Reforming Criminal Procedure to Regulate Deferred Prosecution Agreements for Corporate Personal Data Breaches in Indonesia

Abstract

This research explores the urgency and legal formulation of implementing Deferred Prosecution Agreements (DPA) for corporations involved in personal data breaches, and its relevance to the reform of Indonesia’s Criminal Procedure Code (KUHAP). The study is motivated by the increasing number of high-profile data breach cases in Indonesia such as those involving Tokopedia, BPJS Kesehatan, and PLN which highlight the weaknesses in law enforcement mechanisms and inadequate victim protection. The findings reveal that Indonesia’s criminal justice system, which strictly adheres to the principle of legality, lacks procedural flexibility to handle corporate crime through restorative and preventive approaches. In contrast, DPAs have been effectively implemented in various jurisdictions (e.g., the United States and the United Kingdom) to promote corporate accountability, facilitate victim compensation, and support economic sustainability. This study applies a normative juridical method combined with statutory, comparative, and conceptual approaches, and critically examines the Personal Data Protection Act (Law No. 27 of 2022). The research identifies a regulatory gap in KUHAP, which does not currently accommodate restorative mechanisms such as DPA within its prosecutorial framework. As a result, the study proposes an ideal DPA model for Indonesia, which includes: limited prosecutorial discretion, mandatory corporate compliance conditions, victim participation, and judicial oversight. The study concludes that incorporating DPA into Indonesia’s criminal procedure would enhance the country’s legal response to digital corporate crimes while reinforcing victims' rights and promoting procedural efficiency.