The regulation keeps the 2023 draft's architecture and removes its compulsion. Wajib falls from 167 uses to 49, dilarang from three to none, and 34 articles hand their mechanism to a rule nobody has issued. Both instruments sit here in full, and every difference between the draft and the enacted text is set out below.
Every number here is counted from the two texts or from the differences found between them. None is estimated.
Every difference was read for its effect on the data subject, then put to a second reader whose standing instruction was to refute the reading. All eight verdicts below came back refuted and were corrected.
Three families, not eight colours. Ban yellow and violet, then reserve red and green for judgement, and about seventy degrees of the colour circle are left. That holds two hues comfortably and three at a stretch, because below roughly twenty five degrees of separation two hues cannot reliably be told apart. Eight could not be made to work, and two of the eight sat close enough to the judgement scale to be misread as it.
So the eight domains group into three families, spaced evenly on the arc that is left, and every hue on this page is solved for one common light value. Equal areas then carry equal weight, which is the only condition under which a bar chart tells the truth.
Judgement is a separate system. Two poles through a neutral, intensity carried by value rather than by a new hue, and each step doubled by a mark so it survives greyscale and colour blindness.
Thirty four findings split three ways: fourteen weaken a controller duty, ten strengthen one, eight concern state access to data held by controllers and run seven to one toward wider access, one removes a late compliance penalty and one is neutral.
Both consent and the other bases moved in both directions, so neither can be reported as a single block.
Twelve of the eighteen distinct findings weaken a right, and the losses concentrate in what a subject can enforce: the content of the notice, the start of the clock, the grounds for refusal, and the route to money. The set of twenty counts the rectification refusal and the notice content schedule twice each.
The three step cascade of equivalence, adequate and binding protection and consent survives intact. Around it the movement runs both ways, net weaker. The real losses: the one clause on foreign compulsion is gone, the processor drops out of the risk assessment at PP Pasal 163 and the pre transfer notice at PP Pasal 164, and the equivalence comparator narrows to the UU alone at PP Pasal 165 ayat (1).
Enforcement lost its collective redress route and its price for delay. RPP Pasal 211 gave the authority standing to claim compensation in the public interest and RPP Pasal 212 let it ask the prosecution service to conduct that claim; neither survives, so a mass breach has no public claimant, and prosecutorial assistance remains only for enforcing a sanction decision under PP Pasal 198 and for dispute resolution under Pasal 221.
Breach moved both ways. Scope widened: PP Pasal 114 states the 3 x 24 jam duty to the subject and the Lembaga with no exception clause, so RPP Pasal 124 ayat (5), which excused a failure that disclosed nothing, is gone and destruction, loss and alteration incidents now notify.
PP Pasal 8 keeps the six processing stages of RPP Pasal 9 and attaches none of the harus checklists that RPP Pasal 10 to Pasal 15 carried, with only the correction item reappearing at PP Pasal 70 as a subject right qualified by purpose and stripped of the facility RPP Pasal 83 required.
Commencement moved and nothing else in this domain moved the same way. RPP Pasal 245 applied on promulgation, while PP Pasal 225 applies six months after the 16 July 2026 promulgation, so the regulation's own articles bind from 16 January 2027.
Four domains moved in both directions and are marked mixed. Reporting those as weakening would be the easiest mistake to make here, and the first pass made it in all eight before the check caught it.
A duty that keeps its content but loses wajib still describes what good practice looks like. It stops being the thing a regulator can point at. Twenty five of the 112 differences are that move and nothing else.
| Form | Force | Draft | Enacted | Delta |
|---|---|---|---|---|
| wajib | mandatory, the form the sanction list hangs on | 167 | 49 | -118 |
| harus | directive, weaker than wajib | 88 | 100 | +12 |
| dapat | permissive | 174 | 141 | -33 |
| dilarang | prohibitory | 3 | 0 | -3 |
Test every control you built against the draft. If it relied on the text being mandatory, check whether the enacted wording still is.
Read as a question of who is better off under the enacted text than under the draft. A narrowed exemption strengthens protection and a widened permission weakens it, so the kind of change never settles its direction.
| Beneficiary | n | Share |
|---|---|---|
| Controllers and processors | 71 | 63% |
| Government and law enforcement | 12 | 11% |
| Data subjects | 20 | 18% |
| The supervisory institution | 6 | 5% |
| No one, structural | 3 | 3% |
12 of the 112 differences ease government or law enforcement access to personal data, and 11 of those shift an obligation materially. Five clause level changes cut the other way, so this domain must not be reported as moving in one direction.
Five changes cut the other way and two of them reach that substance. PP Pasal 155 ayat (1) drops penyelidik, which goes to who may make a demand, so a demand at the penyelidikan stage can be refused. PP Pasal 155 ayat (2) huruf g makes the letter state its own basis of authority.
PP Pasal 166 sends law enforcement exchange leaving Indonesian jurisdiction through the transfer cascade at PP Pasal 165. The permissive gateway at RPP Pasal 36 for releasing camera footage to law enforcement has no enacted counterpart, so each release now needs a basis under PP Pasal 30 ayat (3) recorded per request.
Each was checked against the whole enacted text before being called a deletion, because a clause that moved to an article the comparison never named would otherwise read as removed.
| The provision and what it did | Domain |
|---|---|
| Breaches without disclosure lost their notification exemption Breaches that disclosed nothing must now be notified, because the old exemption is gone. | Breach |
| Internal and external audit programme deleted and delegated The detailed audit and processor vetting programme is deleted and left to a rule not yet made. | Controller duties |
| Penalty for late compliance with a decision is gone Ignoring a regulator decision no longer triggers an automatic late payment penalty. | Controller duties |
| Ban on cameras in areas of private expectation is deleted The ban on cameras in areas of privacy expectation has been deleted entirely. | Controller duties |
| Bank Indonesia OJK and LPS no longer named as sole requesters Financial supervision demands are no longer limited to Bank Indonesia, OJK and LPS. | Controller duties |
| Duty to explain a refusal after legal dissolution is deleted A dissolved controller owes no explanation when a subject right cannot be honoured. | Controller duties |
| Investigator duty to delete data after use is replaced by a label Law enforcement recipients lose an express duty to delete case data and are simply labelled controllers instead. | Controller duties |
| Police report and court order no longer attach to a data demand Data demands no longer need a police report or court order attached, only a stated basis of authority. | Controller duties |
The draft deferred 24 mechanisms to a Peraturan Lembaga and the enacted text defers 34. Pasal 223 requires processing to conform to this regulation until the Peraturan Lembaga on processing is issued, and nothing is suspended in the meantime.
| 01 | Cross-border transfer | Make acceptance of access terms a contractual condition of data-room entry. |
| 02 | Sanctions and enforcement | Advise on breach exposure on the basis that the authority cannot sue for subject compensation, and model civil claims separately. |
| 03 | Controller duties | Run the RPP Pasal 135 due diligence and audit programme as internal policy and watch for the Peraturan Lembaga. |
| 04 | Lawful bases and consent | Keep age assurance on any service children can reach; Pasal 38(1) no longer compels it but Pasal 38(2) still applies. |
| 05 | Subject rights | Keep the accuracy and mitigation evidence in the impact assessment file, since that is where a supervisor will look for it. |
| 06 | Breach | State impact in the notice anyway; the enacted minimum does not equal a defensible notice. |
| 07 | Scope and definitions | Track sectoral regulators as well as the Lembaga for additions to the specific personal data category. |
Eleven clusters cover both instruments end to end. Every title opens the statute at its article and every number opens the regulation at its article, so the map is the directory rather than a picture of one.