Understanding Government Regulation No. 33 of 2026 on the Implementation of Indonesia’s Personal Data Protection Law

The Personal Data Protection Law (UU PDP) has actually existed since 2022 and has been fully in force since October 2024. The problem is that many of its provisions are still general and lack technical guidance.

That gap is now filled by Government Regulation No. 33 of 2026 concerning the Implementing Regulation of the UU PDP, which was enacted on 16 July 2026 and takes effect on 16 January 2027.

PP 33 of 2026 brings three main changes that businesses will feel the most: data subject requests must be answered within 3 × 24 hours, personal data protection failures must be notified within 3 × 24 hours, and administrative fines reach 2% of annual revenue.

This article summarizes its core contents: what it regulates, who is affected, what fines loom, and what needs to be prepared before the deadline arrives.

What Is Government Regulation No. 33 of 2026?

PP 33 of 2026 is the implementing regulation of the UU PDP that spells out the technical procedures for running the UU PDP on the ground. It contains procedures, document formats, deadlines, and other mechanisms that the UU PDP has not regulated in detail.

The UU PDP itself was designed to be principles-based. Its articles mention “consent”, “Data Subject rights”, and “sanctions”, but rarely specify document formats or how to calculate them. PP 33/2026 fills that void.

For example, note how the UU PDP sets out principles while PP 33 of 2026 sets out the technical procedures for implementing them:

• The UU PDP obliges Controllers to fulfil Data Subject rights; the PP details the procedures in Articles 20 to 27 and sets a response deadline of 3 × 24 hours.
• The UU PDP names consent as a basis for processing; the PP defines lawful and explicit consent, prohibits combining it with terms and conditions, and obliges the Controller to show evidence of consent.
• The UU PDP sets a maximum fine of 2% of annual revenue; the PP details the variables that determine the amount, including the possibility of it reaching zero.

Item	Provision
Full name	Government Regulation No. 33 of 2026 concerning the Implementing Regulation of Law No. 27 of 2022 on Personal Data Protection
Enacted and promulgated	16 July 2026
State Gazette	2026 No. 88
Number of provisions	12 chapters and 225 articles
Takes effect	16 January 2027, six months after the date of promulgation (Article 225)

The text of this PP had already circulated among industry players before its status was publicly known. Kompas reported its circulation on 29 August 2026, more than a month after promulgation.

Relationship to Law No. 27 of 2022

The relationship is simple: the UU PDP is the framework, PP 33/2026 is the implementation detail. All statutory norms remain in force, and the PP adds technical procedures on top of them.

Aspect	Law No. 27 of 2022	PP No. 33 of 2026
Nature of regulation	Principles-based framework of rights, obligations, sanctions, and institutional arrangements	Operational procedures and technical detail
Main scope	Definitions, Data Subject rights, Controller and Processor obligations, data transfer, administrative sanctions (Article 57), criminal provisions	Processing bases, consent, Data Subject rights procedures, document requirements, DPIA (Data Protection Impact Assessment), PDP Officer (Personal Data Protection Officer), transfer, supervision, and sanction procedures
Number of provisions	16 chapters, 76 articles	12 chapters, 225 articles
Takes effect	17 October 2022, with a 2-year transition until full effect in October 2024	16 January 2027, with a 6-month adjustment period

Learn About the UU PDP

The Personal Data Protection Law (UU PDP) is the set of rules governing how personal data must be managed and protected, while also explaining the rights of data owners and the responsibilities of the parties that process it.

Who Is Covered by This Rule?

This rule applies to any party that processes personal data in Indonesia — private companies, ministries and local governments, as well as international organizations operating in the country.

There is one exception, however: processing for personal or household purposes. Under this rule, every party occupies one of three roles: Data Subject, Controller, or Processor.

Data Subjects, Controllers, and Processors

PP 33/2026 governs three roles at once: Data Subject, Controller, and Personal Data Processor. All three are the pivot of every provision in this rule:

• Personal Data Subject is the owner of the data — the individual whose data is processed. The rights regulated by the PP, from access and correction through to withdrawal of consent and compensation, attach to this role.
• Personal Data Controller is the party that determines purposes and makes decisions about data processing. A company that collects customer data for its operational needs is the Controller. Document obligations, the 3 × 24 hour deadlines, and the threat of sanctions fall mainly on this role.
• Personal Data Processor is the party that processes data on behalf of the Controller: cloud vendors, analytics providers, marketing agencies, or HR outsourcers. The contractual relationship between the two is regulated in detail in Articles 14 and 15.

Most companies hold two roles at once: Controller over their own customers’ data, and Processor when processing data belonging to other clients.

Public Bodies and Extraterritorial Reach

The coverage of PP 33/2026 is set out in its scope (Article 2): it applies to every person, public body, and international organization that carries out personal data processing in Indonesia. In other words, private companies are only part of the parties regulated.

Other parties that are also bound include:

• Ministries, institutions, and local governments that manage citizen data are included.
• International organizations that collect data within Indonesian territory are also bound.

Beyond that, the reach of this PP is also extraterritorial. Parties outside Indonesia are likewise bound if their activities give rise to legal effects in Indonesia or affect Data Subjects who are Indonesian citizens.

This reach mirrors the approach of the GDPR in the European Union. Foreign services serving Indonesian users cannot hide behind server domicile.

Exception: Personal or Household Activities

There is one exception: data processing for personal or household activities is not covered by this rule.

For example, storing a family contact list on a personal phone is not an activity regulated by either the UU PDP or this PP.

For businesses, this exception does not help much. Once data is processed for business purposes at any scale, the rules apply in full. The UU PDP recognizes no special threshold for small businesses, and PP 33/2026 does not add one.

What Does PP No. 33 of 2026 Cover?

We summarize PP 33/2026 in ten areas that most directly touch company operations: data classification, processing bases, cross-border data transfer, through to data protection in corporate actions.

Of those ten areas, the longest discussion deliberately covers documents and deadlines. Both demand the biggest behavioral change inside a company because they concern people and work habits, not just systems.

1. Personal Data Classification: General and Specific

PP 33/2026 reinforces the division of personal data in Article 5 into two types of personal data, each regulated further in Article 6 (specific) and Article 7 (general):

Category	Scope	Example
General Personal Data (Article 7)	Full name, gender, nationality, religion, marital status, and combinations of data that can be used to identify a person	Full name in a customer database
Specific Personal Data (Article 6)	Health data and information, biometric data, genetic data, criminal records, child data, personal financial data, and other data as referred to in statutory provisions	Medical records, fingerprints, bank statements

This classification determines the downstream workload. Specific data triggers heavier obligations, including a Data Protection Impact Assessment and stricter safeguards.

2. Bases for Personal Data Processing

The basic rule is set out in Article 30(1) and (2): a Controller must have a processing basis before starting personal data processing. Holding data in your systems does not automatically make its processing lawful.

Article 30(3) details six recognized bases, each with a simple example:

1. Lawful and explicit consent from the Data Subject for one or more specific purposes — for example, a user consents to location collection when enabling a delivery feature.
2. Performance of a contract, such as processing payment data to fulfil an order.
3. Compliance with a legal obligation, for example reporting employee data to tax authorities.
4. Protection of the vital interests of the Data Subject, such as contacting an emergency contact during a health incident.
5. Performance of tasks in the public interest or public services based on statutory provisions.
6. Other legitimate interests that still balance Data Subject rights against Controller interests — for example, internal network security that is logged and evaluated.

In practice, violation findings most often come from small activities treated as trivial: report exports, test data on development servers, security logs kept indefinitely. Such activities often run for years without anyone writing down their processing basis.

3. Tighter Consent Requirements

For companies that rely on consent, the rules are now stricter. Article 32 sets the validity conditions: consent must be obtained freely, knowingly, specifically, and unambiguously.

The official elucidation of that article is explicit about the old pattern in online forms. Consent to data processing combined with acceptance of terms and conditions no longer meets the standard; the double checkbox on old forms now fails.

After that, Article 33 requires information about the processing to be delivered before consent is requested, worded concisely, accurately, and in line with the processing activity.

Article 34 governs the consent mechanism, electronic and non-electronic, on the condition that the consent is linked to the processing information. Article 35 prohibits deceptive or misleading methods, and Article 36 obliges the Controller to show evidence of each consent.

For product and marketing teams, the consequences are three concrete tasks: separate the consent checkbox from the terms-and-conditions checkbox, store the consent evidence log (recording who, when, and what was agreed), and make sure the privacy information is displayed before the “Agree” button is pressed.

Good customer consent is measured by evidence that can be shown to an examiner.

4. Data Subject Rights and the 3 × 24 Hour Deadline

PP 33/2026 details two things at once: how requests are submitted, and how long the Controller has to respond.

Request procedures (Articles 20–27). Requests are submitted in writing, electronically or non-electronically, and must contain at least the requester’s identity, an explanation of the Data Subject’s rights and interests, and a description of the request regarding the processed data. A request may be submitted by the Data Subject themselves, the parent or guardian of a Child, the guardian of a Person with Disabilities, or an authorized representative.

A uniform 3 × 24 hour deadline. This is the most felt operational change from this PP:

Data Subject Right	Basis
Access to personal data	Article 77
Copy of personal data	Article 78
Correction of personal data	Article 71
Withdrawal of consent	Article 92
Restriction of processing	Article 99

The count is in hours, weekends included. In practice, the difficulty of this deadline only becomes real when the first request actually arrives; before that everything looks easy.

A team answering requests by manually searching each system will find consistency nearly impossible without a clear data map.

One burden rarely mentioned comes directly from Article 77: the 3 × 24 hour deadline is counted from when the request is received, but access may only be granted after verification of the request is complete. Personal data protection practitioner Raditya Kosasih highlighted this double burden to Kompas.id. Because of that, a late start on verification directly eats into the response time.

The PP also governs Data Subject objections to automated processing (Article 93), along with the obligation to inform them when processing is stopped (Article 92(4)) — for example when data is used for offers of goods and services. Controllers must also have an internal mechanism to handle compensation claims from Data Subjects.

5. Documentation and Internal Governance Obligations

PP 33/2026 requires six core documents from businesses: ROPA, a privacy notice, a processor agreement, a legitimate interest analysis, a retention policy, and data protection audits.

The essence of the rule: compliance turns into documents that an examiner can demand at any time.

Document/Obligation	Basis	Core requirement
Record of processing activities (ROPA)	Article 74	All processing activities must be recorded with at least 13 components, including data flow mapping
Privacy Notice	Articles 62 and 65	7 mandatory information components, with no clause unilaterally shifting data protection responsibility onto the subject
Processor appointment agreement	Articles 14–15	11 minimum components; appointing a sub-processor requires the Controller’s written consent
Legitimate interest assessment	Articles 53–54	A legitimate-interest processing basis must be supported by a written analysis
Data retention policy	Article 75	A document stating how long data is kept and when it is deleted
Data protection audit	Article 138	Internal and external audits of data protection implementation

In addition to those six documents, the Controller must draw up and adopt an internal data processing policy in line with the supervisory authority’s guidance. This document is often treated as “later” by companies just building their compliance program.

6. Protection of Children’s Personal Data

PP 33/2026 gives special protection to children’s data; under this rule, a Child is every person under 18 years of age and not yet married (Article 1). The Controller must first identify whether the Data Subject is a child before processing.

Processing children’s data itself requires the consent of a parent or guardian, which must be verified (Article 38). The Child, together with their parents or guardians, may also submit requests to fulfil the Child’s rights as a Data Subject (Article 38(5)).

For businesses whose markets target children — such as educational apps, games, or content platforms — the consequence is real: age verification mechanisms and parental consent flows must be built from the start. Adding them after launch means re-processing the entire user database that has already been collected.

7. Notification of Personal Data Protection Failure (Data Breach)

When a personal data protection failure occurs, the Controller must inform the Data Subject and the Authority — the personal data protection supervisory body referred to in the UU PDP — no later than 3 × 24 hours after the failure becomes known.

In full, the PP sets three obligations at once:

• The 3 × 24 hour deadline (Article 114): the Controller must submit written notification no later than 3 × 24 hours to both the Data Subject and the Authority when a personal data protection failure occurs.
• Public announcement (Article 115): if the failure affects public services or the public interest, an announcement to the public is also mandatory.
• Policy and documentation (Articles 116–117): the Controller must have a policy for preventing and handling incidents, and must document every incident.

For comparison, GDPR Article 33 in the European Union gives a 72-hour deadline and only requires reporting to the authority; notifying Data Subjects is required when the risk is high. The Indonesian regime demands both at once, within a shorter deadline.

In practice, the common mistake is unclear ownership. Without roles assigned from the start, an incident immediately becomes confusing: who is authorized to decide where notifications go. That is why you prepare the playbook first — covering detection, decision, through to notification channels.

Note: some technical provisions are still awaiting an Authority Regulation. But their status is clear: Article 223 keeps data processing subject to PP 33/2026 as long as it does not conflict with it. Therefore, drafting the notification playbook does not wait for derivative rules.

8. Data Protection Impact Assessment and the PDP Officer

DPIA (Articles 120–122). A Data Protection Impact Assessment must be carried out before running high-risk processing. Triggers include:

• automated decision-making with significant effects on Data Subjects;
• processing of Specific Personal Data;
• processing on a large scale;
• profiling, scoring, or systematic monitoring activities;
• matching or combining groups of data; and
• the use of new technologies.

In its elucidation, the PP names new technologies explicitly: artificial intelligence (AI), machine learning, smart technology, and the Internet of Things (IoT). For organizations developing AI initiatives with personal data, the DPIA is now a mandatory step before the system goes live — no exceptions.

PDP Officer (Articles 142–147). Controllers and Processors must appoint a Personal Data Protection Officer if they meet any one of three criteria: processing data for the purposes of public services; their core activities require regular and systematic monitoring of data on a large scale; or their core activities process Specific Personal Data and/or are related to criminal offences on a large scale.

The PDP Officer may be internal or external (Article 144), must have reporting access to top management, work independently without intervention, and be free from conflicts of interest (Article 146).

The criteria in Article 53 of the UU PDP are interpreted as alternatives under Constitutional Court Decision No. 151/PUU-XXII/2024: one condition being met is sufficient — not all of them.

9. Cross-Border Transfer of Personal Data

Chapter V of PP 33/2026 (Articles 160–174) governs the transfer of Personal Data beyond the jurisdiction of the Republic of Indonesia, including activities that many companies often do not consider transfers — such as using foreign cloud and SaaS.

The mechanism is tiered (Article 165):

1. The destination country has an equivalent or higher level of protection. The Authority will establish a list of qualifying countries (adequacy list).
2. If none is available, there must be adequate and binding protection in the form of Standard Contractual Clauses (SCCs) established by the Authority, Binding Corporate Rules (BCRs) for business groups, or other binding instruments recognized by the Authority.
3. If neither is met, Data Subject consent is available — specifically for non-recurring transfers, involving a limited number of Data Subjects, risk-assessed, and reported to the Authority.

Before transferring, the Controller must conduct a transfer risk assessment and inform the Data Subject (Articles 162–164).

This architecture is familiar to those used to the EU GDPR regime (see the GDPR link in the scope section); the difference: the list of destination countries and standard contract clauses will be established by the implementing authority. The principle is the same; the decision rests with the authority.

10. Data Protection in Corporate Actions

PP 33/2026 places personal data protection as part of corporate transactions (Articles 131–137).

Mergers, acquisitions, consolidations, and even dissolutions of legal entities must now account for personal data protection, including assessment and notification regarding data transfers.

The consequence is felt directly at the due diligence table: assessing personal data is a legal requirement in every transaction. A customer database that changes hands without a recorded assessment and notification is a new legal risk for both parties.

Sanctions for Violators

There are four types of administrative sanctions, from written warnings to a maximum fine of 2% of annual revenue, plus compensation to Data Subjects and the supervisory channel of the authority.

The fine amount is not uniform: ten variables determine the figure, and every sanctions decision is announced publicly. All four sanctions apply to Controllers and Processors alike, and all can be imposed once the examination is complete.

Administrative Sanctions and Fine Amounts

Article 184 sets four types of administrative sanctions that may be imposed on the Personal Data Controller and/or Processor:

1. written warning;
2. temporary suspension of Personal Data processing activities;
3. deletion or destruction of Personal Data; and/or
4. administrative fine.

Regarding the fine amount, Article 185 sets a maximum limit of 2% of the Controller’s and/or Processor’s annual revenue or annual receipts. The figure 2% is the ceiling; under certain considerations, the fine may be set at up to IDR 0.00 or 0%.

The fine amount is determined based on ten variables, including:

• the impact of the violation on Data Subjects;
• the duration of the violation;
• the type of Personal Data affected;
• the number of Data Subjects affected;
• the process by which the violation was discovered;
• the level of cooperation during the examination;
• business scale;
• ability to pay;
• compliance history; and
• other relevant variables established by the Authority.

Two points often escape attention: sanctions may be imposed cumulatively — even without a prior written warning — and the decision imposing the sanction is published on the Authority’s official media (Article 195).

The possibility of a 0% fine under certain considerations does not remove your case from that public record. For many companies, the reputational effect of the announcement outlasts the fine itself.

Compensation and Dispute Settlement

Beyond administrative sanctions, PP 33/2026 details the procedures for awarding compensation to harmed Data Subjects — a matter previously only touched on in general terms by the UU PDP. The right itself is already granted by the UU PDP for both material and immaterial losses; the PP provides the procedures for claiming it.

For non-litigious dispute settlement, the PP regulates mediation by the personal data protection body, from facilitation through to mediation procedures in Articles 206–222. Data Subjects gain an out-of-court channel, and businesses gain procedural certainty before disputes end up in the civil courts.

Supervisory Authority

Articles 180–197 govern the supervisory authority’s powers to examine the compliance of Controllers and Processors. The enforcement flow moves from complaint to objection:

Stage	Flow
1. Complaint	A Data Subject or related party reports an alleged violation
2. Document examination	Preliminary verification of documents and statements
3. Examination and investigation	Further examination, including tracing evidence
4. Sanctions decision	The decision is issued and announced
5. Objection	An objection may be filed against the sanctions decision

Cooperation during the examination is one of the variables in the fine calculation. Organizations that are responsive and keep tidy documentation are in a far better position than those that cover things up.

When Does PP 33/2026 Take Effect and What Needs to Be Prepared?

PP 33/2026 officially takes effect on 16 January 2027, six months after promulgation. That date is the final deadline for all adjustments: data mapping, document updates, and incident response procedure testing must be completed before January 2027.

No additional transition period is granted afterwards. In other words, all obligations — including the 3 × 24 hour deadlines and incident notification — apply from the first day.

Timeline

Four dates the compliance team should keep:

• 17 October 2022: UU PDP promulgated
• October 2024: the UU PDP’s 2-year transition ends; all provisions fully in force
• 16 July 2026: PP 33/2026 enacted and promulgated (State Gazette 2026 No. 88)
• 16 January 2027: PP 33/2026 takes effect; full compliance required

Six months looks long on paper. In practice, data flow mapping, vendor contract reviews, and incident response procedure testing must start now, because the three depend on each other: without a data map, the response playbook cannot be written; without contract review, that playbook cannot reach the vendors.

The six-month schedule looks even shorter when counted from the start. Catalyst Policy Works researcher Parasurama Pamungkas calculates: from the UU PDP’s promulgation in October 2022 to the PP taking effect in January 2027, the total waiting time reaches four years and four months — far beyond the two-year transition mandated by the Law.

The question he raises is relevant to businesses: is that final six months enough to prepare compliance operations as well as the supervisory authority?

Initial UU PDP Compliance Checklist for Businesses

These six steps can be done this week:

1. Audit and data mapping. Map what data is processed, where it comes from, for what purpose, and where it is sent. This is the foundation for every following step.
2. Update the privacy policy and consent forms. Separate consent from terms and conditions, make sure information is delivered before consent is requested, and keep evidence of consent (Articles 32–36).
3. Appoint a PDP Officer where required. Evaluate the three criteria of Article 142; if any one is met, appoint a Personal Data Protection Officer, internal or external.
4. Build a ROPA with at least the 13 components of Article 74. Including data flow mapping, because this document is the map for fulfilling Data Subject rights within 3 × 24 hours.
5. Prepare a 3 × 24 hour incident notification playbook. Determine who detects, who decides, and how notifications to Data Subjects and the Authority are delivered (Articles 114–117).
6. Review agreements with processors and third parties. Ensure contracts contain the 11 minimum components (Article 14), and that all sub-processors receive your written consent.

Ready to Manage Privacy Compliance as a Business Risk?

See how GRC helps map personal data risks, monitor UU PDP compliance, and prepare your company for audits without complicated manual processes.

Conclusion

Over the next six months, two things determine whether your company is ready: documents and speed.

ROPA, privacy notice, processor contracts, legitimate interest analysis, through to incident documentation all demand written evidence; the 3 × 24 hour deadlines — both for data subject requests and breach notifications — demand data mapping and clear ownership from day one.

Documents without speed are useless; so is speed without documents.