by Tiyana Sigi Pertiwi and Tiara Amanda Putri
Overview
The Government has issued Government Regulation Number 33 of 2026 on the Implementation of Law Number 27 of 2022 on Personal Data Protection (“GR No. 33/2026”). The regulation further elaborates on provisions of the Personal Data Protection (“PDP”) Law that require more detailed implementation of rules through a Government Regulation. The GR was established and promulgated on 16 July 2026, and comes into force after 6 (six) months from the date of its promulgation (Art. 225), being 16 January 2027.
Its issuance provides a more detailed regulatory framework for implementing the requirements established under the PDP Law. GR No. 33/2026 sets out further provisions to implement personal data protection requirements for both electronic and non-electronic processing, in accordance with the principles and provisions of the PDP Law. These provisions address various aspects necessary to give effect to the law and ensure its proper implementation.
The GR also further fortifies the role of the Agency (Lembaga) organizing PDP in Indonesia as per the PDP Law, which is to be established by the President, as much of the GR runs through and/or delegated to a regulation of said Agency (e.g., breach notification, transfer country list and contract clauses, sanctions, mediation, etc.).
Summary Matrix
Provision
|
Key Summary
|
Articles 1-19
|
Applies to Every Person (Individuals or Corporation), Public Bodies, and International Organizations in Indonesia, as well as those outside Indonesia (if their actions have legal consequences within the jurisdiction of Indonesia and/or for Personal Data Subjects who are Indonesian citizens), except for personal or household activities. Days referred to under the GR are business days. Personal Data is classified into specific and general categories. Personal Data Controllers may appoint Personal Data Processors. A visual data processor and processing device in public places can be installed for security, disaster prevention and/or traffic management purposes, but must display information that they are installed in the area, and must not be used to identify a person, except for criminal prevention and law enforcement processes.
|
Articles 20-73
|
Controllers must have a legal basis before processing Personal Data, including explicit legal consent, contractual necessity, legal obligations, vital interests, public interest tasks, or other legitimate interests, and provide information before processing. The processing of Children’s Personal Data requires parental or guardian consent, while Personal Data of Persons with Disabilities require consent from the disabled person and/or their guardian. Data updates or corrections must be completed within 3 x 24 hours.
|
Articles 74-147
|
Personal Data Controller must record processing activities and determine the Retention Period. Personal Data Subjects’ rights are regulated, which includes the access, erasure, withdrawal of consent, objection to automated processing, restriction of processing, compensation, and data portability. A maximum period of 3 x 24 hours applies to requests for access, cessation of processing upon withdrawal of consent, and restriction of processing. Personal Data breaches must be notified in writing to the Personal Data Subject and the Agency no later than 3 x 24 hours after the breach has become known. Further obligations cover PDP impact assessments, security measures, data transfers of Personal Data in the event of merger, demerger, acquisition, consolidation or dissolution of a legal entity, alongside Processor obligations, and the appointment of a Personal Data Protection Officer (PPDP).
|
Articles 148-174
|
Certain Personal Data Subjects’ rights and Controller obligations are exempted for national defense and security, law enforcement, public interest in the context of state administration, as well as supervision in the financial sector. Each exclusion is subject to specific criteria. Investigators, public prosecutors, or judges may request Personal Data in writing for criminal cases involving PDP offenses. Cross-border transfers of Personal Data outside the Indonesian jurisdiction requires, in order: an equivalent or higher levels of protection than that of under the UU PDP; if this requirement is not met, adequate and binding PDP must be ensured; failing that, the Personal Data Subject’s consent is required. A transfer based on consent is limited to transfers that are not repeated and involve a limited number of Personal Data Subjects.
|
Articles 175-225
|
The Agency supervises compliance and may impose sanctions in the form of a written warning, temporary suspension of processing, deletion or destruction of data, and/or an administrative fine of up to 2% of annual income or annual receipts of the Personal Data Controller and/or Processor in violation. Examination must be completed within 14 days and can be extended to 60 days. The sanction decision is due within 30 days at the latest, and any objection within 14 days. Dispute resolutions are facilitated by the Agency through Mediation for up to 30 days, which can be extended once by up to 30 days. International cooperation and public participation are regulated. Processing may continue until an Agency Regulation is issued, while other regulations remain in force to the extent they do not conflict, and this GR takes effect 6 months after its promulgation.
|
Key Highlights
-
Scope of Personal Data Protection and Classification of Personal Data
GR No. 33/2026 applies to any individual, Public Agency, and International Organization engaging in legal acts related to PDP within or outside the territory of Indonesia, provided that such acts have legal consequences in Indonesia or affect Indonesian citizens who are Data Subjects abroad. The GR excludes the processing of Personal Data by individuals for personal or household activities. Personal Data is classified into two categories: specific Personal Data and general Personal Data. Furthermore, the installation of visual data processing or analytical devices in public spaces and public service facilities must consider the purpose of installation, privacy aspects, and the obligation to provide information regarding the operation of such devices.(1)
-
Legal Basis for Personal Data Processing and Fulfillment of Data Subject Rights
Personal Data Controllers must establish a lawful basis for processing Personal Data before carrying out any processing activities. Such legal bases include explicit and valid consent, the performance of contractual obligations, compliance with legal obligations, the protection of vital interests, the performance of tasks in the public interest or provision of public services, and other legitimate interests. The Regulation also sets out procedures for exercising Data Subjects’ rights, including the right to information and access, the cessation of processing, the erasure or destruction of Personal Data, the withdrawal of consent, and the completion, updating, and rectification of Personal Data. The processing of Personal Data belonging to children and persons with disabilities is subject to specific consent requirements and procedures as stipulated in the regulation.(1)
-
Obligations of Personal Data Controllers and Processors
Personal Data Controllers are required to maintain records of all Personal Data processing activities and uphold Data Subjects’ rights in accordance with the procedures and time limits stipulated in the GR, including specific obligations subject to a deadline of 3 × 24 hours. In the event of a Personal Data Protection Failure, the Controller must provide written notification to the affected Data Subjects and the Institution no later than 3 × 24 hours after becoming aware of the failure. The GR also governs Personal Data Protection Impact Assessments, processing security measures, the obligations of Controllers and Processors, and the appointment of an Officer or Personnel Responsible for Carrying Out Personal Data Protection Functions (PPDP).(1)
-
Supervision, Administrative Sanctions, and Dispute Resolution
The GR governs international cooperation in PDP, public participation, compliance supervision, the imposition of administrative sanctions, and dispute resolution. The Institution is authorized to impose administrative sanctions on Personal Data Controllers and/or Processors that violate specified provisions, including written warnings, temporary suspension of processing activities, erasure or destruction of Personal Data, and/or administrative fines of up to 2% of annual revenue or annual receipts, in accordance with the Regulation. Disputes concerning PDP may also be resolved through mediation and other dispute resolution mechanisms as provided under the applicable laws and regulations.(1)
The Agency (Lembaga) referred to several times in this GR is an institution which organizes PDP under Article 1 Number 15 of the UU PDP, to be established by the President. As of the date of this Regulatory Update, the Agency has not yet been formally established, and its establishment remains under discussion.(2)
References
-
Government Regulation No. 33 of 2026 on the Implementation of the Personal Data Protection Law.
-
Publication Disclaimer:
This disclaimer applies to the publication of articles by Anggraeni and Partners. By accessing or reading any articles published by Anggraeni and Partners, you acknowledge and agree to the terms of this disclaimer:
-
No Legal Advice: The articles published by Anggraeni and Partners are for informational purposes only and do not constitute legal advice. The information provided in the articles is not intended to create an attorney-client relationship between Anggraeni and Partners and the reader. The articles should not be relied upon as a substitute for seeking professional legal advice. For specific legal advice tailored to your individual circumstances, please consult a qualified attorney.
-
Accuracy and Completeness: Anggraeni and Partners strives to ensure the accuracy and completeness of the information presented in the articles. However, we do not warrant or guarantee the accuracy, currency, or completeness of the information. Laws and legal interpretations may vary, and the information in the articles may not be applicable to your jurisdiction or specific situation. Therefore, Anggraeni and Partners disclaims any liability for any errors or omissions in the articles.
-
No Endorsement: Any references or mentions of third-party organizations, products, services, or websites in the articles are for informational purposes only and do not constitute an endorsement or recommendation by Anggraeni and Partners. We do not assume responsibility for the accuracy, quality, or reliability of any thirdparty information or services mentioned in the articles.
-
No Liability: Anggraeni and Partners, its partners, attorneys, employees, or affiliates shall not be liable for any direct, indirect, incidental, consequential, or special damages arising out of or in connection with the use of the articles or reliance on any information contained therein. This includes, but is not limited to, loss of data, loss of profits, or damages resulting from the use or inability to use the articles.
-
No Attorney-Client Relationship: Reading or accessing the articles does not establish an attorney-client relationship between Anggraeni and Partners and the reader. The information provided in the articles is general in nature and may not be applicable to your specific legal situation. Any communication with Anggraeni and Partners through the articles or any contact form on the website does not create an attorney-client relationship or establish confidentiality.
-
Intellectual Property: This publication is an original work of the author(s) that has not been previously published or submitted for publication elsewhere. All intellectual property rights in relation to this publication, including economic rights, are exclusively owned by Anggraeni and Partners (AP).
-
Use of AI Tools: During the preparation of this work, the author(s) may use AI-assisted technologies for readability. After using this tool/service, the author(s) reviewed and edited the content as needed for the purposes of the publication. Any use of artificial intelligence tools, if applied, is limited to supporting purposes only, and the author remains fully responsible for the accuracy, integrity, and quality of the content.
By accessing or reading the articles, you acknowledge that you have read, understood, and agreed to this disclaimer. If you do not agree with any part of this disclaimer, please refrain from accessing or reading the articles published by Anggraeni and Partners.
For further information, please contact:
P: 6221. 7278 7678, 72795001
H: +62 811 8800 427
Tiyana Sigi Pertiwi S.H LL.M
Knowledge Lawyer
connect@ap-lawsolution.net
Tiara Amanda Putri S.H
Growth Officer
