Whitesec ID
Whitesec One · UU PDP

UU PDP compliance, recorded and tracked.

Law No. 27 of 2022 on Personal Data Protection asks for records, deadlines and proof. The privacy workspace in Whitesec One manages them on the same registers as your ISMS.

Book a demoSee it on whitesec.one(opens in a new tab)

Screenshot of the live dashboard with sample data.

Whitesec One UU PDP compliance register tracking the articles of Law No. 27 of 2022 with status per chapter (sample data)
Regulation
UU PDP, Law No. 27 of 2022
Standard
ISO/IEC 27701:2025
UU PDP register
48 articles with status and owner
Deadlines
Computed in days and hours
What it manages

Privacy treated on the same footing as security.

ISO/IEC 27701:2025 is a privacy information management system (PIMS) in its own right. The privacy workspace in Whitesec One runs it on the same registers as your ISMS, adds the records UU PDP asks for, and tracks every privacy deadline in days or hours.

PII controllers, PII processors or both can use it: the organisation's role is declared in PIMS governance, and the Annex A tables for controllers, processors and both roles are available.

What the workspace holds

Six things recorded and tracked for you.

Each record carries the UU PDP article it answers, so it is easy to show an auditor.

  • Records of processing

    Each activity with its purpose, lawful basis under UU PDP Article 20 or GDPR Article 6, data subjects and categories, specific personal data, role, retention, recipients and transfers outside Indonesia, reviewed every 12 months by default.

  • DPIAs that flag themselves

    UU PDP Article 34 triggers such as specific data, large scale and systematic monitoring mark an assessment high-risk. A very high residual risk without prior consultation is flagged, and completion is approved by a second person.

  • Requests on the statutory clock

    Deadlines are computed for you: 3 days under UU PDP for rectification, access, restriction and withdrawal of consent, otherwise 30 days. No work starts until the subject's identity is verified.

  • Breach notification in hours

    Each breach file opens a 72-hour (3 x 24 hours) clock from discovery for every notice that applies, to the agency and to data subjects under UU PDP and to the authority under GDPR. Closing the file needs a second person.

  • Cross-border transfers

    Transfers under UU PDP Article 56 are recorded with their basis. A transfer that relies on consent must record how that consent was obtained.

  • UU PDP compliance register

    48 articles of Law No. 27 of 2022 across data subject rights, legal basis and consent, controller obligations, cross-border transfer and classification, each with a status, owner, actions and evidence, and a compliance percentage per chapter.

Retention and roles

Retention, consent and processing by others.

Retention schedules come with a deletion log that someone other than the person who deleted must verify. PII processors and DPAs are read from the supplier register the ISO 27001 and SOC 2 workspaces use. Privacy roles, from the DPO to legal counsel, are recorded in PIMS governance.

Its limits

A tool, not a substitute.

  • Whitesec One helps you record and track; it is not legal advice. Compliance stays the responsibility of your organisation, with its DPO and legal counsel.
  • The consent register holds your consent mechanisms and notice versions, not each individual's consent, which stays in the systems where it is collected.
  • It does not issue an ISO/IEC 27701 certificate. PIMS certification comes from an accredited certification body.
Related

The platform on one side, support on the other.

References

Questions

UU PDP in Whitesec One

See your UU PDP register in Whitesec One.

We walk through the privacy workspace with the team in Jakarta and agree how it fits your program.

Free Consultation+62 878-7666-6016