--- title: "Indonesia Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/indonesia/ source_html: /jurisdictions/indonesia/index.html description: "Indonesia data protection and privacy regulation: 10 categories, 34 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border…" generated_at: 2026-11-07T14:58:19Z content_sha256: 29fc0345b2719d0c86f0d2fe82c7d36024961ffe377fa5decb7b5eeaaf79c03b generator: "fe-fleet/md-twin@1.0" --- # Indonesia Data Protection & Privacy Regulation | Data Protection Monitor Based mainly on secondary sources. Only 2 of the sources retrieved for this jurisdiction are official or direct reporting of official material (tier 1 or 2), against the 3 we look for. No finding on this page is shown with confidence above “Uncertain” until stronger sources are retrieved. # Indonesia Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/indonesia/), [World Payments](https://payments.gi/jurisdictions/indonesia/) Last updated 2026-11-04 · 10 categories · 34 claims · 30 sources in the cumulative register Download report (PDF) Expand all Indonesia's data-protection regime remains structurally unable to impose the administrative sanctions its own statute provides for, because the independent Personal Data Protection Agency, the Lembaga PDP, has still not been established. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not covered: Lawful Processing & Special Data, Data Subject Rights, Controller/Processor Duties, Cross-Border & Adequacy, Sectoral Watch, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups. Not fully checked this cycle: Regulator & Framework, Enforcement & Redress (3 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=INDONESIA)[Build Report](/reports/?j=INDONESIA)[Compare](/compare/?j=INDONESIA) Framework posture Monitored baseline 0 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Adaptist Consulting Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) 2026-Q4 PDP Agency establishment via Presidential Regulation Module coverage & confidence 0 / 10 modules assessed 0 Confirmed · 0 Probable · 0 Uncertain · 10 Not yet assessed 10 Categories 0 Red categories 3 Sub-modules 34 Claims 0 Tier-1 sources Traffic-light mix 10 n/a (sums to 10 rendered categories; click to filter) No categories are currently flagged red. ## Jurisdiction brief Jurisdiction lead brief 703 Full executive summary 163 ###### Latest update · 4 November 2026 #### Lead Signal Indonesia's data protection framework reached a further stage of codification in the period under review with the promulgation of Government Regulation No. 33 of 2026, signed by President Prabowo Subianto on 16 July 2026. The regulation is understood to be the implementing regulation for the 2022 data protection statute, and is reported to enter into force on 16 January 2027. A savings provision is understood to preserve existing rules in the interim, pending further technical regulations that are themselves to be issued by the Personal Data Protection Authority once that body exists. That qualification matters: the authority named to issue those follow-on rules has still not been established by Presidential Regulation, so the implementing regulation now sits in force on paper while the institution meant to operationalise important parts of it remains absent. #### Other Developments Reports indicate the Ministry of Communication and Digital Affairs (Komdigi), through its Directorate General of Digital Space Supervision, continues to carry interim oversight, enforcing data-handling obligations through the existing electronic-system-provider registration regime rather than through the dedicated data protection authority envisaged by the statute. Separately, as of 21 July 2026 a deputy minister is reported to have stated that the Presidential Regulation establishing the data protection authority remained roughly two months from completion, and that the underlying law mandating the authority's creation is under constitutional review before the Constitutional Court in a case docketed as 236/PUU-XXIV/2026. Whether that case has since been decided is not established in the material available for this period. #### Cross-Monitor Connections No material bearing on the artificial-intelligence, crypto, financial-integrity, world-payments, or advennt monitors was identified in the substrate available. #### Outlook The period ahead turns on two linked dates: the 16 January 2027 commencement of Government Regulation No. 33 of 2026, and whatever timeline follows from the pending Presidential Regulation establishing the data protection authority, now reported to be running behind the roughly two-month estimate given in July. Until that authority exists, the sanctions machinery the statute provides for cannot be exercised, leaving interim enforcement resting on Komdigi's registration-based powers rather than the dedicated regime the law contemplates. The constitutional challenge to the law mandating the authority's creation adds a further source of uncertainty to when, or in what form, that gap closes. 3 earlier updates not shown here. ###### Standing brief · as of 4 October 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Indonesia's data-protection regime remains structurally unable to impose the administrative sanctions its own statute provides for, because the independent Personal Data Protection Agency, the Lembaga PDP, has still not been established. The draft Presidential Regulation creating the Agency completed inter-ministerial harmonisation and was submitted to the President on 20 May 2026, but remained unsigned as of 19 August 2026. In the interim, Komdigi's Directorate General of Digital Space Supervision exercises data-protection oversight under secondary instruments such as Permenkominfo 5/2020, a stopgap rather than the statute's intended enforcement architecture. #### Other Developments Administrative sanctions remain unavailable in practice. UU PDP, Law No. 27 of 2022, reserves administrative sanctions, a written warning, temporary suspension of processing, and further escalating tiers, to the PDP Agency specifically; these sanctions remain structurally unavailable because the Agency has not been established, notwithstanding that the statute's criminal-sanction provisions remain enforceable through the ordinary public prosecutor in the meantime. #### Cross-Monitor Connections A data-localisation signal from the world-payments monitor is worth noting here without re-analysis: Bank Indonesia Regulation No. 10 of 2025, Article 122, mandates that domestic payment-transaction processing occur within Indonesian territory. This is a payments-sector localisation requirement, and it has not been independently verified this cycle against UU PDP's own cross-border transfer provisions; readers interested in the payments-specific analysis should consult the world-payments monitor directly. #### Outlook The non-signature of the Presidential Regulation establishing the Lembaga PDP, now extending well beyond its originally anticipated 2026 timeline, suggests the structural enforcement gap is likely to persist for some time absent an unforeseen executive action. The next concrete marker to watch is whether the regulation is signed, which would trigger the Agency's formal establishment and, with it, the activation of the administrative-sanctions regime that has so far remained dormant since the statute's 2022 enactment. Read full brief · 703 words Standing brief, as of 4 November 2026. #### Regulatory Status Indonesia's data protection regime now has both its primary statute and, as of 16 July 2026, an implementing Government Regulation (No. 33 of 2026), due to take effect 16 January 2027. The institution the statute assigns to enforce it, the independent Personal Data Protection Agency, has still not been established, so interim oversight continues under the Ministry of Communication and Digital Affairs (Komdigi) using the existing electronic-system-provider registration regime. Statutory administrative sanctions exist on paper but are reported to be unexercisable while the agency remains unformed, and the law mandating the agency's creation is itself under constitutional review. #### Outlook Two dates anchor the near-term picture: the 16 January 2027 commencement of the implementing regulation, and the still-unresolved timeline for the Presidential Regulation establishing the data protection agency, last reported in July 2026 as roughly two months away. The constitutional challenge before the Constitutional Court adds a further variable to when full enforcement capacity arrives. Read full brief · 163 words Key regulatory facts for Indonesia Regulatory Dimension Indonesia Standing Position Jurisdiction Indonesia (ID) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 34 sourced findings) Primary Instruments Cited Adaptist Consulting, Rajah & Tann Asia, PPC Land, dataprotection.gi, Nusantara DFDL Last Confirmed / Updated 2026-11-04 (30 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Indonesia: D1 Regulator & Framework 11 claims Not assessed ▾ No standing position recorded for this category. #### Sub-modules (2) #### Regulator And AuthorityNot assessed No narrative recorded for this sub-module. Claims (5): - Kementerian Komunikasi dan Digital (Komdigi) requires: Pending establishment of the Lembaga PDP, Komdigi's Directorate General of Digital Space Supervision exercises interim data-protection oversight under secondary instruments such as Permenkominfo 5/2020. - UU PDP (Law No. 27 of 2022) — Became fully enforceable 17 October 2024, ending its two-year transition period; the law's mandated independent supervisory authority (Lembaga PDP) has still not been established. - Draft Presidential Regulation establishing the PDP Agency — Made public end of February 2026, remains pending presidential approval; June 2026 Constitutional Court petition challenges the lack of a statutory establishment deadline. - Personal Data Protection Agency (PDP Agency) — Independent PDP Agency mandated by the PDP Law not fully established; interim competence with Komdigi. - Kementerian Komunikasi dan Digital (Komdigi) — Pending establishment of the Lembaga PDP, Komdigi's Directorate General of Digital Space Supervision exercises interim data-protection oversight under secondary instruments such as Permenkominfo 5/2020 #### Act And InstrumentsNot assessed No narrative recorded for this sub-module. Claims (4): - Lembaga PDP (draft Presidential Regulation) grants: The draft Presidential Regulation establishing the Lembaga PDP completed inter-ministerial harmonisation and was submitted to the President on 20 May 2026 but remained unsigned as of 19 August 2026. - UU PDP (Law No. 27 of 2022) — Indonesia's core omnibus data-protection statute, modelled on GDPR. - GR 33/2026, the implementing regulation for the PDP Law, was signed 16 July 2026 and enters into force 16 January 2027. - Lembaga PDP (draft Presidential Regulation) — The draft Presidential Regulation establishing the Lembaga PDP completed inter-ministerial harmonisation and was submitted to the President on 20 May 2026 but remained unsigned as of 19 August 2026 Indonesia's Personal Data Protection Law (UU PDP, Law No. 27/2022) has been fully enforceable since 17 October 2024, but the independent supervisory body it mandates, the Lembaga PDP (PDP Agency), remains unestablished. As of the most recent reporting located this cycle (19 August 2026), the draft Presidential Regulation (RPerpres) establishing the Agency had completed inter-ministerial review and harmonisation and was submitted to the President for signature on 20 May 2026, but remained unsigned. Interim data-protection oversight sits with Komdigi's Directorate General of Digital Space Supervision, acting under pre-PDP-era secondary instruments such as Permenkominfo 5/2020. Periodic update · new data 2026-11-04 #### Regulator & Framework Government Regulation No. 33 of 2026 was signed on 16 July 2026 and is reported to be the implementing regulation for Indonesia's data protection statute. It is understood to enter into force on 16 January 2027, with a savings provision preserving existing rules in the interim pending further technical regulations expected from the Personal Data Protection Authority, once that body is established. The authority itself, mandated by the statute, has not yet been established by Presidential Regulation, and interim oversight continues to sit with the Ministry of Communication and Digital Affairs (Komdigi) through its Directorate General of Digital Space Supervision, which is reported to enforce obligations using the existing electronic-system-provider registration regime rather than a dedicated data protection enforcement mechanism. #### Outlook The commencement of Government Regulation No. 33 of 2026 on 16 January 2027 will be the next material date in this framework's development, but its practical effect depends on whether the Personal Data Protection Authority has by then been established, since the regulation's own savings provision anticipates further technical rules from that body. 3 earlier distinct update(s) Periodic update · new data 2026-10-25 #### Regulator & Framework Indonesia's data-protection framework advanced with the promulgation of Government Regulation No. 33 of 2026 on 16 July 2026, published as Lembaran Negara 2026 No. 88, which will enter into force on 16 January 2027 and carries a savings provision preserving existing rules pending further technical regulations. This is the long-anticipated implementing regulation for the PDP Law. Set against this advance, the Personal Data Protection Authority mandated by Articles 58-61 of the PDP Law has still not been established by Presidential Regulation; Komdigi continues to perform interim oversight functions in its place. This institutional gap is now the subject of active litigation: Constitutional Court Case No. 236/PUU-XXIV/2026 asks the Court to order the government to establish the Authority within a fixed deadline, a position the Ministry of Communication and Digital Affairs opposed as of 27 July 2026. #### Outlook The period before GR 33/2026 takes effect on 16 January 2027 is the decisive window for this framework dimension: whether the Authority is established before that date, whether through the pending Case No. 236/PUU-XXIV/2026 litigation or through separate executive action, will determine whether GR 33/2026's provisions have a functioning supervisory body in place at commencement. Periodic update · new data 2026-10-18 #### Regulator & Framework Indonesia's data-protection framework advanced this cycle with the promulgation of Government Regulation No. 33 of 2026 on 16 July 2026, published as Lembaran Negara 2026 No. 88, which will enter into force on 16 January 2027 and carries a savings provision preserving existing rules pending further technical regulations. This is the long-anticipated implementing regulation for the PDP Law. Set against this advance, the Personal Data Protection Authority mandated by Articles 58-61 of the PDP Law has still not been established by Presidential Regulation; Komdigi continues to perform interim oversight functions in its place. This institutional gap is now the subject of active litigation: Constitutional Court Case No. 236/PUU-XXIV/2026 asks the Court to order the government to establish the Authority within a fixed deadline, a position the Ministry of Communication and Digital Affairs opposed as of 27 July 2026. #### Outlook The period before GR 33/2026 takes effect on 16 January 2027 is the decisive window for this framework dimension: whether the Authority is established before that date, whether through the pending Case No. 236/PUU-XXIV/2026 litigation or through separate executive action, will determine whether GR 33/2026's provisions have a functioning supervisory body in place at commencement. Periodic update · new data 2026-10-11 #### Regulator & Framework Indonesia's data protection framework rests on UU PDP, now substantially elaborated by Government Regulation No. 33 of 2026, promulgated 16 July 2026 and taking effect 16 January 2027. The independent authority UU PDP Article 58 mandates, the Lembaga PDP, remains unestablished: the enabling Presidential Regulation is understood to still be in harmonisation at the Ministry of Law, and the resulting delay is the subject of a Constitutional Court judicial review petition filed in June 2026. One account of this gap puts it directly: the dedicated authority the law mandates still does not exist, and neither implementing regulation has been signed. In the interim, the Komdigi Directorate General of Digital Space Supervision holds interim data-protection supervisory and enforcement competence, pursuant to Komdigi Regulation No. 1 of 2025. This interim arrangement means that, notwithstanding GR 33/2026's substantial operational detail across lawful processing, data subject rights, breach notification, cross-border transfer and enforcement, the entity actually exercising supervisory competence today is not the independent authority UU PDP envisages but a directorate general within the communications and digital ministry, pending that authority's eventual establishment. #### Outlook The operational status and timeline of the Lembaga PDP, particularly in light of the pending Constitutional Court review, is the central open question for this module; its resolution would determine whether GR 33/2026's 16 January 2027 effective date arrives with a functioning independent authority in place or with Komdigi's interim competence continuing by default. Sources and claims (11) - [Adaptist Consulting](https://adaptistconsulting.com/reports/indonesias-pdp-law-is-fully-enforceable-without-regulator/) — Kementerian Komunikasi dan Digital (Komdigi) requires: Pending establishment of the Lembaga PDP, Komdigi's Directorate General of Digital Space Supervision exercises interim data-protection oversight under secondary instruments such as Permenkominfo 5/2020. - [Adaptist Consulting](https://adaptistconsulting.com/reports/indonesias-pdp-law-is-fully-enforceable-without-regulator/) — Lembaga PDP (draft Presidential Regulation) grants: The draft Presidential Regulation establishing the Lembaga PDP completed inter-ministerial harmonisation and was submitted to the President on 20 May 2026 but remained unsigned as of 19 August 2026. - [Adaptist Consulting](https://adaptistconsulting.com/reports/indonesias-pdp-law-is-fully-enforceable-without-regulator/) — UU PDP (Law No. 27 of 2022) — Became fully enforceable 17 October 2024, ending its two-year transition period; the law's mandated independent supervisory authority (Lembaga PDP) has still not been established. - [Rajah & Tann Asia](https://www.rajahtannasia.com/viewpoints/indonesias-pdp-law-updates-dpa-u-s-trade%E2%80%91related-data-transfers-and-recent-court-rulings/) — Draft Presidential Regulation establishing the PDP Agency — Made public end of February 2026, remains pending presidential approval; June 2026 Constitutional Court petition challenges the lack of a statutory establishment deadline. - [PPC Land](https://ppc.land/indonesias-data-law-faces-court-test-with-dpa-rules-still-two-months-away/) — UU PDP (Law No. 27 of 2022) — Indonesia's core omnibus data-protection statute, modelled on GDPR. - [dataprotection.gi](https://dataprotection.gi/jurisdictions/indonesia/) — UU PDP — Extraterritorial coverage capturing foreign organisations processing Indonesian users' personal data or targeting the Indonesian market. - [Nusantara DFDL](https://www.nusantaradfdl.com/insights/indonesia-personal-data-protection-law-gr-33-2026/) — GR 33/2026, the implementing regulation for the PDP Law, was signed 16 July 2026 and enters into force 16 January 2027. - [Adaptist Consulting](https://adaptistconsulting.com/reports/indonesias-pdp-law-is-fully-enforceable-without-regulator/) — Komdigi enforces the PDP Law using the PSE registration regime pending establishment of the Lembaga PDP. - [DLA Piper](https://www.dlapiperdataprotection.com/?t=law&c=ID) — Personal Data Protection Agency (PDP Agency) — Independent PDP Agency mandated by the PDP Law not fully established; interim competence with Komdigi. - [https://adaptistconsulting.com/reports/indonesias-pdp-law-is-fully-enforceable-without-regulator/](https://adaptistconsulting.com/reports/indonesias-pdp-law-is-fully-enforceable-without-regulator/) — Kementerian Komunikasi dan Digital (Komdigi) — Pending establishment of the Lembaga PDP, Komdigi's Directorate General of Digital Space Supervision exercises interim data-protection oversight under secondary instruments such as Permenkominfo 5/2020 - [https://adaptistconsulting.com/reports/indonesias-pdp-law-is-fully-enforceable-without-regulator/](https://adaptistconsulting.com/reports/indonesias-pdp-law-is-fully-enforceable-without-regulator/) — Lembaga PDP (draft Presidential Regulation) — The draft Presidential Regulation establishing the Lembaga PDP completed inter-ministerial harmonisation and was submitted to the President on 20 May 2026 but remained unsigned as of 19 August 2026 ### Indonesia: D2 Lawful Processing & Special Data Not assessed ▾ No standing position recorded for this category. #### Lawful Processing & Special Data Government Regulation No. 33 of 2026 establishes six lawful bases for processing personal data: consent, contractual necessity, legal obligation, vital interests, public interest or authority, and a newly added legitimate-interests basis. The addition of a legitimate-interests basis is a notable expansion, since it gives controllers a processing ground that does not depend on obtaining consent or on one of the other more narrowly defined bases, broadening the practical scope for lawful processing under the elaborated regulation once it takes effect on 16 January 2027. The full enumerated list of processing categories requiring explicit consent under GR 33/2026, reportedly set out across several articles of the regulation, has not been located in secondary reporting this cycle, so the precise boundary between processing permissible on a legitimate-interests or other basis and processing that still requires explicit consent cannot currently be stated with article-level precision. #### Outlook Locating the specific enumerated list of consent-requiring processing categories would resolve the current gap and allow a precise statement of how far the new legitimate-interests basis actually displaces the consent requirement in practice. Read full narrative · 181 words Periodic update · new data 2026-10-25 #### Lawful Processing & Special Data GR 33/2026 sets out detailed conditions for each lawful processing basis recognised under the PDP Law and is understood to clarify the legitimate-interest balancing test, though the precise pinpoint provision establishing that clarification has not been independently confirmed against a primary text. This development sits within the broader implementing regulation entering into force on 16 January 2027, and represents the first detailed operationalisation of the PDP Law's lawful-basis framework since the statute's 2022 enactment. #### Outlook As 16 January 2027 approaches, controllers relying on legitimate interest as a processing basis will want to confirm the precise balancing-test criteria once GR 33/2026's full text and any further implementing guidance is available, given that the pinpoint provision remains unconfirmed in current secondary reporting. 1 earlier distinct update(s) Periodic update · new data 2026-10-18 #### Lawful Processing & Special Data GR 33/2026 sets out detailed conditions for each lawful processing basis recognised under the PDP Law and is understood to clarify the legitimate-interest balancing test, though the precise pinpoint provision establishing that clarification has not been independently confirmed against a primary text this cycle. This development sits within the broader implementing regulation entering into force on 16 January 2027, and represents the first detailed operationalisation of the PDP Law's lawful-basis framework since the statute's 2022 enactment. #### Outlook As 16 January 2027 approaches, controllers relying on legitimate interest as a processing basis will want to confirm the precise balancing-test criteria once GR 33/2026's full text and any further implementing guidance is available, given that the pinpoint provision remains unconfirmed in current secondary reporting. Sources and claims (1) - [HLC](https://www.hlc.com/en/publications/indonesias-personal-data-protection-law-implementing-regulation-arrives-quietly) — Government Regulation No. 33 of 2026 — Six lawful bases for processing under PDP Law Art. 20, each with own conditions, notice duties and documentation obligations. ### Indonesia: D3 Data Subject Rights Not assessed ▾ No standing position recorded for this category. #### Data Subject Rights Government Regulation No. 33 of 2026 is reported to confirm a 72-hour response window applying across multiple data-subject rights, an operational detail that gives UU PDP's rights provisions a concrete compliance deadline that controllers can plan against once the regulation takes effect on 16 January 2027. This is reported with Probable confidence rather than Confirmed, reflecting that the specific article-level enumeration of which rights the 72-hour window applies to, and whether any exceptions exist, has not been independently corroborated to the same degree as other GR 33/2026 provisions this cycle. Taken together with the broader pattern across GR 33/2026's other provisions, a 72-hour response window would represent a comparatively short compliance window for responding to data-subject requests once the regulation is in force, and controllers operating in Indonesia should treat this as the operative planning assumption pending any further confirmation. #### Outlook Further confirmation of exactly which data-subject rights the 72-hour window applies to, and whether exceptions exist for complex requests, would sharpen the compliance picture ahead of the 16 January 2027 effective date. Read full narrative · 176 words Periodic update · new data 2026-10-18 #### Data Subject Rights GR 33/2026 operationalises data subject rights under the PDP Law, including access, rectification, deletion, portability and objection to automated decision-making, with specific procedural rules addressing children and persons with disabilities. This is reported as a probable development, giving concrete procedural substance to rights that previously existed only at the level of the primary statute. #### Outlook The procedural detail GR 33/2026 adds to rights exercised by or on behalf of children and persons with disabilities will be a key area to monitor as implementing guidance develops ahead of the regulation's 16 January 2027 effective date. Sources and claims (1) - [dataprotection.gi](https://dataprotection.gi/jurisdictions/indonesia/) — UU PDP — 72-hour breach notification to affected individuals and the supervisory authority; Article 12 grants an explicit private right of action for civil compensation. ### Indonesia: D4 Controller/Processor Duties Not assessed ▾ No standing position recorded for this category. #### Controller/Processor Duties Government Regulation No. 33 of 2026 tightens controller and processor duties on two distinct fronts. First, it removes the prior draft regulation's exemption from breach-notification for breaches not resulting in unlawful disclosure, instead requiring notification of any failure of personal data protection — a materially broader notification trigger than the earlier draft formulation, meaning a wider range of incidents will now require notification once the regulation takes effect. Second, it addresses the specific scenario of corporate restructuring, such as a merger or acquisition, that involves a data transfer: in that scenario, the old and new controllers are treated as joint controllers until the restructuring is legally completed, and a data protection impact assessment update is required as part of that process. The pinpoint article or provision behind the removed breach-notification exemption has not been located this cycle, so while the direction and substance of the change — a broader notification trigger — is confirmed, the precise statutory language effecting that change cannot currently be cited at article level. #### Outlook Locating the specific article effecting the breach-notification exemption removal, and tracking the first instances of the joint-controller treatment being applied in an actual Indonesian corporate restructuring, are the two developments most likely to clarify this module further. Read full narrative · 208 words Periodic update · new data 2026-10-18 #### Controller/Processor Duties Controllers' obligations under Indonesia's PDP framework tightened on several fronts. GR 33/2026 requires breach notification to data subjects and to the Authority (or its interim overseer) within 72 hours, with the clock starting once a breach is known "definitively, properly, and reasonably," a standard that removes a non-disclosure exemption that had appeared in the regulation's earlier draft. Separately, Constitutional Court Decision No. 151/PUU-XXII/2024 clarified that the three criteria triggering a controller's duty to appoint a Data Protection Officer under Article 53(1) are disjunctive, read as "and/or": satisfying any single one of the three criteria is sufficient to trigger the duty, materially broadening the population of entities subject to the DPO-appointment requirement beyond what a cumulative reading would have required. GR 33/2026 further clarifies that, during a corporate restructuring, the old and new data controllers are treated as joint controllers until the restructuring is legally completed. #### Outlook The removal of the non-disclosure exemption from the breach-notification duty, together with the broadened DPO-trigger population following Decision No. 151/PUU-XXII/2024, together raise the practical compliance burden on controllers ahead of GR 33/2026's 16 January 2027 effective date; organisations that had not previously concluded a DPO appointment was required should reassess against the disjunctive reading. Sources and claims (4) - [Adaptist Consulting](https://adaptistconsulting.com/reports/indonesias-pdp-law-is-fully-enforceable-without-regulator/) — Constitutional Court decision ('MK 151') — Lowered the DPO-appointment threshold under UU PDP Article 53 such that any single statutory condition now triggers the appointment duty. - [Mori Hamada & Matsumoto](https://www.morihamada.com/en/insights/newsletters/145906) — Government Regulation No. 33 of 2026 — DPO function in a dedicated chapter; appointment threshold not independently verified. - [Lexology](https://www.lexology.com/library/detail.aspx?g=0482381c-58c3-4c1b-8bd8-d415a59544a2) — Government Regulation No. 33 of 2026 — Joint controllership and mandatory controller-processor contract terms. - [Mori Hamada & Matsumoto](https://www.morihamada.com/en/insights/newsletters/145906) — Government Regulation No. 33 of 2026 — Data security and breach notification as a distinct chapter; specific notification deadline not independently verified. ### Indonesia: D5 Cross-Border & Adequacy Not assessed ▾ No standing position recorded for this category. #### Cross-Border & Adequacy Government Regulation No. 33 of 2026 establishes a three-tier framework for cross-border personal data transfers. An adequacy determination is assessed first; where adequacy is not satisfied, binding safeguards such as standard contractual clauses or binding corporate rules apply; where neither adequacy nor binding safeguards are satisfied, data-subject consent remains available as the transfer basis. This is a structurally familiar tiered approach, but a critical operational limitation sits alongside it: the mechanisms this framework describes, including any adequacy-determination process, cannot yet be fully operationalised in the absence of the Lembaga PDP, the independent authority that UU PDP Article 58 mandates and that remains unestablished pending resolution of its own Constitutional Court review. This means that, notwithstanding GR 33/2026's detailed three-tier structure, a controller seeking to rely on an adequacy determination specifically may find that no such determination has yet been issued by any competent authority, since the authority contemplated to make such determinations does not yet exist in operational form. Binding safeguards and consent-based transfer remain the more immediately usable bases in the interim. #### Outlook Whether an interim adequacy-determination process is announced, whether through Komdigi's current interim competence or in anticipation of the Lembaga PDP's eventual establishment, is the key development to watch for cross-border transfer planning ahead of the 16 January 2027 effective date. Read full narrative · 217 words Periodic update · new data 2026-10-18 #### Cross-Border & Adequacy The Constitutional Court, in Case No. 137/PUU-XXIII/2025, upheld the PDP Law's Article 56 tiered cross-border-transfer framework and rejected a proposed requirement for parliamentary pre-approval of transfers, while itself noting that the Personal Data Protection Authority "has yet to be established." This ruling confirms the transfer framework's constitutional validity while simultaneously highlighting the institutional gap that leaves its practical oversight incomplete. Separately, and predating the PDP Law, commercial banks remain required to obtain prior OJK approval before establishing a data centre or data processing arrangement outside Indonesian territory, a sector-specific localisation-adjacent rule that continues to operate alongside the general PDP cross-border regime. #### Outlook The tiered transfer framework under Article 56 is now judicially settled in its basic validity, but its practical application remains dependent on the Authority's eventual establishment; parties relying on cross-border transfer mechanisms should track whether further technical regulations clarify the tiers' operational detail ahead of GR 33/2026's effective date. Sources and claims (2) - [Rajah & Tann Asia](https://www.rajahtannasia.com/viewpoints/indonesias-pdp-law-updates-dpa-u-s-trade%E2%80%91related-data-transfers-and-recent-court-rulings/) — U.S.-Indonesia Agreement on Reciprocal Trade — Includes cross-border data-transfer commitments to the United States, dated 19 February 2026. - [Lexology](https://www.lexology.com/library/detail.aspx?g=0482381c-58c3-4c1b-8bd8-d415a59544a2) — Government Regulation No. 33 of 2026 — Cross-border transfers and international cooperation; specific transfer-mechanism test not independently verified. ### Indonesia: D6 Sectoral Watch Not assessed ▾ No standing position recorded for this category. Absence reason not determinable No narrative exists and the JID records no gap or review marker explaining why. The renderer will not invent a reason. Sources and claims (1) - [PPC Land](https://ppc.land/indonesias-data-law-faces-court-test-with-dpa-rules-still-two-months-away/) — OJK AI-governance guidelines — Establishes binding expectations for banks, insurers and fintech companies OJK regulates, mandatory only for OJK-regulated entities and distinct from the general UU PDP framework. ### Indonesia: D7 AdTech & Commercial Privacy ▾ No standing position recorded for this category. Absence reason not determinable No narrative exists and the JID records no gap or review marker explaining why. The renderer will not invent a reason. ### Indonesia: D8 Algorithmic, Biometric & Surveillance Governance ▾ No standing position recorded for this category. #### Algorithmic, Biometric & Surveillance Governance Government Regulation No. 33 of 2026 is reported to add detail on automated decision-making as part of its broader elaboration of UU PDP, though the pinpoint article addressing this detail has not been retrieved this cycle. This leaves the precise content of the new automated decision-making provisions — whether, for example, they establish a right to human review, a notification obligation, or specific restrictions on fully-automated decisions with legal or similarly significant effects on data subjects — currently unconfirmed from available sourcing, notwithstanding the general direction that GR 33/2026 does address this area in some form. Given the Uncertain confidence attached to this development, reports suggest GR 33/2026 may add such detail, but the specific scope and mechanism cannot currently be stated with precision, and this should not be read as a confirmed new automated-decision-making right or obligation until the pinpoint provision is located and verified. #### Outlook Locating the specific article or articles within GR 33/2026 addressing automated decision-making is the clear next step needed to move this module from a watch item to a confirmed development. Read full narrative · 182 words Periodic update · new data 2026-10-25 #### Algorithmic, Biometric & Surveillance Governance GR 33/2026 is reported to add AI-relevant duties alongside its breach-notification, DPO and data-subject-rights provisions, though the specific pinpoint article establishing these duties has not been independently located. This finding is accordingly held at an uncertain confidence level pending confirmation against the regulation's full text. #### Outlook Confirmation of the precise AI-relevant provisions within GR 33/2026's text, once available, is the key item to watch for this dimension ahead of the regulation's 16 January 2027 effective date. 1 earlier distinct update(s) Periodic update · new data 2026-10-18 #### Algorithmic, Biometric & Surveillance Governance GR 33/2026 is reported to add AI-relevant duties alongside its breach-notification, DPO and data-subject-rights provisions, though the specific pinpoint article establishing these duties has not been independently located this cycle. This finding is accordingly held at an uncertain confidence level pending confirmation against the regulation's full text. #### Outlook Confirmation of the precise AI-relevant provisions within GR 33/2026's text, once available, is the key item to watch for this dimension ahead of the regulation's 16 January 2027 effective date. ### Indonesia: D9 Children & Vulnerable Groups Not assessed ▾ No standing position recorded for this category. #### Children & Vulnerable Groups GR 33/2026 defines a child as any person under eighteen years of age who is unmarried, and requires controllers to actively identify children among their data subjects and to verify parental consent using available technology, including a transition mechanism as a child reaches adulthood. Comparable accessibility mechanisms are provided for persons with disabilities. These provisions give concrete procedural content to protections that existed only generally under the PDP Law prior to this implementing regulation. #### Outlook Controllers processing data that may belong to minors should begin assessing what active-identification and parental-consent-verification technology they will need to have in place ahead of GR 33/2026's 16 January 2027 effective date, given the regulation's requirement for active rather than passive identification. Read full narrative · 121 words No new data since the standing brief. 1 periodic run re-emitted it unchanged. Sources and claims (1) - [ABNR](https://www.abnrlaw.com/news/indonesias-pdp-law-enters-a-new-phase-enforcement-moves-forward-under-gr-332026) — GR 33/2026 — A child is any person under 18 and unmarried; controllers must actively identify children and verify parental consent using available technology, with transition mechanism at adulthood; similar accessibility mechanisms for persons with disabilities. ### Indonesia: D10 Enforcement & Redress 13 claims Not assessed ▾ No standing position recorded for this category. #### Sub-modules (1) #### Regulator Powers And PenaltiesNot assessed No narrative recorded for this sub-module. Claims (7): - UU PDP (Law No. 27 of 2022) imposes: UU PDP reserves administrative sanctions (written warning, temporary suspension of processing, and further tiers) to the PDP Agency; these remain structurally unavailable because the Agency has not been established. - UU PDP administrative fine provision — Fines of up to 2% of annual revenue remain structurally unavailable because the PDP Agency empowered to impose them has not been established, nearly two years after the law became fully enforceable. - UU PDP Article 57 / GR 33/2026 — Written warnings, temporary/permanent suspension of processing, deletion of personal data, and administrative fines up to 2% of the controller's/processor's annual revenue. - Government Regulation No. 33 of 2026 — Administrative sanctions for PDP Law violations; specific fine tiers not independently verified. - GR 33/2026 — Administrative fines of up to 2% of annual revenue apply across the PDP compliance framework. - The statutory administrative-sanctions machinery of the PDP Law cannot yet be exercised pending establishment of the independent Personal Data Protection Agency. - UU PDP (Law No. 27 of 2022) — UU PDP reserves administrative sanctions (written warning, temporary suspension of processing, and further tiers) to the PDP Agency; these remain structurally unavailable because the Agency has not been established #### Enforcement & Redress UU PDP reserves its administrative sanctions regime, a written warning, temporary suspension of processing, and further escalating tiers, to the Personal Data Protection Agency specifically. Because that Agency has not been established, these administrative sanctions remain structurally unavailable in practice, notwithstanding that the statute has been in force since 2022. This is distinct from the statute's criminal-sanction provisions, which remain enforceable through the ordinary public prosecutor regardless of the Agency's absence, meaning the most severe category of liability under Indonesian data-protection law is not contingent on the Agency's establishment even though the administrative, regulator-led track is. The practical effect for any entity processing personal data in Indonesia is a bifurcated enforcement landscape: criminal exposure is live and prosecutable now, while the administrative enforcement track, warnings, processing suspensions, and the escalating remedies that would typically precede or substitute for criminal referral, remains dormant pending the Agency's formal establishment. #### Outlook The administrative-sanctions regime will activate once the Lembaga PDP is established, which in turn depends on the signature of the pending Presidential Regulation. Until then, enforcement activity, where it occurs, is likely to proceed through the criminal-prosecution channel rather than through regulator-issued administrative penalties. Read full narrative · 195 words Periodic update · new data 2026-11-04 #### Enforcement & Redress The administrative sanctions provided for in Indonesia's data protection statute are reported to remain unexercisable because the independent Personal Data Protection Agency responsible for imposing them has not been established. As of 21 July 2026, a deputy minister is reported to have indicated that the Presidential Regulation establishing the agency remained roughly two months away, and the underlying statutory provision mandating the agency's creation is reported to be under constitutional review before the Constitutional Court, in a case docketed as 236/PUU-XXIV/2026. Whether that case has been decided since is not established on the available record. In the interim, enforcement activity rests with Komdigi's Directorate General of Digital Space Supervision, operating through the electronic-system-provider registration regime rather than the dedicated sanctions mechanism the statute contemplates. #### Outlook The practical reach of enforcement in this area will not change materially until either the Personal Data Protection Agency is established or the constitutional challenge to the law mandating its creation is resolved. Both are open questions carried forward from the position reported in July 2026. 2 earlier distinct update(s) Periodic update · new data 2026-10-18 #### Enforcement & Redress GR 33/2026 confirms that administrative fines of up to two percent of annual revenue apply across the PDP compliance framework, giving concrete financial consequence to the obligations the regulation operationalises. Set against this, enforcement remains institutionally incomplete: the Personal Data Protection Authority mandated by the PDP Law has still not been established, and Constitutional Court Case No. 236/PUU-XXIV/2026, filed to compel the government to establish the Authority within a fixed deadline, remains unresolved, with the Ministry of Communication and Digital Affairs having opposed a court-imposed deadline as of 27 July 2026. #### Outlook The outcome of Case No. 236/PUU-XXIV/2026 is the central enforcement-dimension development to watch: a ruling compelling establishment of the Authority within a fixed timeframe would materially change the practical enforceability of the two-percent fine ceiling and the broader GR 33/2026 framework before or shortly after its 16 January 2027 effective date. Periodic update · new data 2026-10-11 #### Enforcement & Redress UU PDP Article 57, as elaborated by Government Regulation No. 33 of 2026, empowers the PDP Authority to impose a graduated set of sanctions: written warnings, temporary or permanent suspension of processing, deletion of personal data, and administrative fines of up to 2% of a controller's or processor's annual revenue. This is a substantial enforcement toolkit on paper, comparable in structure to administrative-fine regimes found in other jurisdictions' data protection laws. However, because the PDP Authority itself remains unestablished pending resolution of the Constitutional Court review of the delay in its creation, this administrative fine regime is reported as structurally unavailable in practice: there is currently no body empowered to impose it. Ongoing enforcement in Indonesia is understood to rely mainly on criminal sanctions under UU PDP and the ITE Law instead, a materially different enforcement posture than the administrative-fine model GR 33/2026 elaborates on paper. The ten statutory variables for fine calculation under GR 33/2026 Article 185(2) have not been enumerated in secondary reporting located this cycle, so even once the PDP Authority is established, the precise mechanics of how a fine would be calculated remain to be confirmed. #### Outlook The establishment of the Lembaga PDP remains the single precondition for the administrative-fine regime to become operative; until then, criminal sanctions under UU PDP and the ITE Law remain the practical enforcement mechanism, and this gap should be tracked closely against the pending Constitutional Court review's resolution. Sources and claims (13) - [DLA Piper](https://www.dlapiperdataprotection.com/guide.pdf?c=ID) — UU PDP (Law No. 27 of 2022) imposes: UU PDP reserves administrative sanctions (written warning, temporary suspension of processing, and further tiers) to the PDP Agency; these remain structurally unavailable because the Agency has not been established. - [Adaptist Consulting](https://adaptistconsulting.com/reports/indonesias-pdp-law-is-fully-enforceable-without-regulator/) — UU PDP administrative fine provision — Fines of up to 2% of annual revenue remain structurally unavailable because the PDP Agency empowered to impose them has not been established, nearly two years after the law became fully enforceable. - [Rajah & Tann Asia](https://www.rajahtannasia.com/viewpoints/indonesias-pdp-law-updates-dpa-u-s-trade%E2%80%91related-data-transfers-and-recent-court-rulings/) — West Jakarta District Court — PDP Law enforcement remains secondary in practice to the ITE Law; a notable civil case invoking data-protection issues was filed January 2026. - [DLA Piper](https://www.dlapiperdataprotection.com/?t=law&c=ID) — PDP Law enforcement — Enforcement to date characterised as quite low, attributed to absence (until July 2026) of implementing regulations and still-pending PDP Agency establishment. - [Lexology](https://www.lexology.com/library/detail.aspx?g=0fac7f22-89d9-49f4-ad4e-5c296fba3ca6) — PDP Law — Constitutional review before Indonesia's Constitutional Court through multiple petitions, as of August 2026 reporting; status not re-verified this cycle. - [PSHP Adrem](https://www.pshpadrem.law/publication/new-layers-of-pretection-%E2%80%93-what-indonesia%E2%80%99s-new-pdp-implementation-regulation-means-for-business) — UU PDP Article 57 / GR 33/2026 — Written warnings, temporary/permanent suspension of processing, deletion of personal data, and administrative fines up to 2% of the controller's/processor's annual revenue. - [Chambers Practice Guides](https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/indonesia/trends-and-developments) — Indonesia PDP enforcement practice — Pending PDP Authority establishment, the 2%-of-revenue administrative fine remains structurally unavailable; ongoing enforcement relies mainly on criminal sanctions under UU PDP and the ITE Law. - [Lexology](https://www.lexology.com/library/detail.aspx?g=0482381c-58c3-4c1b-8bd8-d415a59544a2) — Government Regulation No. 33 of 2026 — Administrative sanctions for PDP Law violations; specific fine tiers not independently verified. - [Rajah & Tann](https://www.rajahtannasia.com/viewpoints/pdp-law-updates-the-pdp-implementing-regulation-is-out-and-it-clarifies-some-key-questions-under-indonesias-pdp-law/) — GR 33/2026 — Administrative fines of up to 2% of annual revenue apply across the PDP compliance framework. - [HLC](https://www.hlc.com/en/publications/awaiting-indonesias-personal-data-protection-authority-a-constitutional-push-for-a-hard-deadline) — Constitutional Court Case No. 236/PUU-XXIV/2026 — Asks the Court to order the government to establish the PDPA within a deadline; on 27 July 2026 MOCD opposed a court-imposed deadline. - [dataprotection.gi](https://dataprotection.gi/jurisdictions/indonesia/) — The statutory administrative-sanctions machinery of the PDP Law cannot yet be exercised pending establishment of the independent Personal Data Protection Agency. - [PPC Land](https://ppc.land/indonesias-data-law-faces-court-test-with-dpa-rules-still-two-months-away/) — As of 21 July 2026, the Perpres establishing the Lembaga PDP remained pending and the law mandating the body was under constitutional review as Case 236/PUU-XXIV/2026. - [https://www.dlapiperdataprotection.com/guide.pdf?c=ID](https://www.dlapiperdataprotection.com/guide.pdf?c=ID) — UU PDP (Law No. 27 of 2022) — UU PDP reserves administrative sanctions (written warning, temporary suspension of processing, and further tiers) to the PDP Agency; these remain structurally unavailable because the Agency has not been established ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy granted Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) data localisation Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer impact assessment Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties