Data Protection Impact Assessment
Project Description
Pasal.id is an open-access platform providing free access to structured Indonesian legal data. The platform collects user data via OAuth login for personalization and service improvement. This assessment is conducted pursuant to UU PDP Article 34, which requires data controllers to conduct a data protection impact assessment.
Data Processing Activities
Data processing activities include:
- OAuth login: name, email, and profile picture from Google or Facebook
- Bookmarks: regulations saved by users (linked to user_id)
- Article visit tracking: anonymous cookie (pasal_visited), daily reset and maximum 48-hour expiry, not linked to user identity
- Admin analytics: aggregated signup counts and provider breakdown (no individual tracking)
Necessity and Proportionality Assessment
OAuth data: minimum necessary for account identification and outreach. Bookmarks: core product feature, user-initiated. Visit tracking: anti-scraping measure, anonymous, auto-expires. No sensitive/special data collected (no health, religion, political affiliation, or biometrics).
Risk Assessment
Risk 1: Data breach exposing email addresses. Likelihood: low (Supabase managed infrastructure, RLS, restricted service key). Impact: medium. Mitigation: encrypted at rest, TLS, RLS policies on all tables.
Risk 2: Cross-border transfer to Singapore. Likelihood: certain (Supabase SG region). Impact: low (Singapore PDPA comparable to UU PDP). Mitigation: explicit consent at login, contractual safeguards via Supabase ToS.
Risk 3: Unauthorized access via compromised OAuth tokens. Likelihood: low. Impact: medium. Mitigation: httpOnly cookies, server-side validation via getUser(), session refresh in middleware.
Risk 4: Excessive data retention. Likelihood: low. Impact: low. Mitigation: 30-day deletion after account removal, anonymous cookies auto-expire.
Data Subject Rights Implementation
Data subject rights implementation:
- Access: /akun page shows all stored data
- Rectification: profile data comes from OAuth provider (user updates at source)
- Erasure: /akun delete button, cascade deletion, 30-day completion
- Portability: not yet implemented (low priority — minimal data stored)
- Response timeline: 72 hours per UU PDP
Third-Party Processors
Third-party processors:
- Supabase (database, auth) — Singapore region, SOC2 Type II certified
- Vercel (web hosting) — Edge network, no user data stored
- Google and Facebook (OAuth providers) — identity data only, per their respective privacy policies
Review Schedule
Annual review, or upon significant changes to data processing activities.