 2022). The obligation does not disappear just because an AI model is processing the data instead of a regular application.

When does LLM input count as personal data?

Personal data is data that can identify a person, either directly (name, national ID, phone number) or indirectly (a combination of data that, put together, points to one person). If a prompt or document sent to a model contains that kind of data, PDP Law obligations apply, regardless of how briefly the model uses it.

That means even a small feature, summarizing a support ticket, drafting a reply to a customer email, extracting data from a document, still counts as personal data processing if its content includes customer data.

When does it count as a cross-border transfer?

The PDP Law governs transfers of personal data outside Indonesian jurisdiction, with added obligations for the data controller. If the LLM in use processes requests on servers abroad, the data sent to that model crosses jurisdiction at that moment, even if the application calling it is hosted in Indonesia.

Is there an implementing regulation for the PDP Law now?

Yes. Indonesia issued the PDP Law's implementing regulation, Government Regulation No. 33 of 2026, on 16 July 2026, with a six-month transition before it takes effect on 16 January 2027. Two parts of it bear directly on sending customer data to an LLM. First, it turns the cross-border transfer principle in Article 56 into a concrete test: the receiving country or entity needs a level of protection equal to or higher than Indonesia's, and where that cannot be shown, the controller needs binding contractual safeguards or the data subject's explicit consent instead. Second, appointing a processor, which is what happens when a company sends data to a model provider, now requires a written agreement covering the scope of processing, the processing method, the data categories involved, and audit rights.

What changes when the model is hosted in Indonesia?

Running a model onshore removes one category of obligation: cross-border transfer. It does not automatically make a whole implementation PDP-compliant. Other obligations still apply: a lawful basis for processing, notice to data subjects, retention limits, and security while data is stored and processed.

Practical steps before connecting customer data to an LLM

1. Map exactly which fields end up in the prompt or in documents uploaded to the model.
2. Check the model provider's processing location: inside or outside Indonesia.
3. Establish a lawful basis for processing before the feature goes to production.
4. Set retention: conversation logs and documents uploaded to the model need a defined retention period, not indefinite storage.
5. Ask the model provider for written evidence, not marketing claims, of where data is processed and stored.
6. Put a written processing agreement in place with the provider, covering scope, method, data categories and audit rights, the terms PP 33/2026 requires when a processor is appointed.
7. Confirm how fast the provider commits to reporting an incident. A controller has 3x24 hours to notify affected data subjects and the supervisory institution after a personal data protection failure, and a processor that reports late puts that window at risk.

This is not legal advice. In-house legal or a PDP Law consultant still needs to assess the specific case.

Where does IONext fit?

IONext runs inference and open-weight model hosting from a data center in Jakarta, so data sent to the model never leaves Indonesia. This removes cross-border transfer risk for workloads run in ORBIT, but it does not replace a full compliance review of the system built on top of it. Its own certificate number, data location and security controls are published on the Security and Compliance page, the kind of evidence step five asks any provider to produce. Teams can sign up and try it directly. System integrators taking this kind of project to bank, BUMN or government clients can work with IONext through the IONext Partner Program for system integrators.