New Layers of Protection – What Indonesia’s New PDP Implementing Regulation Means for Businesses

I. Introduction

Indonesia’s personal data protection framework is entering a new phase. On 16 July 2026, the Indonesian government issued the long-awaited implementing regulation to Law No. 27 of 2022 on Personal Data Protection (“PDP Law”) through Government Regulation No. 33 of 2026 (“GR 33/2026”). The new regulation adds important layers of detail to the personal data protection regulatory framework in Indonesia.

GR 33/2026 will take effect on 16 January 2027, 6 (six) months after its promulgation, giving businesses a limited window to assess their existing practices and prepare for the new requirements.

This article highlights the key new layers of protection and compliance obligations introduced by GR 33/2026, and what businesses should consider ahead of its full implementation.

II. Key provisions at a glance

GR 33/2026 introduces more detailed requirements on legal bases, visual processing, automated decision-making, accountability and retention, processors and joint controllers, M&A data transfers, cross-border transfers, DPOs, enforcement (including administrative fines of up to 2% of annual revenue or receipts), and the PDP Authority.

III. A closer look at the updated regulatory framework

(a) Detailed elaboration on legal basis for processing personal data

The PDP Law establishes six legal bases for processing personal data. GR 33/2026 provides more detailed requirements for applying those bases, particularly consent and legitimate interests.

For consent, consent be given freely, consciously, specifically and unambiguously, following provision of relevant information to the data subject. Where consent is used in connection with offering goods or services, additional disclosures are required from the data controller, including the third parties receiving the data, the form of the offer, and the mechanism for withdrawing consent and reporting continued solicitation after withdrawal.

GR 33/2026 also provides a clearer framework for legitimate interests. A controller may rely on this basis where it has assessed the necessity, purpose and balance between its interests and the data subject’s rights, and determined that it has a legitimate interest. It must also assess whether the processing could have legal implications or cause harm to the data subject and identify mitigation measures where necessary.

Practical takeaway: With a more detailed elaboration of each legal basis for processing, businesses should therefore reassess the legal bases used for existing processing activities, document legitimate-interest assessments and maintain evidence of consent.

(b) One-size-fits all data privacy procedures may no longer be enough: Specific requirements for processing of personal data of children and persons of disabilities

GR 33/2026 provides further requirements for the processing of personal data of children and persons of disabilities. For children, controllers must identify whether an individual is a child, obtain and verify parental or guardian consent, and consider the child’s capacity when handling data subject rights requests

For persons with disabilities, controllers must use appropriate identification and communication methods, including sign language, Braille and augmentative communication where appropriate, and provide accessible facilities and mechanisms for exercising data subject rights. In certain circumstances, consent may need to be obtained from a guardian.

Practical takeaway: Businesses serving these groups should review their consent, accessibility and rights-request procedures.

(c) Data processing tools: New rules for CCTV and other visual-processing technologies

GR 33/2026 establishes a dedicated framework for their use in public spaces and public-service facilities. Operators must inform individuals that the devices are operating and generally may not use them to identify individuals, subject to exceptions for crime prevention and law enforcement.

The regulation also introduces a privacy-by-design requirement. Controllers and processors must consider factors such as device location and camera angle and limit monitoring to areas relevant to the stated purpose. Clear and accessible notices must identify that visual-processing devices are operating and provide a contact person.

Practical takeaway: These requirements are particularly relevant to businesses operating premises accessible to the public, including offices, malls, hospitals, factories, warehouses, transport facilities and hotels. Businesses should review CCTV policies, notices, camera placement, coverage, purposes and identification capabilities.

(d) High-risk processing will require more active approach

GR 33/2026 provides greater clarity on mandatory Data Protection Impact Assessments (“DPIAs”) for high-risk processing. The DPIA must be carried out before processing begins and must cover the processing purpose, necessity and proportionality, risks to data subjects and mitigation measures. The assessment and mitigation measures must be documented and reviewed if risks change.

Practical takeaway: This is particularly relevant to businesses using AI, large-scale analytics, employee monitoring, biometric processing or profiling.

(e) More clarity on the right of data subjects to challenge AI-driven processing and profiling

The PDP Law gives data subjects a right to object to decisions based solely on automated processing, including profiling, where the processing may produce legal consequences or significant impacts. GR 33/2026 provides greater clarity on these concepts and on how controllers should respond.

Controllers must establish mechanisms for responding to objections by the data subjects and provide adequate information about the technology used and its consequences. Where a verified objection is accepted, an alternative involving human intervention, or not relying on the automated outcome, must be provided. Controllers may reject objections in specified circumstances, including where the decision has no legal or significant impact or where a highly accurate system and mitigation measures are in place.

Practical takeaway: Businesses using AI should identify high-impact decisions and establish human-review and objection mechanisms.

(f) Documentation exercise in relation to privacy compliance

GR 33/2026 places greater emphasis on demonstrating compliance in practice. Controllers should expect to maintain three distinct layers of documentation: internal processing rules, Records of Processing Activities (“RoPA”) and retention documentation.

Internal provisions establish the organisation’s framework for processing personal data. RoPA must document processing activities, including legal bases, purposes, data and data-subject categories, data flows, retention periods, third-party access, security measures and transfers. Controllers must also maintain retention policies covering retention periods, data categories, destruction methods, processor requirements, responsible persons and legal bases. Processors are likewise required to maintain records of their processing activities.

Practical takeaway: Businesses should maintain this documentation when carrying out data processing.

(g) Joint controllers and appointment of data processors: Outsourcing data processing does not outsource responsibilities

GR 33/2026 provides a clearer framework for joint controllers and processors. Joint controllers must have an agreement allocating roles, responsibilities and their relationship, and remain jointly and severally responsible for the relevant processing. GR 33/2025 also governs clauses that must be included under data processing agreements.

Practical takeaway: Businesses should review data processing agreements and vendor contracts, particularly for cloud, IT, payroll and marketing providers.

(h) Personal data is now an explicit M&A workstream

GR 33/2026 establishes specific rules for personal data transfers in mergers, demergers, acquisitions, consolidations and dissolutions.

Before a transfer, the relevant controllers must assess outstanding data subject rights and personal data protection obligations and establish appropriate technical and operational measures. Until completion, the former and new controllers are treated as joint controllers.

The regulation also requires the former and new data controllers to provide notifications to the data subjects both before and after the transaction.

Practical takeaway: Personal data should now be anticipated to be treated as a distinct M&A due diligence and transaction workstream. Parties should identify relevant personal data early in the transaction, assess outstanding data subject rights and compliance obligations, agree the data-transfer mechanics and access controls, and prepare the required data subject notifications as part of the transaction timetable.

(i) Cross-border data transfer will face a more structured assessment regime

GR 33/2026 provides greater clarity on whether a destination jurisdiction offers a level of protection “equivalent to or higher than” Indonesian data protection law. The assessment considers whether the destination has (i) personal data protection laws, (ii) a supervisory authority, and (iii) relevant international commitments or legally binding instruments.

The PDP Authority will assess jurisdictions and establish a list of countries and international organisations considered to meet the standard. Where a destination does not meet it, a transfer may still proceed using adequate and binding safeguards, including legally binding instruments, standard contractual clauses, binding corporate rules or other instruments recognised by the PDP Authority.

Consent may also serve as a basis for a cross-border transfer, but GR 33/2026 limits this mechanism to specific circumstances. The data controller must also inform both the PDP Authority and the relevant data subjects about the transfer and the compelling legitimate interest being pursued.

Practical takeaway: Businesses should monitor the list of jurisdictions recognised by the PDP Authority and assess their existing cross-border transfer arrangements accordingly.

(j) Appointment of DPO

The PDP Law mandates data controllers and data processors to appoint a Data Protection Officer (Pejabat atau Petugas yang Melaksanakan Fungsi Perlindungan Data Pribadi or “DPO”) in certain circumstances. GR 33/2026 now provides greater clarity on the DPO’s role and, importantly, the organisational conditions that must support the DPO in performing that role.

Controllers and processors must ensure that the DPO is involved in processing activities, has access to senior management, operates objectively and independently, and receives adequate resources and information. Conflicts of interest must also be avoided, and the DPO’s activities must be documented.

Practical takeaway: Businesses required to appoint a DPO should review its independence, management access, resources and involvement.

(k) Enforcement and administrative fines

GR 33/2026 gives the PDP Authority power to impose administrative sanctions, including written warnings, temporary suspension of processing, deletion or destruction of personal data and administrative fines. Multiple sanctions may be imposed for the same violation, and a written warning does not necessarily need to precede other sanctions.

For administrative fines, the maximum penalty is 2% of the annual revenue or annual receipts. The calculation is not simply a percentage applied automatically. GR 33/2026 requires the relevant violation variables to take into account factors including the impact and duration of the violation, the type of data affected, the number of affected data subjects, cooperation, business scale, and compliance history. 

Practical takeaway: Businesses should treat personal data compliance as an ongoing enforcement risk, rather than a documentation exercise undertaken only when a breach occurs. In particular, maintaining evidence of compliance, promptly addressing violations, cooperating with the Authority and maintaining a strong compliance record may become important factors in limiting enforcement exposure.

(l) The PDP Authority finally gets more clarity

Under the PDP Law, the PDP Authority was established as the institution responsible for implementing the personal data protection framework, but the PDP Law provided only a relatively high-level description of its role and functions. GR 33/2026 now provides significantly greater clarity on how the PDP Authority is expected to operate and exercise its powers.

In particular, GR 33/2026 gives the PDP Authority a more active regulatory and supervisory role. In addition to issuing further regulations and guidelines contemplated under the regulation, the PDP Authority is expected to supervise compliance and inspect suspected violations by data controllers and data processors.

However, as of the date of this publication, the PDP Authority has not yet been established. This means that some aspects of the new framework remain subject to further regulations and guidelines that will need to be issued once the PDP Authority is established. R 33/2026 nevertheless permits controllers and processors to continue processing personal data pending the issuance of relevant regulations, provided the processing does not conflict with GR 33/2026.

Practical takeaway: Businesses should begin addressing requirements that are already sufficiently clear under GR 33/2026, while monitoring the establishment of the PDP Authority and the subsequent regulations and guidelines that will further shape the new compliance landscape.

IV. What it means for businesses across Indonesia

GR 33/2026 moves Indonesia’s personal data protection regime from broad principles towards a more detailed and operational compliance framework. For businesses, this means that compliance can no longer be limited to merely having policies in place. Data controllers will increasingly need to demonstrate how personal data is processed, who is responsible, what safeguards are in place, and how compliance is documented in practice.

Businesses should, in particular, consider:

• Reviewing their data processing activities and documentation, including RoPA, retention policies, internal privacy rules and DPIAs;

• Strengthening arrangements with processors and other third parties;

• Assessing AI, profiling and automated decision-making practices, particularly where these may significantly affect data subjects;

• Reviewing CCTV and other visual-processing practices;

• Preparing for greater scrutiny of cross-border data transfers, including the available transfer mechanisms;

• Integrating personal data considerations into M&A transactions and transaction planning; and

• Reviewing DPO arrangements and overall compliance readiness, given the more structured enforcement and administrative fine regime.

	NATHANIEL MANGUNSONG Partner PSHP Adrem Law t +62 5229705 - 06 m +62 81717101181 e nathaniel.mangunsong@pshpadrem.law
	SEBASTIAN SORMIN Associate PSHP Adrem Law t +62 5229705 - 06 e sebastian.sormin@pshpadrem.law