PERSONAL DATA PROTECTION
Government Regulation No. 33 Year 2026 (“GR 33”) was enacted on16 July 2026 and will be effective on 16 January 2027. GR 33 is the implementation of the Law on Personal Data Protection Law No. 27 Year 2022 (“Law 27”).
On the reason that regulation regarding personal data protection was scattered across various laws and regulation, Law 27 was enacted to enhance the effectiveness of personal data protection thus, including protecting data subject which personal data is processed by data controller and regulating the obligations of data controller which is an individual, public institution, or international organization that acts either independently or jointly to determine the purposes of and exercise control over the processing of personal data.
Law 27 expressly prohibits any person from (i) unlawfully obtain or collect personal data that does not belong to them with the intent to benefit themselves or another person, in a manner that may result in loss to the data subject (ii) unlawfully disclose personal data that does not belong to them (iii) using personal data which is not its own (iv) creating false personal data or falsifying personal data with the intent to benefit themselves or another person in a manner that results in loss to another person.
These will be subject to sanctions in the form of imprisonment for a maximum of 6 years and/or a fine of a maximum of Rp 6 billion and the forfeiture of profits and/or assets obtained from or resulting from the relevant criminal act as well as the payment of compensation for losses.
If criminal offenses above are committed by a corporation, the penalty may be imposed upon the management, the person exercising control or giving order, beneficial owner and/or company. Penalty imposed upon the company is a fine which is no more than 10 time of the maximum fine. A corporation may also subject to an additional penalty in the form of among other suspension of all or part of the company’s business operations, revocation of a license and/or dissolution of the company.
GR 33 is implementing some provisions under Law 27 which among others are:
1. Mechanism to Exercise the Data Subject’ Rights
Law 27 grants the core rights to the data subject. This right is basically the right of the data subject to control/manage its personal data information, by means of (a) the right to the information itself namely the right to obtain clear details of legal basis, purpose, and accountability of controller, (b) the right to have an access and obtain copy of its personal data, (c) the right to rectify and delete its personal data, (d) the right to withdraw its consent, (e) the right to object, and (f) the right to get compensation, etc.
According to the provision in Article 14 of Law 27 the data subject can exercise its rights above by way of submitting an application to the data controller through electronic or non-electronic method.
GR 33 stipulates the implementation provisions for the data subject exercising of its basic rights above as follows:
2. Joint Controllers
Article 18 of the Law 27 allows processing of the personal data to be carried out jointly with another data controller or more controllers, on the condition that, such arrangement (i) must be supported with an agreement between the controllers, (ii) there is interrelated purposes between the parties; and (iii) appointment of liaison officer as contact person by the parties.
GR 33 regulates the joint control above as follows:
3. Record of the Processing Activities
Article 31 of Law 27 requires the personal data controller to record personal data processing activities.
Article 74 of GR 33 describes the personal data processing activities shall a minimum include:
4. Cross border transfer
Law 27 allows the data controller to transfer personal data to data controller and/or data processor outside Indonesia. In carrying out the transfer of personal data, the data controller transferring the personal data and the party receiving the transfer of personal data are required to ensure personal data protection in accordance with the laws and regulations on personal data protection. The transferor of personal data must ensure that the country where the recipient of personal data is domiciled maintains a level of personal data protection that is equivalent to or higher than that stipulated in Law 27. In the event the requirement above is not met, the data controller must ensure the existence of adequate and binding personal data protection; or if all the above are not met, approval/ consent from the data subject is required to be obtained.
GR 33 stipulates that the assessment of the level of personal data protection mentioned above is conducted by the institution which is responsible for data protection. This institution is required to make a list of countries and/or international organizations which have equal or higher level of protection than Indonesia. The President must designate the establishment of this institution (“Institution”). This Institution, however, has not yet been established by the President.
5. Failure of Personal Data Protection
Article 46 of Law 27 requires the data controller to provide a written notice within 3x24 hour to the data subject and to the Institution in the event of a personal data protection failure,
Article 114 of GR 33 clarifies that 72 hours notification obligation starts from the time the personal data protection failure becomes known with certainty and in a manner that is proper and reasonable. Notice to Institution must be supported with documentation containing of at least the description of effected data, impact/consequences to the data subjects, remedial, and recovery efforts that have been and will be taken by the data controller. The notice must also include information regarding the data protection officer or the contact person designated by the personal data controller.
6. Company Restructuring
Article 48 of Law 27 stipulates that when a corporate data controller undergoes a merger, separation, acquisition, consolidation or dissolution, it must notify the data subject about the transfer of their personal data. The notice must be provided both before and after the event takes place.
And if corporate data controller dissolves or is dissolved, the storage, transfer and destruction of personal data shall be carried out in accordance with the applicable laws and regulations and the effected data subject must be notified.
According to GR 33, the required notice above must be issued by both the former and the new data controllers. The notification must include the information about the transferred data, the new data controller's identity, the intended processing activities and processing schedule by the new controller, and also the mechanism/procedure, timelines for the data subject to submit objection. GR 33 also clarifies that during such restructuring , the participating entities are treated as joint controllers until the process is legally finalized.
7. Data Protection Authority (DPA/Institution)
Until the enactment of GR 33, the DPA has not yet been established by the President. According to Article 59 of Law 27, the DPA carries out:
Disclaimer: This article is intended as general information only and it does not constitute a legal advice. We accept no responsibility for any loss that may arise from reliance on this information. Please contact us if you need full legal advice.
On the reason that regulation regarding personal data protection was scattered across various laws and regulation, Law 27 was enacted to enhance the effectiveness of personal data protection thus, including protecting data subject which personal data is processed by data controller and regulating the obligations of data controller which is an individual, public institution, or international organization that acts either independently or jointly to determine the purposes of and exercise control over the processing of personal data.
Law 27 expressly prohibits any person from (i) unlawfully obtain or collect personal data that does not belong to them with the intent to benefit themselves or another person, in a manner that may result in loss to the data subject (ii) unlawfully disclose personal data that does not belong to them (iii) using personal data which is not its own (iv) creating false personal data or falsifying personal data with the intent to benefit themselves or another person in a manner that results in loss to another person.
These will be subject to sanctions in the form of imprisonment for a maximum of 6 years and/or a fine of a maximum of Rp 6 billion and the forfeiture of profits and/or assets obtained from or resulting from the relevant criminal act as well as the payment of compensation for losses.
If criminal offenses above are committed by a corporation, the penalty may be imposed upon the management, the person exercising control or giving order, beneficial owner and/or company. Penalty imposed upon the company is a fine which is no more than 10 time of the maximum fine. A corporation may also subject to an additional penalty in the form of among other suspension of all or part of the company’s business operations, revocation of a license and/or dissolution of the company.
GR 33 is implementing some provisions under Law 27 which among others are:
1. Mechanism to Exercise the Data Subject’ Rights
Law 27 grants the core rights to the data subject. This right is basically the right of the data subject to control/manage its personal data information, by means of (a) the right to the information itself namely the right to obtain clear details of legal basis, purpose, and accountability of controller, (b) the right to have an access and obtain copy of its personal data, (c) the right to rectify and delete its personal data, (d) the right to withdraw its consent, (e) the right to object, and (f) the right to get compensation, etc.
According to the provision in Article 14 of Law 27 the data subject can exercise its rights above by way of submitting an application to the data controller through electronic or non-electronic method.
GR 33 stipulates the implementation provisions for the data subject exercising of its basic rights above as follows:
- In order to implement the rights of the data subject as described above, now, Article 21 of GR 33, requires the data controller to provide a channel for receiving applications from the data subjects and that, if the data controller processes personal data by electronic means, the application of the basic rights by the data subject must be submitted through electronic.
- In addition, GR 33 describes that application of the data subject’s basic rights to the data controller can be submitted by the data subject’s attorney or, by a guardian if it is a child or person with disability.
2. Joint Controllers
Article 18 of the Law 27 allows processing of the personal data to be carried out jointly with another data controller or more controllers, on the condition that, such arrangement (i) must be supported with an agreement between the controllers, (ii) there is interrelated purposes between the parties; and (iii) appointment of liaison officer as contact person by the parties.
GR 33 regulates the joint control above as follows:
- Article 11 of GR 33 requires that such bilateral agreement must at least outline: (a) each party legal base for processing personal data; (b) the purposes of conducting personal data process; (c) type of the personal data being processed; (d) the role and responsibility of each party; (e) the agreed processing method; and (f) mentioning the jointly appointed liaison officer, if data controller is a jointly controller.
- Article 12 of GR 33 emphasizes that joint personal data controllers shall bear joint and several liability on processing personal data.
3. Record of the Processing Activities
Article 31 of Law 27 requires the personal data controller to record personal data processing activities.
Article 74 of GR 33 describes the personal data processing activities shall a minimum include:
- Names and contact details of the personal data controller, joint personal data controller, and/or personal data processor
- Personal data protection officer and details
- The sources of collection and destinations for the transfer of personal data
- Legal basis for personal data processing
- The purpose of personal data processing
- Types of personal data
- Categories of the data subject
- Parties other than data controller who may access the personal data
- Fulfillment of the data subject rights
- Retention period
- Technical and organizational measures for securing personal data; and
- Details of personal data transfers.
4. Cross border transfer
Law 27 allows the data controller to transfer personal data to data controller and/or data processor outside Indonesia. In carrying out the transfer of personal data, the data controller transferring the personal data and the party receiving the transfer of personal data are required to ensure personal data protection in accordance with the laws and regulations on personal data protection. The transferor of personal data must ensure that the country where the recipient of personal data is domiciled maintains a level of personal data protection that is equivalent to or higher than that stipulated in Law 27. In the event the requirement above is not met, the data controller must ensure the existence of adequate and binding personal data protection; or if all the above are not met, approval/ consent from the data subject is required to be obtained.
GR 33 stipulates that the assessment of the level of personal data protection mentioned above is conducted by the institution which is responsible for data protection. This institution is required to make a list of countries and/or international organizations which have equal or higher level of protection than Indonesia. The President must designate the establishment of this institution (“Institution”). This Institution, however, has not yet been established by the President.
5. Failure of Personal Data Protection
Article 46 of Law 27 requires the data controller to provide a written notice within 3x24 hour to the data subject and to the Institution in the event of a personal data protection failure,
Article 114 of GR 33 clarifies that 72 hours notification obligation starts from the time the personal data protection failure becomes known with certainty and in a manner that is proper and reasonable. Notice to Institution must be supported with documentation containing of at least the description of effected data, impact/consequences to the data subjects, remedial, and recovery efforts that have been and will be taken by the data controller. The notice must also include information regarding the data protection officer or the contact person designated by the personal data controller.
6. Company Restructuring
Article 48 of Law 27 stipulates that when a corporate data controller undergoes a merger, separation, acquisition, consolidation or dissolution, it must notify the data subject about the transfer of their personal data. The notice must be provided both before and after the event takes place.
And if corporate data controller dissolves or is dissolved, the storage, transfer and destruction of personal data shall be carried out in accordance with the applicable laws and regulations and the effected data subject must be notified.
According to GR 33, the required notice above must be issued by both the former and the new data controllers. The notification must include the information about the transferred data, the new data controller's identity, the intended processing activities and processing schedule by the new controller, and also the mechanism/procedure, timelines for the data subject to submit objection. GR 33 also clarifies that during such restructuring , the participating entities are treated as joint controllers until the process is legally finalized.
7. Data Protection Authority (DPA/Institution)
Until the enactment of GR 33, the DPA has not yet been established by the President. According to Article 59 of Law 27, the DPA carries out:
- formulation and establishment of policies and strategies for personal data protection that serve as guidelines for data subjects, data controllers and data processors;
- supervision of the implementation of personal data protection;
- administrative law enforcement regarding violations of the Law 27;
- facilitation of out- of- court dispute resolution;
- assist law enforcement in handling alleged personal data crimes;
- cooperate with personal data protection authorities of other countries in resolving alleged cross-border personal data protection violations;
- conduct assessments on the fulfillment of requirements for transferring personal data outside the jurisdiction of the Republic of Indonesia; and
- receive complaints and/or reports regarding alleged personal data protection violations.
Disclaimer: This article is intended as general information only and it does not constitute a legal advice. We accept no responsibility for any loss that may arise from reliance on this information. Please contact us if you need full legal advice.