The enactment of Indonesia’s Personal Data Protection (PDP) Law in September 2022 has brought about new changes for the country’s personal data protection. However, one of the consequences of the enactment of the PDP law was the requirement for organisations to appoint a data protection officer (DPO).