Data Protection Monitor
Global Privacy & Data Protection Intelligence

Based mainly on secondary sources. Only 2 of the sources retrieved for this jurisdiction are official or direct reporting of official material (tier 1 or 2), against the 3 we look for. No finding on this page is shown with confidence above “Uncertain” until stronger sources are retrieved.

Indonesia Data Protection & Privacy Regulation

ID schema gdpri-v2 trajectory: not yet assessed overlaps: Sentinel (AML/CFT), World Payments

Last updated · 10 categories · 34 claims · 30 sources in the cumulative register

Indonesia's data-protection regime remains structurally unable to impose the administrative sanctions its own statute provides for, because the independent Personal Data Protection Agency, the Lembaga PDP, has still not been established.

Data collected Data published

AI-assembled from cited sources

Not covered: Lawful Processing & Special Data, Data Subject Rights, Controller/Processor Duties, Cross-Border & Adequacy, Sectoral Watch, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups. Not fully checked this cycle: Regulator & Framework, Enforcement & Redress (3 open gaps).

Evidence re-verified: ·Position last changed: ·
Record history & provenance ▾

Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.

Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26

Open in Co-Pilot ↗Build ReportCompare
Framework postureMonitored baseline0 of 10 modules populated · AI-synthesised · Tier-1/2 verified
Lead supervisory authorityAdaptist ConsultingPrimary statutory & supervisory perimeter
Next milestone (> 2026-10-26)2026-Q4PDP Agency establishment via Presidential Regulation
Module coverage & confidence0 / 10 modules assessed0 Confirmed · 0 Probable · 0 Uncertain · 10 Not yet assessed

Jurisdiction brief

Latest update · 4 November 2026

Lead Signal

Indonesia's data protection framework reached a further stage of codification in the period under review with the promulgation of Government Regulation No. 33 of 2026, signed by President Prabowo Subianto on 16 July 2026. The regulation is understood to be the implementing regulation for the 2022 data protection statute, and is reported to enter into force on 16 January 2027. A savings provision is understood to preserve existing rules in the interim, pending further technical regulations that are themselves to be issued by the Personal Data Protection Authority once that body exists. That qualification matters: the authority named to issue those follow-on rules has still not been established by Presidential Regulation, so the implementing regulation now sits in force on paper while the institution meant to operationalise important parts of it remains absent.

Key regulatory facts for Indonesia
Regulatory DimensionIndonesia Standing Position
JurisdictionIndonesia (ID)
Regulatory ScopeData Protection & Privacy Regulation (10 modules, 34 sourced findings)
Primary Instruments CitedAdaptist Consulting, Rajah & Tann Asia, PPC Land, dataprotection.gi, Nusantara DFDL
Last Confirmed / Updated2026-11-04 (30 sources in cumulative register)

#

No standing position recorded for this category.

Sub-modules (2)

Regulator And AuthorityNot assessed

No narrative recorded for this sub-module.

Claims (5):

  • Kementerian Komunikasi dan Digital (Komdigi) requires: Pending establishment of the Lembaga PDP, Komdigi's Directorate General of Digital Space Supervision exercises interim data-protection oversight under secondary instruments such as Permenkominfo 5/2020.
  • UU PDP (Law No. 27 of 2022) — Became fully enforceable 17 October 2024, ending its two-year transition period; the law's mandated independent supervisory authority (Lembaga PDP) has still not been established.
  • Draft Presidential Regulation establishing the PDP Agency — Made public end of February 2026, remains pending presidential approval; June 2026 Constitutional Court petition challenges the lack of a statutory establishment deadline.
  • Personal Data Protection Agency (PDP Agency) — Independent PDP Agency mandated by the PDP Law not fully established; interim competence with Komdigi.
  • Kementerian Komunikasi dan Digital (Komdigi) — Pending establishment of the Lembaga PDP, Komdigi's Directorate General of Digital Space Supervision exercises interim data-protection oversight under secondary instruments such as Permenkominfo 5/2020

Act And InstrumentsNot assessed

No narrative recorded for this sub-module.

Claims (4):

  • Lembaga PDP (draft Presidential Regulation) grants: The draft Presidential Regulation establishing the Lembaga PDP completed inter-ministerial harmonisation and was submitted to the President on 20 May 2026 but remained unsigned as of 19 August 2026.
  • UU PDP (Law No. 27 of 2022) — Indonesia's core omnibus data-protection statute, modelled on GDPR.
  • GR 33/2026, the implementing regulation for the PDP Law, was signed 16 July 2026 and enters into force 16 January 2027.
  • Lembaga PDP (draft Presidential Regulation) — The draft Presidential Regulation establishing the Lembaga PDP completed inter-ministerial harmonisation and was submitted to the President on 20 May 2026 but remained unsigned as of 19 August 2026
Category narrative 94 words

Indonesia's Personal Data Protection Law (UU PDP, Law No. 27/2022) has been fully enforceable since 17 October 2024, but the independent supervisory body it mandates, the Lembaga PDP (PDP Agency), remains unestablished. As of the most recent reporting located this cycle (19 August 2026), the draft Presidential Regulation (RPerpres) establishing the Agency had completed inter-ministerial review and harmonisation and was submitted to the President for signature on 20 May 2026, but remained unsigned. Interim data-protection oversight sits with Komdigi's Directorate General of Digital Space Supervision, acting under pre-PDP-era secondary instruments such as Permenkominfo 5/2020.

Periodic update · new data 2026-11-04

Regulator & Framework

Government Regulation No. 33 of 2026 was signed on 16 July 2026 and is reported to be the implementing regulation for Indonesia's data protection statute. It is understood to enter into force on 16 January 2027, with a savings provision preserving existing rules in the interim pending further technical regulations expected from the Personal Data Protection Authority, once that body is established. The authority itself, mandated by the statute, has not yet been established by Presidential Regulation, and interim oversight continues to sit with the Ministry of Communication and Digital Affairs (Komdigi) through its Directorate General of Digital Space Supervision, which is reported to enforce obligations using the existing electronic-system-provider registration regime rather than a dedicated data protection enforcement mechanism.

Outlook

The commencement of Government Regulation No. 33 of 2026 on 16 January 2027 will be the next material date in this framework's development, but its practical effect depends on whether the Personal Data Protection Authority has by then been established, since the regulation's own savings provision anticipates further technical rules from that body.

3 earlier distinct update(s)
Periodic update · new data 2026-10-25

Regulator & Framework

Indonesia's data-protection framework advanced with the promulgation of Government Regulation No. 33 of 2026 on 16 July 2026, published as Lembaran Negara 2026 No. 88, which will enter into force on 16 January 2027 and carries a savings provision preserving existing rules pending further technical regulations. This is the long-anticipated implementing regulation for the PDP Law. Set against this advance, the Personal Data Protection Authority mandated by Articles 58-61 of the PDP Law has still not been established by Presidential Regulation; Komdigi continues to perform interim oversight functions in its place. This institutional gap is now the subject of active litigation: Constitutional Court Case No. 236/PUU-XXIV/2026 asks the Court to order the government to establish the Authority within a fixed deadline, a position the Ministry of Communication and Digital Affairs opposed as of 27 July 2026.

Outlook

The period before GR 33/2026 takes effect on 16 January 2027 is the decisive window for this framework dimension: whether the Authority is established before that date, whether through the pending Case No. 236/PUU-XXIV/2026 litigation or through separate executive action, will determine whether GR 33/2026's provisions have a functioning supervisory body in place at commencement.

Periodic update · new data 2026-10-18

Regulator & Framework

Indonesia's data-protection framework advanced this cycle with the promulgation of Government Regulation No. 33 of 2026 on 16 July 2026, published as Lembaran Negara 2026 No. 88, which will enter into force on 16 January 2027 and carries a savings provision preserving existing rules pending further technical regulations. This is the long-anticipated implementing regulation for the PDP Law. Set against this advance, the Personal Data Protection Authority mandated by Articles 58-61 of the PDP Law has still not been established by Presidential Regulation; Komdigi continues to perform interim oversight functions in its place. This institutional gap is now the subject of active litigation: Constitutional Court Case No. 236/PUU-XXIV/2026 asks the Court to order the government to establish the Authority within a fixed deadline, a position the Ministry of Communication and Digital Affairs opposed as of 27 July 2026.

Outlook

The period before GR 33/2026 takes effect on 16 January 2027 is the decisive window for this framework dimension: whether the Authority is established before that date, whether through the pending Case No. 236/PUU-XXIV/2026 litigation or through separate executive action, will determine whether GR 33/2026's provisions have a functioning supervisory body in place at commencement.

Periodic update · new data 2026-10-11

Regulator & Framework

Indonesia's data protection framework rests on UU PDP, now substantially elaborated by Government Regulation No. 33 of 2026, promulgated 16 July 2026 and taking effect 16 January 2027. The independent authority UU PDP Article 58 mandates, the Lembaga PDP, remains unestablished: the enabling Presidential Regulation is understood to still be in harmonisation at the Ministry of Law, and the resulting delay is the subject of a Constitutional Court judicial review petition filed in June 2026. One account of this gap puts it directly: the dedicated authority the law mandates still does not exist, and neither implementing regulation has been signed.

In the interim, the Komdigi Directorate General of Digital Space Supervision holds interim data-protection supervisory and enforcement competence, pursuant to Komdigi Regulation No. 1 of 2025. This interim arrangement means that, notwithstanding GR 33/2026's substantial operational detail across lawful processing, data subject rights, breach notification, cross-border transfer and enforcement, the entity actually exercising supervisory competence today is not the independent authority UU PDP envisages but a directorate general within the communications and digital ministry, pending that authority's eventual establishment.

Outlook

The operational status and timeline of the Lembaga PDP, particularly in light of the pending Constitutional Court review, is the central open question for this module; its resolution would determine whether GR 33/2026's 16 January 2027 effective date arrives with a functioning independent authority in place or with Komdigi's interim competence continuing by default.

Sources and claims (11)
  1. Uncertain Adaptist Consulting — Kementerian Komunikasi dan Digital (Komdigi) requires: Pending establishment of the Lembaga PDP, Komdigi's Directorate General of Digital Space Supervision exercises interim data-protection oversight under secondary instruments such as Permenkominfo 5/2020. observed
  2. Uncertain Adaptist Consulting — Lembaga PDP (draft Presidential Regulation) grants: The draft Presidential Regulation establishing the Lembaga PDP completed inter-ministerial harmonisation and was submitted to the President on 20 May 2026 but remained unsigned as of 19 August 2026. observed
  3. Uncertain Adaptist Consulting — UU PDP (Law No. 27 of 2022) — Became fully enforceable 17 October 2024, ending its two-year transition period; the law's mandated independent supervisory authority (Lembaga PDP) has still not been established. observed
  4. Uncertain Rajah & Tann Asia — Draft Presidential Regulation establishing the PDP Agency — Made public end of February 2026, remains pending presidential approval; June 2026 Constitutional Court petition challenges the lack of a statutory establishment deadline. observed
  5. Uncertain PPC Land — UU PDP (Law No. 27 of 2022) — Indonesia's core omnibus data-protection statute, modelled on GDPR. observed
  6. Uncertain dataprotection.gi — UU PDP — Extraterritorial coverage capturing foreign organisations processing Indonesian users' personal data or targeting the Indonesian market. observed
  7. Uncertain Nusantara DFDL — GR 33/2026, the implementing regulation for the PDP Law, was signed 16 July 2026 and enters into force 16 January 2027. observed
  8. Uncertain Adaptist Consulting — Komdigi enforces the PDP Law using the PSE registration regime pending establishment of the Lembaga PDP. observed
  9. Uncertain DLA Piper — Personal Data Protection Agency (PDP Agency) — Independent PDP Agency mandated by the PDP Law not fully established; interim competence with Komdigi. observed
  10. Uncertain https://adaptistconsulting.com/reports/indonesias-pdp-law-is-fully-enforceable-without-regulator/ — Kementerian Komunikasi dan Digital (Komdigi) — Pending establishment of the Lembaga PDP, Komdigi's Directorate General of Digital Space Supervision exercises interim data-protection oversight under secondary instruments such as Permenkominfo 5/2020
  11. Uncertain https://adaptistconsulting.com/reports/indonesias-pdp-law-is-fully-enforceable-without-regulator/ — Lembaga PDP (draft Presidential Regulation) — The draft Presidential Regulation establishing the Lembaga PDP completed inter-ministerial harmonisation and was submitted to the President on 20 May 2026 but remained unsigned as of 19 August 2026

#

No standing position recorded for this category.

Category narrative 181 words

Lawful Processing & Special Data

Government Regulation No. 33 of 2026 establishes six lawful bases for processing personal data: consent, contractual necessity, legal obligation, vital interests, public interest or authority, and a newly added legitimate-interests basis. The addition of a legitimate-interests basis is a notable expansion, since it gives controllers a processing ground that does not depend on obtaining consent or on one of the other more narrowly defined bases, broadening the practical scope for lawful processing under the elaborated regulation once it takes effect on 16 January 2027.

Periodic update · new data 2026-10-25

Lawful Processing & Special Data

GR 33/2026 sets out detailed conditions for each lawful processing basis recognised under the PDP Law and is understood to clarify the legitimate-interest balancing test, though the precise pinpoint provision establishing that clarification has not been independently confirmed against a primary text. This development sits within the broader implementing regulation entering into force on 16 January 2027, and represents the first detailed operationalisation of the PDP Law's lawful-basis framework since the statute's 2022 enactment.

Outlook

As 16 January 2027 approaches, controllers relying on legitimate interest as a processing basis will want to confirm the precise balancing-test criteria once GR 33/2026's full text and any further implementing guidance is available, given that the pinpoint provision remains unconfirmed in current secondary reporting.

1 earlier distinct update(s)
Periodic update · new data 2026-10-18

Lawful Processing & Special Data

GR 33/2026 sets out detailed conditions for each lawful processing basis recognised under the PDP Law and is understood to clarify the legitimate-interest balancing test, though the precise pinpoint provision establishing that clarification has not been independently confirmed against a primary text this cycle. This development sits within the broader implementing regulation entering into force on 16 January 2027, and represents the first detailed operationalisation of the PDP Law's lawful-basis framework since the statute's 2022 enactment.

Outlook

As 16 January 2027 approaches, controllers relying on legitimate interest as a processing basis will want to confirm the precise balancing-test criteria once GR 33/2026's full text and any further implementing guidance is available, given that the pinpoint provision remains unconfirmed in current secondary reporting.

Sources and claims (1)
  1. Uncertain HLC — Government Regulation No. 33 of 2026 — Six lawful bases for processing under PDP Law Art. 20, each with own conditions, notice duties and documentation obligations. observed

#

No standing position recorded for this category.

Category narrative 176 words

Data Subject Rights

Government Regulation No. 33 of 2026 is reported to confirm a 72-hour response window applying across multiple data-subject rights, an operational detail that gives UU PDP's rights provisions a concrete compliance deadline that controllers can plan against once the regulation takes effect on 16 January 2027. This is reported with Probable confidence rather than Confirmed, reflecting that the specific article-level enumeration of which rights the 72-hour window applies to, and whether any exceptions exist, has not been independently corroborated to the same degree as other GR 33/2026 provisions this cycle.

Periodic update · new data 2026-10-18

Data Subject Rights

GR 33/2026 operationalises data subject rights under the PDP Law, including access, rectification, deletion, portability and objection to automated decision-making, with specific procedural rules addressing children and persons with disabilities. This is reported as a probable development, giving concrete procedural substance to rights that previously existed only at the level of the primary statute.

Outlook

The procedural detail GR 33/2026 adds to rights exercised by or on behalf of children and persons with disabilities will be a key area to monitor as implementing guidance develops ahead of the regulation's 16 January 2027 effective date.

Sources and claims (1)
  1. Uncertain dataprotection.gi — UU PDP — 72-hour breach notification to affected individuals and the supervisory authority; Article 12 grants an explicit private right of action for civil compensation. observed

#

No standing position recorded for this category.

Category narrative 208 words

Controller/Processor Duties

Government Regulation No. 33 of 2026 tightens controller and processor duties on two distinct fronts. First, it removes the prior draft regulation's exemption from breach-notification for breaches not resulting in unlawful disclosure, instead requiring notification of any failure of personal data protection — a materially broader notification trigger than the earlier draft formulation, meaning a wider range of incidents will now require notification once the regulation takes effect. Second, it addresses the specific scenario of corporate restructuring, such as a merger or acquisition, that involves a data transfer: in that scenario, the old and new controllers are treated as joint controllers until the restructuring is legally completed, and a data protection impact assessment update is required as part of that process.

Periodic update · new data 2026-10-18

Controller/Processor Duties

Controllers' obligations under Indonesia's PDP framework tightened on several fronts. GR 33/2026 requires breach notification to data subjects and to the Authority (or its interim overseer) within 72 hours, with the clock starting once a breach is known "definitively, properly, and reasonably," a standard that removes a non-disclosure exemption that had appeared in the regulation's earlier draft. Separately, Constitutional Court Decision No. 151/PUU-XXII/2024 clarified that the three criteria triggering a controller's duty to appoint a Data Protection Officer under Article 53(1) are disjunctive, read as "and/or": satisfying any single one of the three criteria is sufficient to trigger the duty, materially broadening the population of entities subject to the DPO-appointment requirement beyond what a cumulative reading would have required. GR 33/2026 further clarifies that, during a corporate restructuring, the old and new data controllers are treated as joint controllers until the restructuring is legally completed.

Outlook

The removal of the non-disclosure exemption from the breach-notification duty, together with the broadened DPO-trigger population following Decision No. 151/PUU-XXII/2024, together raise the practical compliance burden on controllers ahead of GR 33/2026's 16 January 2027 effective date; organisations that had not previously concluded a DPO appointment was required should reassess against the disjunctive reading.

Sources and claims (4)
  1. Uncertain Adaptist Consulting — Constitutional Court decision ('MK 151') — Lowered the DPO-appointment threshold under UU PDP Article 53 such that any single statutory condition now triggers the appointment duty. observed
  2. Uncertain Mori Hamada & Matsumoto — Government Regulation No. 33 of 2026 — DPO function in a dedicated chapter; appointment threshold not independently verified. observed
  3. Uncertain Lexology — Government Regulation No. 33 of 2026 — Joint controllership and mandatory controller-processor contract terms. observed
  4. Uncertain Mori Hamada & Matsumoto — Government Regulation No. 33 of 2026 — Data security and breach notification as a distinct chapter; specific notification deadline not independently verified. observed

#

No standing position recorded for this category.

Category narrative 217 words

Cross-Border & Adequacy

Government Regulation No. 33 of 2026 establishes a three-tier framework for cross-border personal data transfers. An adequacy determination is assessed first; where adequacy is not satisfied, binding safeguards such as standard contractual clauses or binding corporate rules apply; where neither adequacy nor binding safeguards are satisfied, data-subject consent remains available as the transfer basis. This is a structurally familiar tiered approach, but a critical operational limitation sits alongside it: the mechanisms this framework describes, including any adequacy-determination process, cannot yet be fully operationalised in the absence of the Lembaga PDP, the independent authority that UU PDP Article 58 mandates and that remains unestablished pending resolution of its own Constitutional Court review.

Periodic update · new data 2026-10-18

Cross-Border & Adequacy

The Constitutional Court, in Case No. 137/PUU-XXIII/2025, upheld the PDP Law's Article 56 tiered cross-border-transfer framework and rejected a proposed requirement for parliamentary pre-approval of transfers, while itself noting that the Personal Data Protection Authority "has yet to be established." This ruling confirms the transfer framework's constitutional validity while simultaneously highlighting the institutional gap that leaves its practical oversight incomplete. Separately, and predating the PDP Law, commercial banks remain required to obtain prior OJK approval before establishing a data centre or data processing arrangement outside Indonesian territory, a sector-specific localisation-adjacent rule that continues to operate alongside the general PDP cross-border regime.

Outlook

The tiered transfer framework under Article 56 is now judicially settled in its basic validity, but its practical application remains dependent on the Authority's eventual establishment; parties relying on cross-border transfer mechanisms should track whether further technical regulations clarify the tiers' operational detail ahead of GR 33/2026's effective date.

Sources and claims (2)
  1. Uncertain Rajah & Tann Asia — U.S.-Indonesia Agreement on Reciprocal Trade — Includes cross-border data-transfer commitments to the United States, dated 19 February 2026. observed
  2. Uncertain Lexology — Government Regulation No. 33 of 2026 — Cross-border transfers and international cooperation; specific transfer-mechanism test not independently verified. observed

#

No standing position recorded for this category.

Absence reason not determinableNo narrative exists and the JID records no gap or review marker explaining why. The renderer will not invent a reason.
Sources and claims (1)
  1. Uncertain PPC Land — OJK AI-governance guidelines — Establishes binding expectations for banks, insurers and fintech companies OJK regulates, mandatory only for OJK-regulated entities and distinct from the general UU PDP framework. observed

#

No standing position recorded for this category.

Absence reason not determinableNo narrative exists and the JID records no gap or review marker explaining why. The renderer will not invent a reason.

#

No standing position recorded for this category.

Category narrative 182 words

Algorithmic, Biometric & Surveillance Governance

Government Regulation No. 33 of 2026 is reported to add detail on automated decision-making as part of its broader elaboration of UU PDP, though the pinpoint article addressing this detail has not been retrieved this cycle. This leaves the precise content of the new automated decision-making provisions — whether, for example, they establish a right to human review, a notification obligation, or specific restrictions on fully-automated decisions with legal or similarly significant effects on data subjects — currently unconfirmed from available sourcing, notwithstanding the general direction that GR 33/2026 does address this area in some form.

Periodic update · new data 2026-10-25

Algorithmic, Biometric & Surveillance Governance

GR 33/2026 is reported to add AI-relevant duties alongside its breach-notification, DPO and data-subject-rights provisions, though the specific pinpoint article establishing these duties has not been independently located. This finding is accordingly held at an uncertain confidence level pending confirmation against the regulation's full text.

Outlook

Confirmation of the precise AI-relevant provisions within GR 33/2026's text, once available, is the key item to watch for this dimension ahead of the regulation's 16 January 2027 effective date.

1 earlier distinct update(s)
Periodic update · new data 2026-10-18

Algorithmic, Biometric & Surveillance Governance

GR 33/2026 is reported to add AI-relevant duties alongside its breach-notification, DPO and data-subject-rights provisions, though the specific pinpoint article establishing these duties has not been independently located this cycle. This finding is accordingly held at an uncertain confidence level pending confirmation against the regulation's full text.

Outlook

Confirmation of the precise AI-relevant provisions within GR 33/2026's text, once available, is the key item to watch for this dimension ahead of the regulation's 16 January 2027 effective date.

#

No standing position recorded for this category.

Category narrative 121 words

Children & Vulnerable Groups

GR 33/2026 defines a child as any person under eighteen years of age who is unmarried, and requires controllers to actively identify children among their data subjects and to verify parental consent using available technology, including a transition mechanism as a child reaches adulthood. Comparable accessibility mechanisms are provided for persons with disabilities. These provisions give concrete procedural content to protections that existed only generally under the PDP Law prior to this implementing regulation.

No new data since the standing brief. 1 periodic run re-emitted it unchanged.

Sources and claims (1)
  1. Uncertain ABNR — GR 33/2026 — A child is any person under 18 and unmarried; controllers must actively identify children and verify parental consent using available technology, with transition mechanism at adulthood; similar accessibility mechanisms for persons with disabilities. observed

#

No standing position recorded for this category.

Sub-modules (1)

Regulator Powers And PenaltiesNot assessed

No narrative recorded for this sub-module.

Claims (7):

  • UU PDP (Law No. 27 of 2022) imposes: UU PDP reserves administrative sanctions (written warning, temporary suspension of processing, and further tiers) to the PDP Agency; these remain structurally unavailable because the Agency has not been established.
  • UU PDP administrative fine provision — Fines of up to 2% of annual revenue remain structurally unavailable because the PDP Agency empowered to impose them has not been established, nearly two years after the law became fully enforceable.
  • UU PDP Article 57 / GR 33/2026 — Written warnings, temporary/permanent suspension of processing, deletion of personal data, and administrative fines up to 2% of the controller's/processor's annual revenue.
  • Government Regulation No. 33 of 2026 — Administrative sanctions for PDP Law violations; specific fine tiers not independently verified.
  • GR 33/2026 — Administrative fines of up to 2% of annual revenue apply across the PDP compliance framework.
  • The statutory administrative-sanctions machinery of the PDP Law cannot yet be exercised pending establishment of the independent Personal Data Protection Agency.
  • UU PDP (Law No. 27 of 2022) — UU PDP reserves administrative sanctions (written warning, temporary suspension of processing, and further tiers) to the PDP Agency; these remain structurally unavailable because the Agency has not been established
Category narrative 195 words

Enforcement & Redress

UU PDP reserves its administrative sanctions regime, a written warning, temporary suspension of processing, and further escalating tiers, to the Personal Data Protection Agency specifically. Because that Agency has not been established, these administrative sanctions remain structurally unavailable in practice, notwithstanding that the statute has been in force since 2022. This is distinct from the statute's criminal-sanction provisions, which remain enforceable through the ordinary public prosecutor regardless of the Agency's absence, meaning the most severe category of liability under Indonesian data-protection law is not contingent on the Agency's establishment even though the administrative, regulator-led track is.

Periodic update · new data 2026-11-04

Enforcement & Redress

The administrative sanctions provided for in Indonesia's data protection statute are reported to remain unexercisable because the independent Personal Data Protection Agency responsible for imposing them has not been established. As of 21 July 2026, a deputy minister is reported to have indicated that the Presidential Regulation establishing the agency remained roughly two months away, and the underlying statutory provision mandating the agency's creation is reported to be under constitutional review before the Constitutional Court, in a case docketed as 236/PUU-XXIV/2026. Whether that case has been decided since is not established on the available record. In the interim, enforcement activity rests with Komdigi's Directorate General of Digital Space Supervision, operating through the electronic-system-provider registration regime rather than the dedicated sanctions mechanism the statute contemplates.

Outlook

The practical reach of enforcement in this area will not change materially until either the Personal Data Protection Agency is established or the constitutional challenge to the law mandating its creation is resolved. Both are open questions carried forward from the position reported in July 2026.

2 earlier distinct update(s)
Periodic update · new data 2026-10-18

Enforcement & Redress

GR 33/2026 confirms that administrative fines of up to two percent of annual revenue apply across the PDP compliance framework, giving concrete financial consequence to the obligations the regulation operationalises. Set against this, enforcement remains institutionally incomplete: the Personal Data Protection Authority mandated by the PDP Law has still not been established, and Constitutional Court Case No. 236/PUU-XXIV/2026, filed to compel the government to establish the Authority within a fixed deadline, remains unresolved, with the Ministry of Communication and Digital Affairs having opposed a court-imposed deadline as of 27 July 2026.

Outlook

The outcome of Case No. 236/PUU-XXIV/2026 is the central enforcement-dimension development to watch: a ruling compelling establishment of the Authority within a fixed timeframe would materially change the practical enforceability of the two-percent fine ceiling and the broader GR 33/2026 framework before or shortly after its 16 January 2027 effective date.

Periodic update · new data 2026-10-11

Enforcement & Redress

UU PDP Article 57, as elaborated by Government Regulation No. 33 of 2026, empowers the PDP Authority to impose a graduated set of sanctions: written warnings, temporary or permanent suspension of processing, deletion of personal data, and administrative fines of up to 2% of a controller's or processor's annual revenue. This is a substantial enforcement toolkit on paper, comparable in structure to administrative-fine regimes found in other jurisdictions' data protection laws.

However, because the PDP Authority itself remains unestablished pending resolution of the Constitutional Court review of the delay in its creation, this administrative fine regime is reported as structurally unavailable in practice: there is currently no body empowered to impose it. Ongoing enforcement in Indonesia is understood to rely mainly on criminal sanctions under UU PDP and the ITE Law instead, a materially different enforcement posture than the administrative-fine model GR 33/2026 elaborates on paper. The ten statutory variables for fine calculation under GR 33/2026 Article 185(2) have not been enumerated in secondary reporting located this cycle, so even once the PDP Authority is established, the precise mechanics of how a fine would be calculated remain to be confirmed.

Outlook

The establishment of the Lembaga PDP remains the single precondition for the administrative-fine regime to become operative; until then, criminal sanctions under UU PDP and the ITE Law remain the practical enforcement mechanism, and this gap should be tracked closely against the pending Constitutional Court review's resolution.

Sources and claims (13)
  1. Uncertain DLA Piper — UU PDP (Law No. 27 of 2022) imposes: UU PDP reserves administrative sanctions (written warning, temporary suspension of processing, and further tiers) to the PDP Agency; these remain structurally unavailable because the Agency has not been established. observed
  2. Uncertain Adaptist Consulting — UU PDP administrative fine provision — Fines of up to 2% of annual revenue remain structurally unavailable because the PDP Agency empowered to impose them has not been established, nearly two years after the law became fully enforceable. observed
  3. Uncertain Rajah & Tann Asia — West Jakarta District Court — PDP Law enforcement remains secondary in practice to the ITE Law; a notable civil case invoking data-protection issues was filed January 2026. observed
  4. Uncertain DLA Piper — PDP Law enforcement — Enforcement to date characterised as quite low, attributed to absence (until July 2026) of implementing regulations and still-pending PDP Agency establishment. observed
  5. Uncertain Lexology — PDP Law — Constitutional review before Indonesia's Constitutional Court through multiple petitions, as of August 2026 reporting; status not re-verified this cycle. observed
  6. Uncertain PSHP Adrem — UU PDP Article 57 / GR 33/2026 — Written warnings, temporary/permanent suspension of processing, deletion of personal data, and administrative fines up to 2% of the controller's/processor's annual revenue. observed
  7. Uncertain Chambers Practice Guides — Indonesia PDP enforcement practice — Pending PDP Authority establishment, the 2%-of-revenue administrative fine remains structurally unavailable; ongoing enforcement relies mainly on criminal sanctions under UU PDP and the ITE Law. observed
  8. Uncertain Lexology — Government Regulation No. 33 of 2026 — Administrative sanctions for PDP Law violations; specific fine tiers not independently verified. observed
  9. Uncertain Rajah & Tann — GR 33/2026 — Administrative fines of up to 2% of annual revenue apply across the PDP compliance framework. observed
  10. Uncertain HLC — Constitutional Court Case No. 236/PUU-XXIV/2026 — Asks the Court to order the government to establish the PDPA within a deadline; on 27 July 2026 MOCD opposed a court-imposed deadline. observed
  11. Uncertain dataprotection.gi — The statutory administrative-sanctions machinery of the PDP Law cannot yet be exercised pending establishment of the independent Personal Data Protection Agency. observed
  12. Uncertain PPC Land — As of 21 July 2026, the Perpres establishing the Lembaga PDP remained pending and the law mandating the body was under constitutional review as Case 236/PUU-XXIV/2026. observed
  13. Uncertain https://www.dlapiperdataprotection.com/guide.pdf?c=ID — UU PDP (Law No. 27 of 2022) — UU PDP reserves administrative sanctions (written warning, temporary suspension of processing, and further tiers) to the PDP Agency; these remain structurally unavailable because the Agency has not been established
No categories match.

Filters combine as OR inside a group and AND across groups.

Provenance and declared absence

Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.

Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category across all regulatory modules.

Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.

Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score. Not shown on this page.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-11-04. A year-precision row is never promoted into a tighter band.

Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 3 sub-module(s), 34 claim(s) (34 category placement(s)), 30 source(s) in the cumulative register.

Audit trail

Machine checkChallenged on 24 Oct 2026: not upheld (10 confirmed against the cited source; 1 contradicted by the cited source; 5 could not be checked). An automated, adversarial test run by a second model; no person has assessed the result.

Think something on this page is wrong? Report an error.

GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped).

Show article map
GDPR article to category mapping
ArticleCategorySub-module
Art. 5Controller/Processor Dutiesaccountability and dpia
Art. 6Lawful Processing & Special Datalawful bases
Art. 7Lawful Processing & Special Dataconsent thresholds
Art. 9Lawful Processing & Special Dataspecial categories
Art. 13Data Subject Rightsaccess right
Art. 14Data Subject Rightsaccess right
Art. 15Data Subject Rightsaccess right
Art. 16Data Subject Rightsrectification and erasure
Art. 17Data Subject Rightsrectification and erasure
Art. 18Data Subject Rightsrestriction and objection
Art. 19Data Subject Rightsrectification and erasure
Art. 20Data Subject Rightsdata portability
Art. 21Data Subject Rightsrestriction and objection
Art. 22Algorithmic, Biometric & Surveillance Governanceautomated decision making transparency
Art. 25Controller/Processor Dutiesaccountability and dpia
Art. 28Controller/Processor Dutiesjoint controller arrangements
Art. 30Controller/Processor Dutiesropa requirements
Art. 32Controller/Processor Dutiessecurity measures
Art. 33Controller/Processor Dutiesbreach notification
Art. 34Controller/Processor Dutiesbreach notification
Art. 35Controller/Processor Dutiesaccountability and dpia
Art. 37Controller/Processor Dutiesdpo requirements
Art. 38Controller/Processor Dutiesdpo requirements
Art. 39Controller/Processor Dutiesdpo requirements
Art. 44Cross-Border & Adequacytransfer mechanisms
Art. 45Cross-Border & Adequacyadequacy granted
Art. 46Cross-Border & Adequacysccs and bcrs
Art. 47Cross-Border & Adequacysccs and bcrs
Art. 48Cross-Border & Adequacydata localisation
Art. 49Cross-Border & Adequacytransfer impact assessment
Art. 77Enforcement & Redressregulator powers and penalties
Art. 78Enforcement & Redressprivate right of action
Art. 79Enforcement & Redressprivate right of action
Art. 80Enforcement & Redresscollective redress and class actions
Art. 81Enforcement & Redressregulator powers and penalties
Art. 82Enforcement & Redressregulator powers and penalties
Art. 83Enforcement & Redressregulator powers and penalties
Art. 84Enforcement & Redressregulator powers and penalties