# UU PDP and App Design: Prepare the Technical Workstream

> Prepare app privacy engineering with data inventories, access controls, retention and deletion paths, while qualified owners review legal obligations.

- URL: https://weaveward.com/blog/uu-pdp-compliance-apps
- Published: 2024-06-06
- Updated: 2026-10-12
- Category: Security & Cloud
- Tags: UU PDP, privacy engineering, data lifecycle
- Author: Weaveward Team

UU PDP refers to Indonesia's personal data protection law. An application team can prepare a technical privacy workstream by mapping the data lifecycle, limiting access and making retention and deletion operationally possible. That work supports compliance review; it does not establish legal compliance by itself.

Use the current official law and qualified advice for legal interpretation. The software brief should identify the decisions advisers and business owners need to make, then implement the approved controls consistently.

## Inventory the actual data

List fields, documents, logs, backups and third-party transfers. An app may store more information than appears on its main form. Uploaded files, analytics identifiers, error reports and notification systems can create additional copies.

For a hypothetical enquiry app, a name and business email may be sufficient. A complete identity document would be unnecessary for that task. Record the purpose of each field before deciding that an empty input box is harmless.

## Map the lifecycle

| Stage | Technical question |
| --- | --- |
| Collection | Which fields are needed and how is the purpose explained? |
| Use | Which workflow consumes the data? |
| Access | Which roles and services may retrieve it? |
| Sharing | Which provider receives which information? |
| Retention | What rule identifies records ready for review or deletion? |
| Deletion | How are active copies and retained backups handled? |

The legal basis and exact obligations are decisions for the responsible organisation and advisers. The application should make the approved policy enforceable rather than leaving it only in a website notice.

## Limit unnecessary copies

Avoid placing full personal records in general application logs. Error messages can often use an internal reference and sanitized reason. Test notifications and support exports because they can bypass the intended access boundary.

Development environments should use synthetic or appropriately sanitized data. Copying production records to a laptop for convenience creates another lifecycle the team must understand and protect.

## Treat credentials separately

Provider keys, signing secrets and database credentials need controlled storage, access and rotation. They should not be embedded in public code or returned to the browser. A privacy-aware application can still expose its data if operational credentials are poorly handled.

Define ownership for rotation and incident response. Removing a value from the latest source file does not revoke a credential already exposed elsewhere.

## Implement reviewable access

A permission matrix should connect roles to operations and records. Test unauthorized reads, exports and changes at the server, including access through direct identifiers. A hidden button is not an access control.

Record sensitive administrative actions with useful audit information while minimising the personal data in that audit. Balance reviewability with avoiding another uncontrolled copy.

## Make deletion a real workflow

Identify the record reference, authorised request process and affected systems. Test what happens to uploads, search indexes, derived records and queued notifications. Backups need a policy that the technical team can explain honestly.

Do not promise instant removal from every retained copy if the infrastructure cannot support that statement. Align the public explanation with the approved operating procedure.

The deliverable is a data map, controlled access and tested lifecycle actions, plus unresolved legal questions clearly assigned to responsible owners. This gives a privacy review concrete evidence without presenting an engineering checklist as a legal certification.

## Primary references

- [Indonesia Law 27 of 2022, official text](https://peraturan.bpk.go.id/Home/Download/224884/UU%20Nomor%2027%20Tahun%202022.pdf)
- [OWASP secrets management](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)

## Related reading

- [data governance growing companies](/blog/data-governance-growing-companies)
- [Secure Contact Forms: Save Enquiries with Clear Consent](/blog/secure-contact-form-lead-capture)

Explore our [it consulting](/services/it-consulting) to plan a bounded workflow and the evidence needed for acceptance.