For almost four years, Indonesia's Personal Data Protection Law (Law No. 27 of 2022, known as UU PDP) operated without detailed implementing rules. Many organizations understood its principles but were unsure what they actually had to do.
On 16 July 2026, the government enacted Government Regulation No. 33 of 2026 (GR 33/2026) as the implementing regulation of UU PDP. It takes effect on 16 January 2027. Organizations therefore have less than three months to make sure the way they handle personal data is compliant.
Turning principles into clear duties
UU PDP has in fact been binding since its adjustment period ended in October 2024. However, much of it was written as principles. GR 33/2026 turns those principles into procedures that can be carried out.
The regulation contains 12 chapters and 225 articles. It covers the classification of personal data, the legal bases for processing, data subject rights, the obligations of controllers and processors, cross-border transfers, impact assessments, and administrative sanctions. It applies to businesses, public bodies, and international organizations that process personal data in Indonesia.
The most important shift concerns proof. It is no longer enough for an organization to say it complies. It needs documents, procedures, and records that demonstrate compliance.
Personal data protection failures
One of the most demanding provisions concerns personal data protection failures. Under Article 114, a data controller must notify affected data subjects and the supervisory authority in writing no later than 3 x 24 hours after the failure is known.
The notice must at least describe which data was exposed, when and how it was exposed, the handling and recovery steps taken, and a contact person. If the failure occurs on the processor's side, such as a vendor or service provider, the processor must report it to the controller at the first opportunity.
This deadline is very tight for organizations that do not know what data they hold or where it is stored. Without procedures prepared in advance, three days can easily be spent just figuring out what happened.
Children data and specific data need special handling
The regulation separates personal data into two groups, ordinary data and specific data. Specific data includes health information, biometric data, genetic data, criminal records, data about children, and personal financial data. These categories carry greater risk, so the rules for handling them are stricter.
Children's data receives particular attention. Article 38 requires controllers to take steps to identify users who are children before processing their data. Once a child is identified, processing requires consent from a parent or guardian.
This directly affects education services, family apps, entertainment platforms, and any other digital service that children may use. Registration and consent flows for these services should be reviewed.
Impact assessments and data protection officers
Articles 120 to 122 require a data protection impact assessment before any high-risk processing. Examples include processing specific data, processing at large scale, using new technologies, and automated decision-making with a significant effect on individuals.
For product teams, this means privacy has to be considered from the design stage. Impact assessments are best carried out before a feature is built, not after it has been launched.
In addition, Article 142 requires the appointment of a data protection officer (known locally as PPDP) in certain conditions. These include processing for public services, regular and systematic large-scale monitoring of data subjects, and large-scale processing of specific data. The officer must be competent and have access to the organization's top management.
Sanctions calculated by impact
Violations may lead to administrative sanctions in the form of written warnings, temporary suspension of processing, deletion or destruction of data, and fines. Article 185 caps fines at 2 percent of annual revenue or income.
Fines do not automatically reach that ceiling. The calculation considers the impact and duration of the violation, the type and volume of data affected, the scale of the business, and how cooperative the organization is during the investigation. Organizations that are transparent and have made genuine compliance efforts are in a stronger position.
Beyond administrative sanctions, individuals also have the right to sue and receive compensation for violations involving their personal data.
A supervisory authority still to come
One piece remains unfinished, and that is the supervisory authority. UU PDP mandates a Personal Data Protection Agency that will monitor compliance, investigate violations, and impose sanctions.
The draft Presidential Regulation establishing the agency was submitted to the President through a letter from the Minister of Administrative and Bureaucratic Reform dated 20 May 2026. As of mid-September 2026, no official announcement of its enactment had been made. In the meantime, supervision is carried out by the Ministry of Communication and Digital Affairs through its Directorate General of Digital Space Supervision.
Some observers expect the agency to become fully effective in 2028 at the earliest. Several technical details, including the specifics of breach notification, are also waiting for rules from the agency. Even so, the missing authority is no reason to delay preparation. UU PDP is already in force, individuals can already file claims, and GR 33/2026 will take effect on schedule.
Steps you can start now
Compliance does not have to begin with a large project. The first step is to map the personal data your organization manages, including what kind of data it is, where it is stored, who can access it, and what it is used for.
Next, review the legal basis for each type of data and make sure consent mechanisms are clear. Organizations should also prepare an incident response procedure that can realistically meet the 3 x 24 hour deadline, with defined roles and notification templates.
After that, review contracts with vendors and service providers that process data on your behalf. These contracts should set out incident reporting duties and data security standards. Organizations that meet the criteria should also appoint a data protection officer and set up an impact assessment process for every new product or feature.
Finally, involve every employee. Many data breaches start with simple mistakes, such as sharing files through insecure channels or using weak passwords. Regular training helps close gaps that technology alone cannot address.
Closing
With GR 33/2026 in place, Indonesia's personal data protection rules now have clear details. The question is no longer what needs to be done, but how ready organizations are to do it.
Compliance should not be seen as an administrative burden alone. Orderly data management shows that an organization values the trust of its users, partners, and the public. Organizations that start preparing now will face January 2027 with far more confidence.
Source: this article draws on Meridian Hukum for the official metadata of GR 33/2026, Veritask for Article 114 on breach notification and Articles 120 to 122 on impact assessments, the RSM Indonesia Client Alert of 18 September 2026 for Articles 142 to 146 on data protection officers, Katadata for Article 38 on children's data, Bisnis.com for Article 6 on specific personal data and Article 185 on administrative fines, Hukumonline Pro for the types of administrative sanctions, Kompas.com for the Constitutional Court hearing of 27 July 2026 on the draft Presidential Regulation, and Bisnis.com on 13 September 2026 for the outlook on when the supervisory agency may become effective.
