Data Protection Indonesia 2026: PP 33/2026, PDP Agency Timeline & Penalties Explained

The personal data protection law indonesia framework enters a decisive operational phase in 2026, as Government Regulation No. 33 of 2026 (PP 33/2026) begins to give practical effect to Law No. 27 of 2022 and the national Personal Data Protection Agency moves toward full operation. For in-house counsel, data protection officers, compliance leads and HR or IT heads, this is the year that long-anticipated obligations become enforceable realities rather than policy aspirations. This guide sets out what PP 33/2026 changes, how the supervisory authority is expected to supervise controllers and processors, the administrative and criminal penalties that apply, and a practical compliance checklist you can begin acting on immediately.

The aim is simple: to answer the question most organisations are now asking, what exactly must we do in 2026 to avoid fines and criminal exposure?

Executive summary: what companies must know in 2026

Indonesia’s data privacy regime is maturing quickly. Law No. 27 of 2022 established the substantive rights and obligations; its implementing regulation operationalises them by supplying procedural detail; and a dedicated supervisory authority is intended to enforce both. Together these pillars shift the pdp law indonesia landscape from a largely self-regulated environment toward active, risk-based enforcement. Organisations that treated the 2022 law as a distant concern now face concrete administrative and penal exposure.

If you do nothing else in the first half of 2026, prioritise these five actions:

• Complete data protection impact assessments (DPIAs) for high-risk processing activities, including large-scale profiling and processing of sensitive personal data.
• Build or refresh your data inventory and records of processing so you can demonstrate lawful basis, retention and data flows on demand.
• Stand up a breach-response and notification plan aligned to the reporting timelines operationalised by the implementing regulation.
• Update processor and vendor contracts to include compliant data-processing terms and cross-border transfer safeguards.
• Appoint or formally nominate a data protection officer and define internal accountability for compliance and regulator liaison.

These five items form the backbone of an audit-ready posture. The sections below explain the legal basis for each and how the personal data protection law indonesia framework will be supervised and enforced through the year.

Background: Law No. 27 of 2022 in brief

Law No. 27 of 2022 on Personal Data Protection is Indonesia’s first comprehensive, omnibus data protection statute. Before its enactment, data protection obligations were scattered across sectoral regulations and ministerial rules, creating inconsistency and limited redress for individuals. The law consolidated these into a single framework with recognisable concepts of controllers, processors, lawful bases for processing, and enforceable data subject rights.

The statute distinguishes between general personal data, information such as name, contact details and identifiers, and specific (sensitive) personal data, which includes health and health-service data, biometric and genetic data, financial data, children’s data, sexual orientation, and information revealing a person’s criminal record or similar protected characteristics. Processing of sensitive categories attracts heightened safeguards and is a frequent trigger for mandatory DPIAs.

Two roles sit at the centre of the regime. A personal data controller determines the purposes and means of processing, while a personal data processor processes data on the controller’s behalf and under its instructions. Both carry obligations, but the controller bears primary accountability for lawful processing, transparency, security and honouring data subject rights.

The law provided a transition period after enactment to allow organisations time to adapt. That period has now effectively elapsed, and the issuance of the implementing regulation together with the establishment of the supervisory authority marks the point at which the pdp law indonesia framework becomes a live compliance obligation with real consequences for non-compliance. For the authoritative text of the law, organisations should consult the official government legal repositories, which publish the authenticated statute and its enactment details.

What PP 33/2026 changes, key operational rules

Government Regulation No. 33 of 2026 operates as the implementing regulation that translates the principles of Law No. 27 of 2022 into workable procedures. Where the primary law states that controllers must report breaches, maintain records, and enable cross-border transfers under adequate safeguards, the implementing regulation supplies the operational “how”, the forms, the deadlines, the thresholds and the administrative process. In practical terms, this is the document that compliance teams will live by day to day. Because the precise content and article numbering should be verified against the authenticated text, organisations should confirm all operative provisions against the official legal repositories before finalising internal policies.

Scope and application

The implementing rules apply to controllers and processors that handle the personal data of individuals in Indonesia, consistent with the broad territorial reach of the parent statute. Those rules bind both domestic organisations and, in many cases, foreign entities processing the personal data of individuals located in Indonesia. Organisations that previously assumed the pdp law indonesia regime applied only to locally incorporated companies should reassess that position carefully.

The framework also scales general obligations with risk. High-volume processing, systematic monitoring and sensitive-data processing attract more demanding documentation, assessment and security requirements than low-risk, small-scale activities. This risk-based gradient is central to how the regime is expected to operate in practice.

New compliance processes required

The implementing regulation is expected to formalise several processes that many organisations have run informally, if at all:

• Records of processing. Controllers and processors must maintain structured records documenting processing purposes, categories of data, recipients, retention periods and security measures, the evidentiary backbone for any regulator inquiry.
• Breach reporting. The rules set out the procedure and timeframe within which personal data breaches must be reported to the authority and, where required, communicated to affected data subjects, together with the prescribed content of that notification.
• Data protection impact assessments. DPIAs become a documented prerequisite for high-risk processing, with the assessment retained as evidence of compliance.
• Cross-border transfer mechanisms. Transfers outside Indonesia must rely on recognised safeguards, such as an adequacy-style determination of the destination jurisdiction’s level of protection, adequate and binding safeguards, or the data subject’s valid consent, with the rules setting out which mechanisms are available and the conditions attached.
• Administrative interaction with the authority. The rules establish the procedural steps for how the supervisory authority receives notifications, requests information, conducts reviews and imposes administrative sanctions.

Specific provisions to note

Because this is an implementing regulation, its operative articles govern the precise deadlines and documentation standards that enforcement will turn on. Compliance teams should map their internal controls directly against the regulation’s provisions on breach-notification timing, recordkeeping content, DPIA triggers and transfer safeguards, and should verify the exact article references against the authenticated text published in the official legal repositories before finalising internal policies. Treating the regulation as the operative rulebook, rather than relying on the more general language of the 2022 law, is the single most important drafting discipline for 2026.

PDP Agency: timeline, remit and supervisory powers

The personal data protection law indonesia framework anticipated a dedicated supervisory authority responsible for overseeing compliance, receiving complaints, conducting audits and imposing administrative sanctions. Its activation fundamentally changes the risk calculus: for the first time, there is a single authority mandated to supervise the regime and to act against controllers and processors that fall short. Until that authority is fully operational, supervisory functions continue to be exercised through the responsible government ministry.

Timeline to full operation

The supervisory authority’s establishment and operational readiness are expected to align with 2026 and the implementation of the regulation. Organisations should treat the authority’s go-live as the point at which supervisory activity begins in earnest. Early indications suggest that first-year activity is likely to combine guidance and compliance-building measures with the capacity to respond to complaints and significant breaches. Because the precise sequencing of operational milestones is announced through official channels, organisations should monitor announcements from the responsible government ministry and any official supervisory-authority notices for confirmed dates and procedural guidance.

Remit and jurisdiction

The authority’s remit covers supervision of controllers and processors subject to the pdp law indonesia regime. Its jurisdiction extends across the lifecycle of personal data processing, collection, use, storage, transfer and deletion, and to both the substantive obligations in Law No. 27 of 2022 and the procedural requirements in the implementing regulation. The authority is also expected to coordinate with sectoral regulators, meaning that organisations in regulated industries such as finance and telecommunications may face overlapping oversight.

Likely supervisory activities

Industry observers expect the supervisory toolkit to include:

• Complaint handling. Receiving and investigating complaints from data subjects about unlawful or non-transparent processing.
• Audits and inspections. Requesting records, reviewing DPIAs and processing registers, and assessing security and governance measures.
• Requests for information. Requiring controllers and processors to produce documentation relevant to an inquiry.
• Corrective orders. Issuing remedial instructions, including orders to suspend non-compliant processing until deficiencies are resolved.
• Administrative sanctions. Imposing the administrative penalties available under the law and regulation, following the prescribed procedure.

The practical effect for compliance leaders is that documentation must be inspection-ready at all times. A well-maintained processing register, retained DPIAs and a tested breach-response plan are the artefacts the authority is most likely to request first.

Penalties & enforcement under the personal data protection law indonesia regime

Enforcement under the personal data protection law indonesia framework operates across three tracks: administrative sanctions imposed by the supervisory authority, criminal liability prosecuted through the courts, and civil claims brought by affected individuals. Understanding how these interact is essential to assessing exposure, because a single incident, a large breach of sensitive data, for example, can trigger more than one track simultaneously.

Administrative sanctions

Administrative enforcement is the most common and most immediate risk. Under the law, administrative sanctions range from written warnings and temporary suspension of processing activities, through to deletion or destruction of personal data and administrative fines. The implementing regulation supplies the procedural framework for how these sanctions are assessed and imposed, including the steps the authority must follow and the opportunities a controller has to respond. The law provides for administrative fines calculated by reference to a proportion of the controller’s or processor’s relevant annual revenue or receipts, subject to the caps and conditions set out in the statute and implementing regulation.

Because these figures are revenue-linked and governed by the operative text, organisations should confirm the precise cap and calculation method against the authenticated law and its implementing regulation before modelling exposure.

Criminal liability, who can be prosecuted

Law No. 27 of 2022 reserves criminal liability for specified, serious misconduct, such as unlawfully obtaining or collecting personal data that does not belong to the perpetrator, unlawfully disclosing or using such data, and falsifying personal data for unlawful gain or to cause loss. These offences carry criminal fines and terms of imprisonment. Critically, the law contemplates liability extending to corporations, and corporate officers and controlling individuals may face exposure where offences are committed by or on behalf of the organisation. This elevates data protection from a purely administrative concern to a matter of personal and board-level risk, and it is a key reason why governance ownership must sit at a senior level.

Enforcement procedure and appeal routes

Administrative enforcement follows the procedure set out in the implementing regulation, typically beginning with notice and an opportunity to remediate before escalation to fines or suspension. Decisions of the authority are, in principle, subject to administrative appeal and judicial review through the appropriate channels, while criminal matters proceed through the ordinary criminal justice process involving investigators, prosecutors and the courts. Organisations receiving an enforcement notice should preserve relevant evidence, engage local counsel early and document their remediation steps carefully, as a demonstrable good-faith remediation effort can materially affect outcomes.

The enforcement ladder means that even a well-intentioned organisation can accumulate exposure quickly: a missed DPIA leads to an administrative finding, an unreported breach compounds it, and a serious misuse of sensitive data can tip the matter into criminal territory. Managing indonesia data protection enforcement risk is therefore as much about sequencing and documentation as it is about substantive compliance.

Data subject rights and required company responses

Law No. 27 of 2022 grants individuals a suite of enforceable rights, and the implementing regulation shapes how organisations must respond. Honouring these rights promptly and verifiably is both a legal obligation and a practical defence: a documented, timely response to a data subject request (DSR) is strong evidence of good-faith compliance if the authority later inquires.

The core data subject rights indonesia organisations must support include:

• Right of access. To obtain information about and a copy of the personal data being processed.
• Right to rectification. To correct, update or complete inaccurate or incomplete personal data.
• Right to erasure. To request deletion or destruction of personal data in defined circumstances.
• Right to data portability. To obtain personal data in a usable format and, where feasible, have it transmitted onward.
• Right to object and to restrict processing. To object to certain processing, including automated decision-making and profiling.
• Right to withdraw consent. To withdraw previously given consent for processing based on consent.

Practical DSR standard operating procedure and timeline

A defensible DSR process should run through consistent, logged stages:

1. Intake. Provide clear channels for individuals to submit requests and record each request on receipt.
2. Verification. Confirm the requester’s identity proportionately, to prevent disclosure to the wrong person.
3. Assessment. Determine the nature of the request, locate the relevant data, and identify any applicable exemptions.
4. Action. Fulfil the request, provide access, correct, delete, port or restrict, within the statutory response window.
5. Response. Communicate the outcome in writing, including reasons where the request is refused in whole or in part.
6. Logging. Retain a complete record of the request, the steps taken and the outcome for accountability.

Organisations should confirm the exact response deadline against the implementing regulation and build their internal service levels to a tighter internal target, leaving margin for verification and escalation.

Exemptions and sensitive data handling

Not every request must be fulfilled in full. The law recognises grounds on which a controller may lawfully decline or limit a response, for example, where fulfilment would prejudice national defence or security, law enforcement, the public interest, the supervisory functions of a regulator, or the legitimate rights of others. Where sensitive personal data is involved, verification and handling standards rise accordingly. Any refusal should be reasoned, documented and capable of justification if challenged.

Operational compliance checklist for 2026

The following twelve-point checklist converts the personal data protection law indonesia obligations into concrete workstreams, each with a suggested owner and priority. Use it to structure a defensible programme over the coming months.

• 1. Data inventory and mapping. Document what data you hold, where it flows, and on what lawful basis. Owner: DPO / data governance.
• 2. Records of processing. Maintain structured processing records aligned to the implementing regulation. Owner: DPO / compliance.
• 3. DPIAs for high-risk processing. Assess and document profiling, large-scale and sensitive-data processing. Owner: DPO with business owners.
• 4. Lawful basis and consent review. Validate consent mechanisms and alternative lawful bases. Owner: legal / compliance.
• 5. Privacy notices. Ensure transparency notices meet the law’s content requirements. Owner: legal / marketing.
• 6. Processor and vendor contracts. Update agreements with compliant data-processing terms. Owner: legal / procurement.
• 7. Cross-border transfer safeguards. Implement recognised transfer mechanisms for data leaving Indonesia. Owner: legal / IT.
• 8. Breach-response plan. Build and test an incident plan aligned to the regulation’s notification timing. Owner: security / DPO.
• 9. DSR workflow. Deploy the intake-to-response SOP described above. Owner: DPO / operations.
• 10. Security measures. Implement technical and organisational safeguards proportionate to risk. Owner: CISO / IT.
• 11. Training and awareness. Train staff who handle personal data on obligations and incident reporting. Owner: HR / compliance.
• 12. DPO appointment and regulator liaison. Formally designate a data protection officer indonesia role with authority and reporting lines where required by the law. Owner: executive sponsor.

90-day priority plan

In the first 90 days, concentrate on the items that most reduce enforcement risk: complete the data inventory, run DPIAs for your highest-risk processing, stand up the breach-response plan, update your most critical processor contracts, and confirm your DPO and accountability structure. These create the evidentiary spine that the supervisory authority is most likely to examine first.

6–12 month roadmap

Over the following months, broaden coverage: refine privacy notices, complete the processor-contract remediation across all vendors, finalise cross-border transfer mechanisms, roll out organisation-wide training, and conduct an internal audit against both Law No. 27 of 2022 and its implementing regulation. Schedule a review cycle so that policies are updated promptly whenever the authority issues new guidance.

How to prepare for an inspection or enforcement action

Even well-prepared organisations can face a regulator inquiry, a complaint, or a reportable breach. How you respond in the first hours and days often shapes the outcome more than the underlying incident itself.

Immediate steps after notice

On receiving an enforcement notice, a complaint or a credible breach report:

• Preserve evidence. Secure logs, records of processing, DPIAs and communications relevant to the matter.
• Engage counsel. Appoint local data protection counsel early to manage privilege, strategy and regulator communications.
• Verify the facts. Establish what happened, what data is affected and who is impacted before making representations.
• Meet reporting obligations. Where a breach is notifiable, report within the timeframe set by the implementing regulation with the prescribed content, rather than delaying for a complete picture.
• Control communications. Coordinate internal and external messaging to avoid inconsistent or prejudicial statements.

Evidence and remediation tracker

Maintain a single tracker recording the timeline of events, the documents requested and produced, the remediation steps taken and their completion dates, and the status of communications with the authority and affected individuals. A clear, contemporaneous record of good-faith remediation demonstrates diligence and can materially influence how the authority exercises its discretion on sanctions. Keep the board and senior stakeholders informed through structured updates, given the potential for personal and corporate liability.

Conclusion & recommended next steps

The personal data protection law indonesia regime has moved from statute toward live enforcement, and 2026 is the year organisations must demonstrate, not merely assert, compliance. The implementing regulation supplies the operational detail, the supervisory authority supplies the oversight, and Law No. 27 of 2022 supplies the sanctions that make both matter. The five priorities remain constant: complete DPIAs for high-risk processing, build a defensible data inventory and records of processing, implement a tested breach-response and notification plan, remediate processor and cross-border transfer arrangements, and formalise your DPO and accountability structure. Organisations that embed these controls now will be well placed to manage indonesia data privacy 2026 risk; those that defer face escalating administrative, civil and potentially criminal exposure.

Given the pace of regulatory development, review your programme against official guidance regularly and seek tailored local advice on statutory interpretation and enforcement strategy. For a pillar overview, see Personal data protection, Indonesia, and to engage a specialist, you can Find a data protection lawyer in Indonesia.

Sources

1. Indonesian Government Legal Repository (Peraturan.go.id)
2. Ministry of Communication and Digital Affairs (Kementerian Komunikasi dan Digital)
3. State Secretariat / JDIH (Jaringan Dokumentasi dan Informasi Hukum)
4. DPR RI (The House of Representatives)
5. Indonesian Bar Association (PERADI)
6. Supreme Court of Indonesia (Mahkamah Agung)