INTRODUCTION

Indonesia's personal data protection ("PDP") regime has entered its operational phase. On 16 July 2026, the Government issued Government Regulation No. 33 of 2026 on the Implementation of the Personal Data Protection Law ("PP 33/2026"), setting out how the obligations under Law No. 27 of 2022 ("PDP Law") are to be applied in practice.

Businesses have been subject to the PDP Law's broad principles for some time, but with limited guidance on what compliance actually looks like. PP 33/2026 fills much of that gap. Once it takes effect on 16 January 2027, the question will no longer be whether a business has a privacy policy, but whether it can demonstrate to the regulator, customers and transaction counterparties that its day-to-day practices comply.

This article outlines the key changes introduced by PP 33/2026 and the priorities businesses should address before the deadline.

CONCLUSION

PP 33/2026 marks a clear shift in Indonesia's PDP framework, from having documents in place to being able to demonstrate compliance. Records of processing, DPIAs, transfer assessments, data processing agreements and a working breach response plan will increasingly be expected as evidence, with administrative fines of up to 2% of annual revenue or receipts for non-compliance.

Regards, 

Pasaka Rievan Smith
Counsellors at Law

Download to read the full article.