Issued Date: 27 October 2026
INTRODUCTION
Indonesia's personal data protection regulatory framework has undergone a significant development following the issuance of Government Regulation No. 33 of 2026 on the Implementing Regulation of Law No. 27 of 2022 on Personal Data Protection ("GR 33/2026").
Following the enactment of Law No. 27 of 2022 on Personal Data Protection (the "PDP Law"), GR 33/2026 was introduced to further implement its provisions by establishing more detailed and technical requirements. In essence, GR 33/2026 governs personal data processing, the rights and obligations of relevant parties, cross-border personal data transfers, regulatory supervision, administrative sanctions, and dispute resolution.
In light of these developments, this Client Alert outlines the key provisions of GR 33/2026 and their practical implications for businesses operating in Indonesia.
KEY PROVISIONS
GR 33/2026 establishes a more detailed regulatory framework for personal data protection in Indonesia, particularly concerning the obligations and responsibilities of Personal Data Controllers ("Controllers") and Personal Data Processors ("Processors").
Before going further with their respective obligations, it is important for businesses to understand the distinction between these two roles, such as:
- Controller determines the purposes and exercises control over the processing of Personal Data;
- Processor processes Personal Data on behalf of a Controller and in accordance with its instructions.
Illustration:
Note: a Controller may process Personal Data independently or appoint a Processor to do so on its behalf. An entity's status as a Controller is determined by its control over the processing of Personal Data. Accordingly, a corporation receiving and/or storing Personal Data may qualify as a Controller, regardless of whether such data is processed for commercial or non-commercial purposes (Article 3 and Article 8 of GR 33/2026).
In certain circumstances, a single entity may act as both a Controller and a Processor, depending on its role in each Personal Data processing activity.
Having distinguished between the respective roles of Controllers and Processors, set out below are the key provisions of GR 33/2026, categorized according to their applicability to each role, which businesses should take into consideration when carrying out Personal Data processing activities.
Obligations of Personal Data Controllers
| No. | Key Provisions | Summary of Obligations |
| 1 | Legal Basis for Processing Personal Data | Controllers must establish a valid legal basis before processing Personal Data, including consent, contractual obligations, legal obligations, vital interests, public interest, or legitimate interests. Where consent is relied upon, it must be freely given, informed, specific, and unambiguous. Controllers must also maintain proof of consent and provide mechanisms for its withdrawal. (Articles 30–39). |
| 2 | Personal Data Processing Policies | Controllers must establish internal Personal Data processing policies in accordance with guidelines issued by the PDP Agency. Controllers must also provide Personal Data Subjects with relevant information concerning processing activities, including the purposes, legal basis, and applicable retention periods. (Articles 28 and 62–68). |
| 3 | Recording and Documentation of Personal Data Processing Activities | Controllers must maintain records of Personal Data processing activities, including the purposes and legal basis of processing, categories of Personal Data and Personal Data Subjects, applicable security measures, and information on Personal Data transfers. (Articles 74–75). |
| 4 | Fulfilment of Personal Data Subject Rights | Controllers must provide accessible channels for Personal Data Subjects to exercise their rights, including access, correction, deletion, withdrawal of consent, and data portability. Controllers must verify and respond to such requests in accordance with the procedures and applicable time limits under GR 33/2026. (Articles 20–27 and 69–113). |
| 5 | Personal Data Protection Impact Assessment | Controllers must conduct a Personal Data Protection Impact Assessment (DPIA) before undertaking processing activities that pose a potentially high risk to Personal Data Subjects, including large-scale processing, automated decision-making, systematic monitoring, and processing involving new technologies. (Articles 120–122). |
| 6 | Notification of Personal Data Protection Failures | Controllers must notify affected Personal Data Subjects and the PDP Agency in writing within 3 x 24 hours after becoming aware, or when they reasonably should have become aware, of a Personal Data Protection Failure. Public notification is also required under certain circumstances. (Articles 114–119). |
| 7 | Appointment of Personal Data Processors | Controllers may appoint Processors through agreements specifying, among others, the scope, purposes, methods, and duration of processing, the parties' respective obligations, audit mechanisms, dispute resolution, and the engagement of other Processors. Processing by appointed Processors remains the responsibility of the relevant Controllers. (Articles 13–16). |
| 8 | Joint Personal Data Controller Arrangements | Where two or more Controllers jointly determine the purposes and exercise control over Personal Data processing, they must enter into an agreement governing their respective roles, responsibilities, and processing arrangements. Joint Controllers are subject to joint and several legal responsibilities for such processing. (Articles 11–12). |
Obligations of Personal Data Processors
| No. | Key Provisions | Summary of Obligations |
| 1 | Processing Based on Controller Instructions | Processors must process Personal Data in accordance with the Controller's documented instructions and the agreement between the parties. Where a Processor processes Personal Data beyond the Controller's instructions and purposes, such processing becomes the responsibility of the Processor. (Article 139). |
| 2 | Engagement of Other Personal Data Processors | Processors must obtain prior written consent from the relevant Controller before engaging other Processors. Such engagement must be governed by a written agreement ensuring an equivalent level of Personal Data Protection. (Article 15). |
| 3 | Personal Data Protection and Security Obligations | Processors must comply with the applicable obligations relating to Personal Data accuracy, processing records, security measures, prevention of unauthorized processing, and protection against unauthorized access or disclosure. (Article 140 in conjunction with Articles 69, 74, 123, 125, 126, 129, and 130). |
| 4 | Accountability and Compliance Documentation | Processors must document their processing activities, respond to information requests from the PDP Agency, demonstrate compliance with applicable Personal Data Protection obligations, and conduct audits. (Article 141). |
Obligations Applicable to Both Controllers and Processors
| No. | Key Provisions | Summary of Obligations |
| 1 | Appointment of Personal Data Protection Officers | Controllers and Processors must appoint an official or officer performing Personal Data Protection functions (PPDP) where the prescribed conditions are met, including processing for public services, large-scale systematic monitoring, or large-scale processing of specific Personal Data. (Articles 142–146). |
| 2 | Personal Data Protection and Organizational Security | Controllers and, to the extent expressly applicable, Processors must implement appropriate technical and organizational measures to protect Personal Data against unauthorized access, disclosure, alteration, loss, or destruction. (Articles 123–130 and 140). |
| 3 | Cross-Border Transfers of Personal Data | Cross-border transfers must comply with the applicable Personal Data Protection requirements, including the prescribed hierarchy of transfer safeguards. Controllers and/or Processors involved in such transfers must also undertake relevant documentation, mapping, assessment, and compliance measures. (Articles 160–174). |
| 4 | Administrative Sanctions | Controllers and/or Processors violating specified obligations may be subject to administrative sanctions, including written warnings, temporary suspension of processing activities, deletion or destruction of Personal Data, and administrative fines of up to 2% of annual income or annual receipts, calculated by reference to the applicable violation variables. (Articles 184–199). |
Other Key Provisions under GR 33/2026
In addition to the respective obligations of Controllers and Processors, GR 33/2026 introduces further provisions concerning the transfer of Personal Data in corporate actions, regulatory supervision and enforcement, and dispute resolution mechanisms, as summarized below.
| No. | Key Provisions | Summary of Obligations |
| 1 | Cross-Border Transfers of Personal Data | GR 33/2026 regulates the transfer of Personal Data outside Indonesia by requiring Controllers to ensure that the receiving country provides an equivalent or higher level of Personal Data Protection. Where such requirement cannot be met, Controllers must ensure the availability of adequate and binding safeguards, including standard contractual clauses or binding corporate rules. If neither requirement can be fulfilled, the transfer may be carried out based on the consent of the relevant Personal Data Subjects which has been obtained at the outset of personal data processing. Controllers and/or Processors must also comply with the applicable documentation, risk assessment, and notification requirements (Articles 160–174 of GR 33/2026). |
| 2 | Transfer of Personal Data in Corporate Actions | GR 33/2026 regulates the transfer of Personal Data in connection with mergers, demergers, acquisitions, consolidations, and dissolutions of legal entities. Controllers must assess the rights of Personal Data Subjects and their outstanding data protection obligations before transferring Personal Data. The existing and new Controllers are also required to notify affected Personal Data Subjects before and after the relevant corporate action takes effect. For mergers, demergers, acquisitions, and consolidations involving Personal Data transfers, the Controllers must enter into an agreement governing Personal Data Protection and their respective responsibilities. (Articles 131–138). |
| 3 | Regulatory Supervision and Administrative Enforcement | GR 33/2026 authorizes the Personal Data Protection Agency (the "PDP Agency") to supervise compliance with Personal Data Protection requirements through monitoring, examination, and investigation of alleged violations. Controllers and/or Processors found to have violated certain obligations may be subject to administrative sanctions, including written warnings, temporary suspension of processing activities, deletion or destruction of Personal Data, and administrative fines of up to 2% of annual income or annual receipts, subject to the applicable calculation and assessment criteria. (Articles 180–199). |
| 4 | Personal Data Protection Dispute Resolution | GR 33/2026 further regulates the settlement of Personal Data Protection disputes through arbitration, courts, or alternative dispute resolution mechanisms. Disputing parties may submit reports to the PDP Agency, which will verify the reported matters and determine the appropriate follow-up. Where no criminal or administrative violation is identified, the PDP Agency may facilitate dispute resolution, prioritizing mediation, subject to the applicable requirements and exceptions. (Articles 200–222). |
WHAT COMES NEXT?
GR 33/2026 will come into effect on 16 January 2027, six months following its promulgation. Business actors should therefore use this period to assess their existing Personal Data processing activities and ensure compliance with the more detailed requirements introduced under GR 33/2026.
In particular, business actors should identify their respective roles as Controllers and/or Processors, review their internal Personal Data Protection policies and procedures, and assess whether their existing data processing agreements, security measures, and cross-border data transfer arrangements require further adjustments.
GR 33/2026 also contemplates the issuance of further implementing regulations by the PDP Agency. We will continue to monitor these regulatory developments and provide further updates should there be any significant changes affecting the implementation of GR 33/2026.
If you have further questions on this matter, please contact us via email at:
Ruben Soeratman
Partner & Data Privacy Officer
ruben.soeratman@nurjadinet.com
Fajar Riduan Siahaan
Partner
fajar.siahaan@nurjadinet.com
Hafizhah Kurnia Putri
Senior Associate
hafizhah.putri@nurjadinet.com
Naura Maharani Adawiya Syafril
Associate
naura.syafril@nurjadinet.com
Disclaimer:
The substance of this document is only information and shall not constitute legal advice. We will not be liable for any consequence that occurs due to any party that relies upon the content of this document.