Indonesia Data Protection Law for Events: AI Booths, Photo Booths and Brand Activations
Indonesia data protection law for events: what UU PDP means for AI booths, photo booths and brand activations that collect faces, photos or visitor data.
In this article
Indonesia's data protection law for events is UU No. 27 Tahun 2022 on Personal Data Protection (UU PDP). If your booth collects names, phone numbers, photos or face data, it applies to you: ask for clear consent, collect only what the activation needs, keep it safe, and delete it when the purpose is done.
See our AI computer vision service and AI photo booth service.
What UU PDP Covers at an Activation
Most activations collect more personal data than teams expect. A typical booth day can include:
- Registration data: names, emails, phone numbers, badge or wristband IDs.
- Photos and videos: photo booth shots, GIFs, mosaics shared on screens.
- Face data: AI skin, color or face analysis that reads a visitor's features.
- Behaviour data: check-ins, game scores, loyalty points and redemptions.
UU PDP sorts personal data into general and specific data. Specific data includes health data, biometric data, genetic data, children's data and personal financial data. Face data that a system uses to analyse or recognise a person can count as biometric data, so AI booths deserve extra care.
This article explains the general points of the law for planning purposes. It is not legal advice; check your setup with your legal team.
The Key Principles, in Booth Terms
| UU PDP principle | What it means at a booth |
|---|---|
| Lawful basis and consent | Ask before you capture, in plain words, on the screen or the form |
| Purpose limitation | Use the data only for what you told visitors, such as sending their photo |
| Data minimisation | Collect only what the mechanic needs; skip fields you will never use |
| Retention | Set how long photos and face data are kept, then delete them |
| Security | Encrypt storage, limit who can access the dashboard, avoid shared logins |
| Data subject rights | Let visitors access, correct or delete their data and withdraw consent |
| Breach notification | Notify affected people and the authority within 3x24 hours |
Privacy by Design for AI and Photo Booths
The easiest way to follow the law is to build privacy into the booth from day one:
- Consent screen first. One short screen before the camera starts: what is captured, why, and how long it is kept.
- Process on the device where possible. A face analysis can run, show its result and discard the image, without storing the face at all.
- Separate photos from identity. Keep the photo and the phone number linked only as long as needed to deliver it.
- Short retention. Agree a deletion date with the brand before the event, and stick to it.
- Aggregate for reporting. The brand dashboard needs counts and rates, not individual faces.
- Clear request channel. Give visitors one contact for access or deletion requests after the event.
What Our Activations Collect, and How Much
Real numbers show why this matters. Every figure below is one person sharing something with a brand.
La Roche-Posay ran an interactive UV camera with real-time tracking that guided people into a personal UV analysis. It reached 103k+ passersby, 5k visitors and 589 analyses. Presence and movement tracking only needs to know someone is there; the personal UV analysis is where consent matters.
La Roche-PosaySee the project →Laneige used a 12-season AI personal color analysis with real-time try-on and product recommendations. It recorded 19k+ visitors, a 32% engagement rate and 179 analyses, with a custom dashboard to manage content and product mapping.
LaneigeSee the project →Photo NRG, for an FMCG brand, started each session with one wristband tap, turned three poses into a GIF, added points to the visitor's account and placed every photo in a live mosaic. It brought 1,337 participants, 445 a day on average. Here the photo, the wristband and the loyalty account are all linked, so the consent note covers all three.
FMCGSee the project →A Quick Checklist Before the Event
- Map every data point the booth collects, from the camera to the dashboard.
- Write the consent text in Bahasa Indonesia and English.
- Decide which data stays on the device and which goes to the cloud.
- Set retention and deletion dates in the brief.
- Name one person responsible for data requests and incidents.
How to Start
Share your activation idea and the data it needs, and we will help design a booth that collects only what it should. Contact us to plan your next AI or photo booth.
Frequently Asked Questions
What does Indonesia's data protection law mean for events?
Indonesia's Personal Data Protection Law, UU No. 27 Tahun 2022 (UU PDP), sets rules for anyone who collects or processes personal data. At events, that covers registration forms, check-in badges, photo booths, AI face analysis and any visitor data a brand keeps after the day.
Is a photo from a photo booth personal data?
Yes, when a person can be identified from it. A photo linked to a name, phone number or account is clearly personal data. Face data used to analyse or recognise someone can count as biometric data, which the law treats as specific personal data.
Do I need consent to run an AI booth?
Consent is the most common legal basis for activations. Visitors should know what is collected, why, and for how long before they start, and they should be able to say no and still enjoy the booth where possible.
What rights do visitors have over their data?
Under UU PDP, data subjects can ask for access to their data, correct it, have it deleted and withdraw consent. A booth should have a simple way to handle those requests after the event.
What happens if visitor data leaks?
UU PDP requires the controller to notify the affected people and the authority in writing within 3x24 hours of a personal data breach.
Sources
Project figures from rekursiv case studies
- Interactive UV camera La Roche-Posay
- 12-season personal color mirror Laneige
- Photo NRG FMCG
