Indonesia's Personal Data Protection Law (Law No. 27 of 2022, UU PDP) has been fully applicable since its two-year adjustment period ended in October 2024, yet the supervisory agency it relies on still did not exist in October 2026, which leaves organisations with binding duties and an incomplete enforcement machine. The gap is narrowing: Government Regulation No. 33 of 2026 (PP 33/2026), the implementing regulation, was promulgated on 16 July 2026 and takes effect on 16 January 2027. This guide covers who the law reaches, the duties that matter most to security teams (the 3 x 24 hour breach notice, security measures, impact assessments, the data protection officer and cross-border transfers), the sanction regime, what the law means for AI agents and machine credentials, and a compliance plan. It is written for security, privacy and engineering leads supporting processing in Indonesia or of Indonesian citizens' data. For how Indonesia fits among other regimes, see the Global Privacy Regulatory Map.
Key takeaways
- Breach notice in 3 x 24 hours: Article 46 requires written notice to affected data subjects and to the supervisory agency within 3 x 24 hours of a personal data protection failure, with public notice in certain cases.
- The law is in force, the agency is not: UU PDP took effect on 17 October 2022 and its adjustment period ended in October 2024; the Personal Data Protection Agency (the "lembaga") had not been established by October 2026, and the Ministry of Communication and Digital Affairs (Komdigi) continues oversight in the interim.
- PP 33/2026 starts on 16 January 2027: its 225 articles detail consent, records of processing, impact assessments (Articles 120 to 121), transfers (Articles 160 to 174) and fines of up to 2% of annual revenue (Article 185).
- Extraterritorial reach: Article 2 covers anyone outside Indonesia whose processing has legal effect in Indonesia or on Indonesian citizens abroad, so offshore SaaS and cloud providers are in scope.
- Criminal exposure is real: unlawful collection, disclosure, use or falsification of personal data carries prison terms of up to six years and fines up to IDR 6 billion, multiplied up to ten times for corporations.
Scope: who and what is covered
UU PDP was enacted and promulgated on 17 October 2022 (State Gazette 2022 No. 196) and is recorded as in force on the national legal database. It applies to every person, public body and international organisation that carries out legal acts regulated by the law, both inside Indonesia and outside it where those acts have legal consequences in Indonesia or for Indonesian citizens abroad. Processing by individuals for purely personal or household purposes is excluded.
| Element | UU PDP position | Where |
|---|---|---|
| Personal data | Data about an individual identified or identifiable, alone or combined with other information, directly or indirectly, through electronic or non-electronic systems | Art. 1 |
| Specific personal data | Health, biometric, genetic, criminal records, children's data, personal financial data and other data under legislation | Art. 4 |
| Controller (Pengendali Data Pribadi) | Decides the purposes and controls processing; carries most duties | Arts. 1, 20-50 |
| Processor (Prosesor Data Pribadi) | Processes on the controller's behalf; must follow instructions and also appoint a DPO where Article 53 triggers apply | Arts. 51-53 |
| Lawful bases | Explicit consent, contract, legal obligation, vital interests, public interest or official authority, legitimate interest | Art. 20 |
| Supervisory agency | A "lembaga" established by and reporting to the President; not yet formed (see Timeline) | Arts. 58-61 |
Offshore providers: a foreign cloud, SaaS or analytics provider processing data of Indonesian users is caught by Article 2. Sector rules sit alongside UU PDP: financial services, health and electronic system operator registration under Komdigi rules can add duties, so map them before relying on UU PDP alone.
Key obligations
Consent and lawful bases
Article 20 lists six lawful bases, and consent must be explicit, for a stated purpose and recorded. PP 33/2026 (Articles 32 to 35) adds that consent must be free, specific, informed and unambiguous, bans deceptive capture, and requires controllers offering goods or services to disclose third-party recipients and how to withdraw. For security processing, legal obligation or legitimate interest is usually the better fit than consent: document the reasoning before you rely on it.
Security of processing
Article 35 requires the controller to protect and secure the personal data it processes through technical and operational measures, setting the security level according to the nature and risk of the data. The law does not name controls, so a recognised baseline (ISO/IEC 27001:2022, NIST CSF 2.0) is the practical way to show the measures fit the risk. Controllers must also keep data confidential and supervise every party involved in processing under its control.
Data subject requests
Several rights carry a 3 x 24 hour clock from receipt of the request, including correcting inaccurate data, giving access to data and its processing record, and delaying or restricting processing. That is far shorter than the GDPR's one month, so request intake, identity verification and system lookups need to be close to automated.
Impact assessments and records
Article 34 requires a data protection impact assessment where processing carries high potential risk, and lists seven cases: automated decisions with legal or significant effects, specific personal data, large-scale processing, systematic evaluation, scoring or monitoring, matching or combining datasets, new technology, and processing that limits data subjects' rights. PP 33/2026 Article 121 requires the assessment before processing begins and a review when risk changes; the elucidation to Article 120 names AI, machine learning, smart technology and IoT. PP 33/2026 also sets a record of processing activities with at least 13 content items and a written retention policy. See the DPIA Guide and the Data Mapping and ROPA Guide.
Data protection officer
Article 53 requires controllers and processors to appoint an official or officer for personal data protection where processing is for public services, where core activities need regular and systematic large-scale monitoring, or where core activities involve large-scale processing of specific personal data or data on criminal offences. In Decision 151/PUU-XXII/2024 the Constitutional Court ruled that the "and" in Article 53(1)(b) must be read as "and/or", so either condition is enough to trigger the duty.
Breach notification
| Item | UU PDP Article 46 | Practical note |
|---|---|---|
| Trigger | A failure of personal data protection (kegagalan Pelindungan Data Pribadi) | Wider than confirmed exfiltration; treat confirmed unauthorised access or exposure as the start point and record your reasoning |
| Deadline | No later than 3 x 24 hours | Repeated in PP 33/2026 Article 114; plan for 72 hours from awareness |
| Recipients | Data subjects and the agency | Both at once, unlike the GDPR's risk-based subject notice |
| Minimum content | Data exposed; when and how; handling and recovery steps | Pre-build a bilingual template |
| Public notice | Required "in certain cases" | Expect it for incidents affecting public services or large populations |
| Interim recipient | Komdigi handles incidents and complaints until the agency exists | Check sector regulators (OJK, Bank Indonesia) for parallel duties |
For the global comparison of clocks, see the Breach Notification Laws by Country Guide.
Cross-border transfers
Article 56 allows transfers to controllers or processors outside Indonesia. The controller must first ensure the destination country offers protection equal to or higher than UU PDP; failing that, it must use adequate and binding safeguards; failing both, it must obtain the data subject's consent. PP 33/2026 Articles 160 to 174 keep that order and narrow the consent route to non-recurring transfers involving few data subjects, with prior notice to the agency and the data subject. The adequacy list, agency-issued standard contractual clauses and approved binding corporate rules depend on the agency, so they did not exist as of October 2026. In the meantime, intra-group agreements and contracts modelled on recognised clauses are the usual safeguard, documented with a transfer assessment. See the International Data Transfers Map and the Data Sovereignty and Residency Guide.
Timeline and current status
| Date | Event | Effect |
|---|---|---|
| 17 October 2022 | UU PDP enacted, promulgated and effective | Article 74 two-year adjustment period begins |
| October 2024 | Adjustment period ends | All duties apply; no implementing regulation or agency yet |
| 20 May 2026 | Draft presidential regulation on the agency sent for signature (KemenPAN-RB letter) | Agency still to be formed |
| 16 July 2026 | PP 33/2026 promulgated | Six-month run-in |
| 27 July 2026 | Government opposes Constitutional Court petition 236/PUU-XXIV/2026 seeking a deadline for the agency rules | Case pending at the time of writing |
| 16 January 2027 | PP 33/2026 takes effect (Article 225) | Detailed consent, DPIA, DPO, transfer and fine rules apply |
Interim position: PP 33/2026 Article 223 lets processing continue while the agency's own regulations are pending, provided it does not conflict with the regulation. Commentators quoted in the Indonesian press in September 2026 did not expect the agency to be fully operational before 2028. Treat the agency timeline as uncertain and check the status before each annual review.
Enforcement and penalties
| Type | Measure | Source |
|---|---|---|
| Administrative | Written warning, temporary suspension of processing, deletion or destruction of data, administrative fine | UU PDP Art. 57; PP 33/2026 Art. 184 |
| Administrative fine | Up to 2% of annual revenue or receipts, per violation variable | UU PDP Art. 57(3); PP 33/2026 Art. 185 |
| Publication | The agency may publish the results of its supervision | PP 33/2026 Art. 183 |
| Criminal: unlawful collection | Up to 5 years and/or IDR 5 billion | UU PDP Art. 67(1) |
| Criminal: unlawful disclosure | Up to 4 years and/or IDR 4 billion | UU PDP Art. 67(2) |
| Criminal: unlawful use | Up to 5 years and/or IDR 5 billion | UU PDP Art. 67(3) |
| Criminal: creating or falsifying data | Up to 6 years and/or IDR 6 billion | UU PDP Art. 68 |
| Corporations | Fines up to 10 times the maximum, plus confiscation, business suspension, licence revocation or dissolution | UU PDP Art. 70 |
Criminal provisions apply now through the police and courts and do not wait for the agency. Administrative fines need the agency to impose them, which is why enforcement has so far been weak. Data subjects can also seek compensation for violations.
What it means for AI agents and non-human identities
UU PDP does not mention AI agents, but three duties land directly on them and on the service accounts, API keys and tokens they run on.
- Automated decisions: Article 34(2)(a) makes automated decision-making with legal or significant effects a DPIA trigger, and the PP 33/2026 elucidation names AI and machine learning. Any agent that approves, scores or declines people needs an assessment before deployment. See the AI Impact Assessment Template.
- Machine credentials as a breach path: a leaked API key or over-privileged service account that exposes customer records is a protection failure under Article 46 and starts the 3 x 24 hour clock. Inventory, owners, rotation and least privilege for these identities are part of the Article 35 security duty. See the Non-Human Identity (NHI) Guide and the Secrets Management Guide.
- Agents calling offshore models: an agent that sends Indonesian users' prompts or records to a model endpoint outside Indonesia is making an Article 56 transfer. Record the endpoint region, the safeguard and the data categories in the transfer register.
- Access requests on a 3 x 24 hour clock: data held in agent memory, vector stores and logs is in scope for access and correction. If you cannot find it in three days, you cannot comply.
Compliance steps
- Confirm scope: list entities, products and systems that process Indonesian residents' or citizens' data, including offshore processors and agents.
- Map data and lawful bases: build the record of processing to the PP 33/2026 minimum content, flag specific personal data, and assign an Article 20 basis to each activity.
- Appoint the DPO where Article 53 applies: read the triggers with "and/or", and include processors.
- Run DPIAs: screen every activity against the seven Article 34 triggers, starting with AI, biometrics and large-scale monitoring; repeat when risk changes.
- Rebuild the breach runbook for 72 hours: include simultaneous subject and agency notice, the three content items, Komdigi as interim contact and sector regulators. Test it with a tabletop before go-live. See the Incident Response Plan Template.
- Paper transfers: list destinations, apply the Article 56 hierarchy, sign safeguards, and plan to swap in agency clauses once published.
- Automate requests: route access, correction and restriction requests to a tracked queue with a 3 x 24 hour timer and a rollback for wrong-person disclosures.
- Prepare for 16 January 2027: gap-assess against PP 33/2026 consent, retention and audit (Articles 138 and 141) rules, then re-check for agency regulations each quarter.
Framework mapping
| UU PDP duty | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Legal requirements (Art. 2, 20) | GV.OC-03 | PT-2, PT-3 | A.5.31, A.5.34 |
| Records and data inventory | ID.AM-07 | PM-5 | A.5.9, A.5.12 |
| Security of processing (Art. 35) | PR.DS-01, PR.DS-02, PR.AA-05 | AC-6, IA-5, AU-2 | A.8.2, A.8.5, A.8.15, A.8.24 |
| DPIA (Art. 34) | GV.OC-03 | RA-8 | A.5.34 |
| Breach notice (Art. 46) | RS.CO-02 | IR-6, IR-8 | A.5.24, A.5.26 |
| Processors and transfers (Arts. 51, 56) | GV.OC-03 | SA-9 | A.5.19, A.5.20 |
Measuring it
- Breach clock: median hours from detection to dual notice in exercises, target under 72.
- Request timeliness: percentage of access, correction and restriction requests closed within 3 x 24 hours.
- DPIA coverage: share of Article 34 trigger activities, including AI agents, with a current assessment.
- Transfer coverage: share of offshore destinations with a documented Article 56 basis.
- Machine credential hygiene: percentage of service accounts and API keys touching personal data with a named owner and rotation in policy.
Common failure patterns
- Waiting for the agency: treating the missing agency as a pause. The duties and criminal offences already apply, and Komdigi handles incidents now.
- Importing the GDPR clock: planning a risk-based subject notice later. Article 46 requires notice to subjects and the agency together within 3 x 24 hours.
- One-month request handling: copying GDPR timelines for access and correction when several Indonesian rights run on 3 x 24 hours.
- Reading Article 53 with "and": skipping a DPO because only one limb applies, despite the Constitutional Court's "and/or" ruling.
- Using consent for routine transfers: PP 33/2026 limits consent to non-recurring, small transfers, so recurring cloud and group flows need safeguards.
- Unowned machine credentials: long-lived keys and service accounts on customer data stores with no owner, which turn a leaked secret into a notifiable failure.
Practitioner checklist
- Confirm whether Article 2 extraterritorial scope applies to each product and offshore processor.
- Complete a record of processing with lawful bases and specific personal data flagged.
- Appoint a DPO wherever either Article 53 limb applies, for controllers and processors.
- Screen all processing, including AI agents, against the seven Article 34 DPIA triggers.
- Adopt a 72-hour runbook with dual notice to subjects and the agency, and Komdigi as interim contact.
- Document an Article 56 basis for every offshore destination, including model and SaaS endpoints.
- Set a 3 x 24 hour timer on access, correction and restriction requests.
- Inventory and assign owners to service accounts, API keys and tokens that reach personal data.
- Gap-assess against PP 33/2026 before 16 January 2027 and recheck agency status quarterly.
Standards and references
- BPK RI JDIH: Undang-undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi
- Pasal.id: UU No. 27 Tahun 2022, Pasal 46 (breach notification)
- Pasal.id: UU No. 27 Tahun 2022, Pasal 34 (impact assessment)
- RSM Indonesia: Client Alert on Government Regulation No. 33 of 2026
- HLC: A first look at GR 33/2026
- HLC: Awaiting Indonesia's Personal Data Protection Authority
- SSEK via Conventus Law: Consequences of breaches of data protection law in Indonesia
- Bisnis.com: Pembentukan Badan PDP Dipercepat
Related NHI Mgmt Group resources: International Data Transfers Map · Breach Notification Laws by Country Guide · Singapore PDPA Guide · Vietnam Personal Data Protection Guide · Global Privacy Regulatory Map. This guide summarises Indonesia's Law No. 27 of 2022 on Personal Data Protection and Government Regulation No. 33 of 2026 as at October 2026 and is not legal advice.