In recent years, Indonesia has increasingly emerged as a strategic destination for the conduct of clinical trials, particularly for global biotechnology companies. Clinical research activities in the country have grown significantly over the past 15 years, increasing by 83% and reaching 66 clinical trials in 2024. With its large population, high genetic diversity, and evolving medical needs, Indonesia offers substantial potential for the development of new drugs and therapies. The government has also actively promoted the health research ecosystem through regulatory reforms and the acceleration of licensing processes.
However, these opportunities are accompanied by a complex and evolving legal landscape. Global biotech companies operating in Indonesia must navigate various legal risks, ranging from compliance with clinical trial regulations and the protection of research subjects to cross-border data management. Without a comprehensive understanding of these requirements, such risks may not only disrupt the continuity of clinical studies but also give rise to serious legal consequences, including administrative sanctions and potential criminal liability.
Understanding the Complexity of Licensing and Regulatory Compliance for Clinical Trials in Indonesia
The conduct of clinical trials in Indonesia is subject to an increasingly stringent legal framework, particularly following the enactment of Law No. 17 of 2023 on Health (“Health Law”) and the Indonesian Food and Drug Authority Regulation No. 8 of 2024 on Procedures for Approval of Clinical Trial Implementation (“BPOM Regulation 8/2024”). These regulations mandate that all clinical trials must obtain prior approval from the Indonesian Food and Drug Authority (BPOM) before commencement.
The Health Law stipulates that research and development in the health sector must uphold principles of ethics, safety, and the protection of human subjects. In practice, biotechnology companies are required to undergo several critical stages, including obtaining ethical clearance from an accredited Health Research Ethics Committee, submitting comprehensive clinical trial documentation, and undergoing scientific and administrative evaluation by BPOM. This process is not only time-consuming but also requires highly detailed documentation aligned with international standards.
BPOM Regulation 8/2024 further elaborates on the approval mechanism, including the obligation to submit key documents such as research protocols, informed consent forms, and pre-clinical data. Clinical trials are fundamentally conducted on pharmaceutical products and/or certain food products to ensure compliance with standards of safety, quality, and efficacy prior to broader use. In practice, incomplete or non-compliant documentation may result in rejection or delays in the approval process.
This presents a particular challenge for global companies that must align their internal standards and procedures with Indonesia’s national regulatory framework. In addition, clinical trials must adhere to Good Clinical Practice (GCP) principles, which cover the design, conduct, monitoring, and reporting of clinical trials to ensure that generated data is accurate and reliable, while safeguarding the rights, integrity, and confidentiality of research subjects.
Compliance with GCP is not merely administrative in nature but constitutes a critical element in mitigating legal risks, particularly in avoiding disputes arising from ethical violations or procedural non-compliance that may affect the validity of clinical trial outcomes.
Protection of Research Subjects and Legal Liability Risks in Clinical Trials
The protection of clinical trial subjects is a fundamental aspect of Indonesia’s health law framework, given that research involving human participants inherently carries ethical, medical, and legal risks. Such protection extends beyond physical safety to include psychological and social aspects, as well as respect for fundamental rights and human dignity. Accordingly, safeguarding research subjects requires a multidimensional approach encompassing a robust legal framework, stringent ethical standards, clear operational procedures, and continuous oversight mechanisms.
In Indonesia, the protection of personal data of research subjects has become a primary concern, particularly following the enactment of Law No. 27 of 2022 on Personal Data Protection (“PDP Law”). Article 65 paragraph (1) of the PDP Law explicitly provides:
“Any person is prohibited from unlawfully obtaining or collecting personal data that does not belong to them for the benefit of themselves or others, which may result in harm to the Personal Data Subject.”
Violations of this provision may result in criminal sanctions, including imprisonment and/or fines. For global biotech companies, these risks are further heightened as clinical trial data often includes highly sensitive health information. Improper data management may lead to breaches related to data processing, consent, and statutory limitations under the PDP Law.
In addition, legal liability may arise from issues concerning the safety of research subjects. In cases where serious adverse events are not properly managed, companies may face civil liability claims as well as potential criminal prosecution. Article 335 paragraph (5) of the Health Law further emphasizes that:
“Research involving human subjects must be conducted with due respect for the rights of research subjects, including guarantees that no harm is inflicted upon them.”
Thus, the protection of research subjects is not only a matter of safety and ethics but is also closely linked to legal liability, particularly in the management of highly sensitive personal data. These challenges are further compounded by the cross-border nature of modern clinical trials, where subject data is often processed and shared with multiple parties outside Indonesia.
read also : Uji Klinis di Indonesia: Aturan dan Risikonya
Legal Challenges of Cross-Border Data Transfers in Global Clinical Trials
In clinical trials, especially those involving international partners, the transfer of data overseas is common. Data from research subjects in Indonesia is typically not only used by domestic parties but also sent to sponsors, contract research organizations (CROs), or research centers in other countries. The issue is that this data often contains highly sensitive health information, so it cannot simply be transferred without clear regulations.
In Indonesia, this is regulated by the Personal Data Protection Act (PDP Act), which clearly stipulates that personal data may only be transferred abroad if the destination country provides an equivalent level of protection, or if there are adequate safeguards in place, as set forth in Article 56 of the PDP Act. This means that biotech companies cannot arbitrarily send clinical trial subject data abroad without ensuring that such data remains secure and protected in accordance with Indonesian law.
One of the primary challenges is the variation in data protection regimes across jurisdictions. Not all countries maintain equivalent standards, requiring companies to implement additional measures such as inter-party agreements or enhanced internal security systems. Failure to do so may render such transfers unlawful and expose companies to sanctions.
Moreover, informed consent from clinical trial participants plays a critical role. Participants must be clearly informed that their data may be transferred abroad, including the purposes of such transfer and the parties responsible for its management. Failure to provide adequate disclosure may lead to legal disputes in the future.
Additional complexity arises from the multiple stakeholders involved in global clinical trials, including sponsors, CROs, hospitals, and laboratories across different jurisdictions. This often raises the question of liability allocation in the event of data breaches or misuse. Where responsibilities are not clearly defined, legal exposure increases significantly.
The use of technologies such as cloud computing further complicates matters, as data may be stored across servers located in multiple jurisdictions, making it difficult to determine the applicable law. Therefore, companies must ensure that all data processing activities remain compliant with Indonesian legal requirements.
In conclusion, cross-border data transfers in clinical trials are not merely a technical issue but a matter of legal compliance. Biotechnology companies must proactively design robust data governance frameworks from the outset to ensure that clinical trials can proceed smoothly without exposing the organization to unnecessary legal risks.***
Read also : The Legal Framework for Digital Twin Technology in Indonesian Healthcare Services
Regulations:
- Law No. 17 of 2023 on Health (“Health Law”).
- Indonesian Food and Drug Authority Regulation No. 8 of 2024 on Procedures for Approval of Clinical Trial Implementation (“BPOM Regulation 8/2024”).
- Law No. 27 of 2022 on Personal Data Protection (“PDP Law”).
Reference:
- Menggerakkan Uji Klinis di Indonesia Melalui Kolaborasi. World Health Organization (WHO). (Accessed on 22 April 2026 at 13:57 WIB).
- Pedoman dan Standar Etik Penelitian dan Pengembangan Kesehatan Nasional. Kementerian Kesehatan RI. (Accessed on 22 April 2026 at 14:10 WIB).
- Aiyal, Julio Rafael dkk., Perlindungan Hukum Terhadap Peserta Uji Klinis dalam Kasus Penggunaan Obat Eksperimental. Lex Crimen Jurnal Fakultas Hukum Unsrat, Vol. 14 No. 4 (2026). (Accessed on 22 April 2026 at 14:17 WIB).
- 5 Hal yang Perlu Diketahui tentang Uji Klinis BPOM di Indonesia. Sistem Uji Sumber Obat Indonesia. (Accessed on 22 April 2026 at 14:40 WIB).
- Aturan dan Risiko Transfer Data Pribadi Antarnegara. HukumOnline. (Accessed on 22 April 2026 at 15:07 WIB).
- Tantangan Pengiriman Data Pribadi Lintas Negara. Asosiasi Praktisi Perlindungan Data Indonesia. (Accessed on 22 April 2026 at 15:38 WIB).
About Author
