Is it legal to analyse CCTV footage in Indonesia?
What the Personal Data Protection Law says about cameras in public places, and how counting people without identifying them fits in.
By Stella Nurina Susanto · October 2026It's the first question most mall and store managers ask us, and it's the right one. Indonesia's Personal Data Protection Law (UU PDP, Law No. 27 of 2022) has applied in full since October 2024, and it has a specific article on cameras in public places.
What the law says about cameras
Article 17 of UU PDP covers installing "visual data processors", meaning cameras, in public places. Installation is allowed for security, disaster prevention, and traffic management. The area must display information that a camera is operating. And the footage must not be used to identify a person.
The implementing regulation, PP 33/2026, was signed in July 2026 and applies from 16 January 2027. It adds detail on that notice: it should say that a camera is operating, give the operator's contact details, and sit at the entrance, or somewhere people see before they enter the monitored area. It also requires a data protection impact assessment before high-risk processing, and names AI and machine learning among the examples.
The penalties are real. Unlawful processing can bring administrative sanctions, including fines of up to 2% of annual revenue, and the law also sets criminal penalties for unlawful use of personal data.
What this means for counting visitors
Three things follow for anyone who wants to count visitors from security footage:
- Nobody is identified. Counting how many people walked past a store, or how long a queue was, doesn't require knowing who anyone is. We detect and track anonymous shapes. There is no facial recognition, and nobody is matched across days or locations.
- Only totals leave the system. Every number on the dashboard is an aggregate: visitors per hour, average dwell time, queue length.
- Raw footage doesn't stay with us. We delete the recordings 30 days after upload.
There is one question your counsel should look at directly. Article 17 lists security, disaster prevention and traffic as the purposes for installing cameras in public places. Analysing the same footage for business insight isn't on that list, even when no one is identified. How your company frames and documents that use, and how you inform visitors, is a decision for your legal team. We're glad to join that conversation and share exactly how the data is processed.
Questions to ask any CCTV analytics provider
- Does the system identify individuals or match faces? (It shouldn't.)
- What leaves your site: video, images or only counts?
- How long is raw footage kept, and who can access it?
- Will you sign a data processing agreement that names us as the data controller?
- Can tenants or branches see each other's data? (They shouldn't.)
The short answer
Counting people from CCTV can be done in a way that respects UU PDP: no identification, aggregates only, short retention, proper signage, and a documented purpose. Get the purpose question checked by your counsel before you start, and choose a provider that can show you how its processing works.