Indonesia: New Personal Data Protection Regulation Introduces Significant Compliance Requirements for Businesses

Indonesia has introduced a comprehensive new regulation governing the protection and processing of personal data, bringing greater clarity to the country’s data protection framework and introducing additional compliance obligations for businesses.

Government Regulation No. 33 of 2026 (“GR 33/2026”), issued on 16 July 2026, implements Law No. 27 of 2022 on Personal Data Protection (the “PDP Law”). The new regulation contains 225 articles and provides detailed guidance on how organisations must collect, process, store, transfer and protect personal information.

The regulation will take effect on 16 January 2027, giving businesses a limited period to review their existing arrangements and prepare for the new requirements.

Scope of Application and Personal Data Classification

Indonesia’s data protection legislation applies to processing activities conducted within Indonesia, as well as activities undertaken outside the country that have legal consequences in Indonesia or affect Indonesian citizens abroad.

GR 33/2026 clarifies the exemption for personal or household activities. Processing will only fall outside the regulation where it is genuinely private, non-commercial and not intended for public purposes.

The regulation also develops the distinction between general and specific personal data.

Specific personal data includes health information, biometric and genetic data, criminal records, children’s information and personal financial data. Additional categories may be designated by the Ministry of Communication and Digital Affairs in coordination with the relevant supervisory authority.

Importantly, combinations of general personal information may require enhanced protection where they can identify an individual. This development is particularly relevant to businesses using customer profiling, data enrichment and marketing analytics.

Joint Data Controllers and Data Processing Agreements

GR 33/2026 establishes more detailed contractual requirements for organisations sharing responsibility for personal data processing.

Agreements between joint data controllers must specify the legal basis and purposes of processing, the categories of personal data involved and the allocation of responsibilities between the parties.

Agreements appointing data processors must address at least 11 prescribed elements, including processing activities, duration, contractual obligations, audit arrangements and dispute resolution procedures.

Data processors must also obtain prior written consent before appointing sub-processors. The original controller remains ultimately responsible for processing undertaken by those sub-processors.

Businesses should therefore review existing data processing agreements and arrangements with third-party service providers.

Data Subject Rights and Response Deadlines

The PDP Law established several rights for individuals, including access to personal information, correction, deletion, data portability, withdrawal of consent and objections to certain automated processing activities.

GR 33/2026 introduces a more clearly defined timeframe for responding to verified requests.

Organisations must respond to specified data subject requests within 72 hours, including requests concerning access, correction, deletion, withdrawal of consent and restrictions on processing.

The regulation also clarifies who may submit requests on behalf of individuals, including parents, guardians and authorised representatives.

Additional provisions address automated decision-making. Where an objection is accepted, organisations must provide human intervention or an alternative form of non-automated processing.

Data portability rights are subject to specific conditions, including that the processing is automated and based on consent or contractual necessity.

Consent and Protection of Children and Vulnerable Individuals

The new regulation introduces additional safeguards concerning consent and the processing of information relating to children and persons with disabilities.

Organisations cannot reduce the quality of goods or services simply because an individual refuses consent, unless the relevant processing is essential to providing those goods or services.

Consent may be withdrawn at any time, and the relevant processing must cease within 72 hours of a verified withdrawal request.

Where children’s personal data is involved, controllers must establish appropriate age-identification procedures, obtain parental or guardian consent where required and provide mechanisms addressing the transition to adulthood.

Organisations must also ensure that individuals with disabilities can exercise their data protection rights through accessible communication and identification procedures.

Businesses handling children’s information should additionally consider Government Regulation No. 17 of 2025, which addresses electronic system governance and child protection.

CCTV and Visual Monitoring Requirements

GR 33/2026 introduces specific provisions governing CCTV systems and other visual data processing technologies.

The use of such equipment in public spaces and public service facilities is restricted to defined purposes, including security, disaster prevention and traffic management, subject to particular exceptions for law enforcement and crime prevention.

Where monitoring equipment is installed, organisations must provide clear notices informing individuals that surveillance is taking place.

These notices must include appropriate contact information and be displayed prominently before individuals enter the monitored area.

The requirements are particularly relevant to businesses operating retail premises, hotels, transport facilities and commercial buildings.

Data Protection Impact Assessments and Officers

The regulation provides further detail on when organisations must conduct Personal Data Protection Impact Assessments.

Assessments are required for certain high-risk processing activities, including:

• Automated decision-making with significant or legal consequences.

• Processing specific categories of personal data.

• Large-scale personal data processing.

• Systematic monitoring or profiling.

• Combining or matching datasets.

• Processing involving new technologies.

• Activities restricting the exercise of data subject rights.

Assessments must be undertaken before processing begins and reviewed as risks evolve.

GR 33/2026 also clarifies when a Personal Data Protection Officer (“PDPO”) must be appointed, including certain public service activities, large-scale monitoring and large-scale processing of sensitive or criminal record information.

A PDPO may be appointed internally or externally, but must have appropriate independence, resources and direct access to senior management.

Processing Records and Data Retention

Organisations must maintain more comprehensive records of their personal data processing activities.

GR 33/2026 prescribes 12 categories of information for processing records, including the purposes and legal basis of processing, data categories, data flows, responsible parties and retention periods.

Businesses must also establish a separate written data retention policy covering prescribed requirements.

The regulation distinguishes between terminating processing, deleting data and permanently destroying information, with different obligations applying to each activity.

Controllers must follow documented procedures for deletion and destruction, including identification, segregation, implementation, record-keeping and periodic review.

Personal Data Breach Notifications

Indonesia’s existing requirement to notify personal data protection failures within 72 hours remains in place.

GR 33/2026 clarifies that the notification period begins when the organisation becomes certain that a personal data protection failure has occurred.

Notifications must be provided to affected individuals and the relevant supervisory authority.

The regulation also introduces more detailed requirements concerning notification content, incident documentation and internal response procedures.

Importantly, the notification obligations do not contain a general minimum severity threshold. Organisations should therefore ensure that internal reporting and incident management procedures can accommodate the full range of reportable incidents.

International Transfers of Personal Data

Cross-border transfers are among the areas receiving substantial attention under GR 33/2026.

The regulation expands the existing three-tier framework governing transfers of personal data outside Indonesia.

Adequate protection: Organisations must first consider whether the destination country provides personal data protection equivalent to or greater than Indonesian standards.

Appropriate safeguards: Where the destination does not offer adequate protection, transfers may proceed using recognised legally binding safeguards, including contractual clauses or approved binding corporate rules.

Consent: Where neither of the preceding mechanisms is available, consent may be used in limited circumstances, subject to additional restrictions, risk assessments and notification obligations.

Consent-based transfers are generally restricted to non-recurring transfers involving a limited number of individuals.

Before undertaking international transfers, controllers must map the relevant data flows, assess the applicable transfer mechanism, evaluate risks and provide appropriate information to affected individuals.

These provisions are especially important for multinational organisations, international service providers and businesses relying on overseas cloud hosting or data processing arrangements.

Mergers, Acquisitions and Corporate Restructuring

GR 33/2026 introduces specific personal data protection requirements for mergers, acquisitions, consolidations, spin-offs and corporate dissolutions.

Where personal information is transferred as part of a corporate transaction, the outgoing controller must review outstanding data protection obligations and update relevant assessments.

The outgoing and incoming controllers are treated as joint controllers until the transaction is completed.

Both parties must provide prescribed notices to affected individuals, including information about the incoming controller and how individuals may object to the transfer.

The parties must also agree on the legal basis for processing and the allocation of responsibilities.

Organisations undertaking transactions involving Indonesian businesses should incorporate these requirements into due diligence, transaction documentation and completion planning.

Regulatory Supervision and Administrative Penalties

GR 33/2026 establishes more detailed procedures for regulatory investigations, enforcement and administrative sanctions.

The maximum administrative fine remains 2% of annual revenue for specified data protection violations.

The level of any penalty will depend on factors such as the seriousness and duration of the breach, the number of individuals affected, the organisation’s cooperation with regulators and its compliance history.

The supervisory authority will also have powers to issue binding instructions, including orders requiring changes to certain third-party arrangements.

Defined procedural deadlines now apply to complaint reviews, investigations, sanctions decisions and objections.

Data Protection Dispute Resolution

The regulation introduces a more structured approach to disputes involving personal data protection.

The supervisory authority will play an important role in assessing complaints and determining whether matters should proceed through administrative enforcement, criminal investigation or mediation.

Mediation is encouraged as a means of resolving disputes before arbitration or court proceedings.

The process generally must be completed within 30 working days of the first mediation session, with a possible extension of a further 30 working days.

Where parties reach an agreement, they may seek to formalise the settlement through the competent courts.

Implementation Date and Transitional Arrangements

GR 33/2026 will come into force on 16 January 2027, six months after its promulgation.

Organisations may continue processing personal data during the transitional period, provided their activities do not conflict with the new regulation.

As no additional general grace period has been provided, businesses should treat 16 January 2027 as the principal deadline for implementing the necessary compliance measures.

Further guidance may follow from Indonesia’s personal data protection supervisory authority as the regulatory framework develops.

Practical Considerations for Businesses

Businesses operating in Indonesia, or processing personal information relating to Indonesian citizens from overseas, should review their existing data protection arrangements before the new regulation takes effect.

Key areas for consideration include:

• Reviewing data processing agreements and joint controller arrangements.

• Identifying activities requiring data protection impact assessments.

• Assessing whether a Personal Data Protection Officer must be appointed.

• Updating processing records and establishing appropriate retention policies.

• Reviewing CCTV systems, monitoring practices and privacy notices.

• Ensuring procedures for data subject requests meet the 72-hour requirements.

• Evaluating international data transfer mechanisms and associated safeguards.

• Updating incident response and breach notification procedures.

• Incorporating data protection requirements into mergers, acquisitions and corporate restructuring.

GR 33/2026 represents a significant development in Indonesia’s personal data protection framework. Its detailed operational requirements will affect both domestic businesses and international organisations with activities connected to Indonesia.

With the implementation deadline approaching, early preparation will be important to ensuring regulatory compliance, reducing operational risk and maintaining confidence in the responsible handling of personal information.

By SSEK, Indonesia, a Transatlantic Law International Affiliated Firm. 

For further information or for any assistance please contact indonesia@transatlanticlaw.com

Disclaimer: Transatlantic Law International Limited is a UK registered limited liability company providing international business and legal solutions through its own resources and the expertise of over 105 affiliated independent law firms in over 95 countries worldwide. This article is for background information only and provided in the context of the applicable law when published and does not constitute legal advice and cannot be relied on as such for any matter. Legal advice may be provided subject to the retention of Transatlantic Law International Limited’s services and its governing terms and conditions of service. TransatlanticLaw International Limited, based at 84 Brook Street, London W1K 5EH, United Kingdom, is registered with Companies House, Reg Nr. 361484, with its registered address at 83 Cambridge Street, London SW1V 4PS, United Kingdom.