Salinan v5.8 · 28 Sep 2026
What changed from the 2023 draft to PP 33/2026
The draft of 31 August 2023 ran to 245 articles in 10 chapters. The enacted text has 225 in 12. Below are 112 differences found by comparing the two clause by clause, each quoted from both texts, with 72 of them marked as changing an obligation. Statutory text is Indonesian and untranslated.
The implementing regulation brings legally significant changes from the 2023 draft
PP 33/2026 takes effect on 16 January 2027. Comparing the 2023 draft with the enacted text clause by clause turns up 112 verified differences, 72 of which change what a controller actually has to do. Every one is quoted from both texts.
Six months to comply and the rules still unwritten
Almost every enforcement mechanism in the regulation is routed to a Peraturan Lembaga that has not been issued. Pasal 223 requires processing to conform to this regulation until the Peraturan Lembaga on processing is issued, which is what keeps compliance possible in the meantime.
Every change by theme
Open a theme to see everything inside it before you read any of it.
By the workstream that has to rebuild it
The same differences, sorted by compliance domain rather than by chapter, on the ten domain framework the gap assessment working paper uses. One bucket, the regime, holds what shapes the programme without sitting inside it.
Audit becomes mandatory the checklist goes
PP 33/2026 Pasal 138(2) turns accountability into a floor introduced by paling sedikit harus: technical and organisational measures, documentation of every processing activity, responses to the Lembaga, proof of compliance, and both an internal and an external protection audit, where draft Pasal 154(3) had said only that a controller dapat audit.
Pasal 169(2) adds kepada Lembaga as the addressee for the accountability documents behind a transfer safeguard, and Pasal 69(3) to (8) makes a data quality standard, periodic or ad hoc verification and a record of the results standing controls, after draft Pasal 82(3)(d) let a controller conclude that verification was not needed.
What thinned is the scaffolding around all that: draft Pasal 10 to Pasal 15 hung a duty checklist on each lifecycle stage and enacted Pasal 8 lists the stages with nothing attached, the seven-part public body instrument at draft Pasal 67 shrinks to two headings at Pasal 50 with no publication and no filing, and the data-room access gate at draft Pasal 152 survives only as a duty to prepare terms at Pasal 133(6).
The controller now owes two audits, a maintained verification regime and documents producible to the regulator, while the lifecycle checklist, the public body instrument and the transaction access gate that used to carry the programme have gone.
- Book an internal and an external protection audit for this cycle under Pasal 138(2)(e), name the external provider, and set a retention rule for both reports so they stand as accountability evidence.
Pasal 169(2) states no trigger, form or deadline for producing accountability documents to the Lembaga, and the Peraturan Lembaga on the policy document promised by Pasal 50(3) has not been issued, so whether filing is proactive or on request is still open.
More officers appointed with weaker protection
The dan/atau at PP 33/2026 Pasal 142(1) follows the Constitutional Court. Putusan 151/PUU-XXII/2024, pronounced 30 July 2025 and granted in full, declared the dan in UU 27/2022 Pasal 53(1) huruf b conditionally unconstitutional sepanjang tidak dimaknai dan/atau, so the three appointment triggers are alternative, not cumulative.
Draft RPP Pasal 165(1) is dated 31 August 2023, predates the ruling, and joined the triggers with dan; that cumulative reading would have failed it. Any one trigger now pulls a controller into the duty, where the draft required all three at once.
The officer's own position moved the other way: RPP Pasal 168(1)(c) barred dismissal or punishment for doing the job and enacted Pasal 146(1)(c) asks only that the officer operate objectively and independently and free from interference, while the direct report to the Lembaga PDP at RPP Pasal 169(2)(c) becomes a report to internal leadership at Pasal 147(2)(c).
On dissolution the duty to appoint a surviving contact point at RPP Pasal 147(3) is now discretionary under Pasal 136(2), with no period attached.
Many more controllers now have to appoint an officer, but the officer they appoint has lost the tenure guarantee and the route to the regulator that the draft gave them.
- Re-run the appointment test against each limb of Pasal 142(1) on its own, and record which limb catches which entity, because processing for public services alone is now enough.
- Add a no dismissal and no penalty for performing the role term to the officer's engagement contract and job description, since Pasal 146(1)(c) no longer supplies it.
- Open a dated escalation log for the officer's findings and recommendations, with the internal recipient named, because that record is the only trace once escalation stays inside the organisation.
- Add a named post-dissolution contact and a period to winding up and merger templates, rather than relying on Pasal 136(2).
Pasal 142(2) leaves the detail of the officer's duty to a Peraturan Lembaga that has not been issued, so the qualification standard, whether a group may share one officer, and whether contact details must reach the Lembaga are all still open.
The appointment triggers move from dan to dan/atau
- a.pemrosesan Data Pribadi untuk kepentingan pelayanan publik;
- b.kegiatan inti Pengendali Data Pribadi memiliki sifat, ruang lingkup,
dan/atautujuan yang memerlukan pemantauan secara teratur dan sistematis atas Data Pribadi dengan skala besar;dan - c.kegiatan inti Pengendali Data Pribadi terdiri dari pemrosesan Data Pribadi dalam skala besar untuk Data Pribadi yang bersifat spesifik dan/atau Data Pribadi yang berkaitan dengan tindak pidana.
- a.pemrosesan Data Pribadi untuk kepentingan pelayanan publik;
- b.kegiatan inti Pengendali Data Pribadi memiliki sifat, ruang lingkup, atau tujuan yang memerlukan pemantauan secara teratur dan sistematis atas Data Pribadi dengan skala besar; dan/atau
- c.kegiatan inti Pengendali Data Pribadi terdiri dari pemrosesan Data Pribadi dalam skala besar untuk Data Pribadi yang bersifat spesifik dan/atau Data Pribadi yang berkaitan dengan tindak pidana.
Both texts list the same three triggers: processing for public services, core activities involving regular and systematic large-scale monitoring, and core activities built on large-scale processing of specific or crime-related data. The difference sits in one connector. RPP Pasal 165(1) closes limb b with dan, so a controller had to satisfy all three at once. PP 33/2026 Pasal 142(1) closes it with dan/atau, so any one limb is enough.
The connector is the Court's wording. Putusan 151/PUU-XXII/2024, pronounced 30 July 2025, declared the dan in UU 27/2022 Pasal 53(1) huruf b conditionally unconstitutional sepanjang tidak dimaknai dan/atau. The draft is dated 31 August 2023 and predates the ruling; the enacted text writes what the Court required. Public bodies processing for public services now fall within the duty on that ground alone, as does a controller running large-scale systematic monitoring.
Two smaller moves sit beside it. Inside limb b the draft's sifat, ruang lingkup, dan/atau tujuan becomes sifat, ruang lingkup, atau tujuan. The appointment standard at RPP Pasal 165(2), professionalism, knowledge of the law and of protection practice, and capacity for the tasks, becomes its own article at PP Pasal 143, and both the duty and the standard now wait on a Peraturan Lembaga for their detail.
Notice template gone consent test added
The sixteen item content schedule at draft Pasal 76(2) did not survive: enacted Pasal 62 fixes only seven headings, a notice channel that stays available throughout processing and delivery before processing begins, with the content detail parked in Pasal 66 for a Peraturan Lembaga that has not issued. Consent moved the other way.
Pasal 32(2) now requires it to be free, conscious, specific and unambiguous, and the draft escape at Pasal 104(2), which let a controller keep processing on another basis after a withdrawal, is gone, so Pasal 92 runs verification, cessation and a confirmation back to the subject. Deadlines shifted quietly as well, since Pasal 64 gives thirty Hari for the indirect collection notice and Pasal 1 defines Hari as a working day.
The controller lost the drafting specification it could audit its notice against but gained a validity test for consent and lost the ability to switch basis once consent is withdrawn.
- Freeze the draft Pasal 76(2) sixteen item list as the internal notice template, map every item to a field in the live notice, and note that Pasal 62(3) requires the notice to stay reachable for as long as processing continues.
Pasal 66 sends the content of the privacy notice to a Peraturan Lembaga that has not issued, so until it does nothing in force states what a notice must actually say beyond the seven headings in Pasal 62(1).
Seven headings survive the sixteen items do not
The sixteen item content list at draft Pasal 76(2) was the specification a controller could audit a notice against: identity, officer contact, basis, the use, storage and destruction periods, the withdrawal, access and objection mechanisms, the security measures.
Enacted Pasal 62(1) keeps seven headings, Pasal 62(3) adds a channel that must stay reachable throughout processing, and Pasal 66 parks the content detail in a Peraturan Lembaga that has not issued, so keep drafting to the draft list. Timing moved twice.
Pasal 62(4) starts the duty before processing where draft Pasal 77(1) said before collection, and a controller that treats collection as a prior step has an argument the chapter never closes, so serve the notice at collection anyway.
The indirect collection notice at Pasal 64 now runs 30 Hari, a working day term under Pasal 1, roughly six calendar weeks, and its trigger widens to data obtained as well as collected. The specific notices thinned. The vital interest notice at Pasal 47(1) loses wajib, its parent and guardian addressees and any fixed time, while the public task notice moves to the start of processing with any deferral recorded under Pasal 51(3).
Pasal 65 then re-scopes the exoneration ban to the notice itself, tidak dapat where the draft said dilarang, so a liability disclaimer sitting in terms of service falls outside it on its face.
Consent gains a test and loses its exit
Pasal 32(2) adds the test the draft never had: consent must be obtained freely, consciously, specifically and unambiguously. The draft regulated the mechanism, the prior information and the proof, so a flow could pass every rule while bundling purposes or relying on a pre-ticked box.
Now it fails on validity, and the proof duty at Pasal 36 means the controller must evidence which design feature delivers each of the four qualities. The exit closed. Draft Pasal 104(2) let a controller answer a withdrawal by switching to another basis and carrying on; Pasal 92 keeps the duty to stop, adds verification and a confirmation of cessation, and carries no exception, so the basis is fixed at collection.
The mechanism, withdrawal and non-discrimination duties drop from wajib to harus, but neither instrument's sanction list ever reached them, so rank remediation by the Pasal 184(1) list. Two scope lines moved. The marketing disclosure duty at Pasal 35(2) now applies only where the processing rests on explicit consent, so direct marketing run on legitimate interests escapes it, and Pasal 62 does not require recipients or an offer specific withdrawal route.
And the duty to identify service users is no longer keyed to services children can reach: Pasal 38(1) calibrates it to the purpose of processing, though parental consent at Pasal 38(2) keeps wajib.
The bases beyond consent are redrawn
The contract basis carries new weight. Pasal 43(1) swaps the draft's specific security guarantee for a general compliance guarantee, adds the subject's rights and the controller's duties, and drops the disclosure of other bases used beyond the contract purpose, the one contractual transparency device against basis stacking.
And where the draft voided a non compliant contract, Pasal 43(2) instead disqualifies it as a basis, triggered by any of the nine items rather than the consent limb alone. Public task narrowed and legitimate interest opened. Pasal 49(2) keeps only the statutory mandate limb, so processing the draft grounded on a directly threatened public interest must now find a statute that commands the action or fall back on vital interests.
Pasal 55 then hands public bodies the basis the draft flatly denied them, confined to purposes outside the public task, which is exactly the space GDPR Article 6(1)(f) leaves open. Underneath the bases the fairness standard slipped.
Honest and good faith processing was a free-standing wajib at draft Pasal 79(2); Pasal 60(2) restates it as a harus riding on transparency, so the general hook against conduct that is disclosed but substantively misleading is gone, and a fairness argument now has to run through the three transparency requirements Pasal 60(1) sets out.
Vendor oversight now rests on contracts
The supervision chapter lost its working parts. RPP Pasal 135 took the pre engagement vetting of a processor and the internal, external and exit audit programme with it, and RPP Pasal 137 took the eleven minimum contract terms and the Bahasa Indonesia requirement, leaving PP 33/2026 Pasal 127 with three bare headings and Pasal 128 pointing at a Peraturan Lembaga that has not been issued.
The appointment side still stands and is where the work now sits: PP Pasal 14 carries the eleven item clause list intact including the audit and inspection mechanism, Pasal 15(2) keeps written controller approval before a processor engages another, and the new Pasal 141(2) gives the processor its own four duties of documenting, answering the Lembaga, showing compliance and auditing.
Around that the floor drops, because sub processor assurance falls to harus at Pasal 15(3) and outside the Pasal 184(1) sanction list, an instruction under Pasal 139(2) need only be documented rather than written, Pasal 126(2) recasts affiliates as Pengendali Data Pribadi lain instead of supervised parties, and Pasal 10 no longer deems a party that requests personal data a controller.
The enacted text deletes the only mandated diligence and audit programme over processors and softens the assurance and instruction duties, so almost everything the controller does here it now does because its own contract and policy say so.
- Rebuild the data processing agreement template on PP Pasal 14 and write back the four RPP Pasal 137 clauses no enacted article now requires: return or deletion of data at termination, protection standard parity with the controller, notice of any change to the processor's security policy, and an incident procedure. Name the documented instruction channel in the same agreement so Pasal 139(2) is satisfied by something you control, and keep executing bilingually because UU 24/2009 Pasal 31 still bites even though the language clause went.
- Keep the RPP Pasal 135 diligence and audit calendar as internal vendor policy: legality, compliance history, breach record, technical readiness and references checked before onboarding, then periodic and exit audits. Map the processor's reporting obligations to the four items at Pasal 141(2), since those are what the Lembaga will ask a processor to produce.
- Re paper intra group data flows, which are no longer supervised by default: characterise each as joint control under Pasal 1 angka 20 or as controller to controller, and allocate controller status expressly in every data sharing agreement. Add a counterparty check on any claimed defence or security exemption, asking which body issued the surat keterangan under Pasal 150(d) and which requirements it disapplies, because one body can now sign it and the letter need not say.
The Peraturan Lembaga promised at Pasal 128, which is meant to carry the supervision detail, the minimum agreement content and the audit cadence, and which does not yet exist even though the underlying duty at Pasal 126(1) keeps wajib and sits in the Pasal 184(1) sanction list.
Register template fixed production duty widened
PP 33/2026 Pasal 74(2) fixes thirteen minimum fields for the controller register and Pasal 74(5) a four-field list for the processor, updated under Pasal 74(7) whenever the information changes. RPP Pasal 87(8) put a wajib on the controller alone to hand records to the authority; Pasal 74(9) recasts the duty as harus, extends it to the processor, and the new Pasal 74(10) makes records a standing requirement for audit and supervision.
The minimisation entry changed shape too. RPP Pasal 74(2) asked for processing seminimal mungkin, an open standard with nothing to document against. Enacted Pasal 59(2) replaces it with three named factors: the relationship between the data and the purpose, whether the data is sufficient for the purpose, and whether it exceeds what is needed. The register can now carry an answer per field instead of an assertion.
The register itself is heavier to build and must now be produced by the processor and kept audit-ready, while the entries recorded against several lawful bases became easier to justify.
- Rebuild the inventory template against the thirteen fields in Pasal 74(2), add a separate processor sheet carrying the four fields in Pasal 74(5), and set a change trigger so the record updates under Pasal 74(7) rather than at an annual review.
Whether harus in Pasal 74(9) and (10) carries the same sanction exposure as wajib under UU PDP Pasal 57, which no Peraturan Lembaga has yet settled.
The register as drafted and as enacted
- a.nama dan detail kontak Pengendali Data Pribadi, Pengendali Data Pribadi Bersama, dan/atau Prosesor Data Pribadi;
- b.kontak
Pejabat Pelindung Data Pribadi; - c.sumber pengumpulan dan tujuan pengiriman Data Pribadi;
- d.dasar pemrosesan Data Pribadi;
- e.tujuan pemrosesan Data Pribadi;
- f.jenis Data Pribadi;
- g.kategori Subjek Data Pribadi;
- h.pihak selain Pengendali Data Pribadi yang dapat mengakses Data Pribadi;
- i.pemenuhan hak Subjek Data Pribadi;
- j.pemetaan aliran Data Pribadi;
- k.masa retensi;
dan - l.langkah teknis dan organisasi dalam rangka pengamanan Data Pribadi.
- a.nama dan kontak Prosesor Data Pribadi;
- b.lingkup kegiatan pemrosesan Data Pribadi;
- c.rincian transfer Data Pribadi; dan
- d.deskripsi umum langkah organisasi dan teknis pengamanan Data Pribadi.
- a.nama dan detail kontak Pengendali Data Pribadi, Pengendali Data Pribadi Bersama, dan/atau Prosesor Data Pribadi;
- b.kontak PPDP;
- c.sumber pengumpulan dan tujuan pengiriman Data Pribadi;
- d.dasar pemrosesan Data Pribadi;
- e.tujuan pemrosesan Data Pribadi;
- f.jenis Data Pribadi;
- g.kategori Subjek Data Pribadi;
- h.pihak selain Pengendali Data Pribadi yang dapat mengakses Data Pribadi;
- i.pemenuhan hak Subjek Data Pribadi;
- j.pemetaan aliran Data Pribadi;
- k.Masa Retensi;
- l.langkah teknis dan organisasi dalam rangka pengamanan Data Pribadi; dan
- m.rincian transfer Data Pribadi.
- a.nama dan kontak Prosesor Data Pribadi;
- b.lingkup kegiatan pemrosesan Data Pribadi;
- c.rincian transfer Data Pribadi; dan
- d.deskripsi umum langkah organisasi dan teknis pengamanan Data Pribadi.
Both texts open the same way: a wajib on the controller to record every processing activity, a minimum field list, a shorter list for its processor, and an update whenever the information changes. The list itself grew from twelve fields to thirteen, because Pasal 74(2)(m) adds transfer details to the controller register, and the new Pasal 74(4) states that the processor's own record does not discharge the controller's duty.
Storage loosened. Draft Pasal 87(5) and 87(7) put a wajib on the controller to keep the record in written form; Pasal 74(6) and 74(8) say the record is stored and managed by the controller and/or the processor, with no deontic marker at all. The sharper movement sits at the end. RPP Pasal 87(8) placed a wajib on the controller alone to hand the record over when the authority asked.
Pasal 74(9) recasts that as harus and extends it to the processor, and Pasal 74(10) adds a standing duty to keep the record available for audit and supervision. Whether harus carries the sanction exposure of wajib under UU PDP Pasal 57 is unresolved; the wider reach is the reliable half of the change.
Dasar pemrosesan between draft and enactment
Three bases got easier to invoke. Draft Pasal 65 barred the public interest basis wherever the processing carried a commercial benefit for the controller; no enacted provision replaces it, so the only remaining filter is whether legislation mandates the action.
Pasal 45(2) opens the legal obligation list with termasuk where the draft closed it, and Pasal 46 cuts the vital interests conditions from three to two and widens the protected class from third parties to any other party. One moved the other way.
Pasal 42(1)(a) requires a pre contract request to be written or recorded, so an oral enquiry no longer triggers the basis unless the controller captures it; the draft's agreement to sign gives way to the easier intention to be bound. Each shift changes what the controller documents: record the instrument grounding a legal obligation, log inbound enquiries at the point of contact, and disclose any commercial upside in the Pasal 50 policy document.
Assessment stays wajib mitigation does not
PP 33/2026 Pasal 120(1) keeps the wajib on running an impact assessment for the seven high risk categories, but Pasal 121(3) and (4) state the implementation of the identified protective measures and the documentation of the assessment in the plain indicative, where RPP Pasal 128(5) and (6) said wajib, and Pasal 121(2)(a) drops secara sistematis from the description of processing.
Prior consultation under Pasal 122(1) is still only dapat, though the draft's cumulative dan at RPP Pasal 129 became dan/atau, so either ground now opens the door and the Lembaga still owes no answer. The legitimate interest balancing analysis required by Pasal 53 is now only documented under Pasal 54 and explained on request under Pasal 56, where RPP Pasal 71 made the controller send it to the subject unprompted.
The controller must still produce the assessment but is no longer compelled by a wajib to act on it, to document it, or to be methodical in describing the processing, and the balancing analysis no longer has to reach the person it concerns.
- Add a closure register to the DPIA template: every measure recorded under Pasal 121(2)(d) gets a named owner, a go live date and an internal sign off, and make that sign off a policy gate for the processing to start, since the enacted text no longer supplies one.
Pasal 122(2) sends the rest of the impact assessment regime to a Peraturan Lembaga, so the required format, any published list of processing that always needs an assessment, and whether the Lembaga responds to a consultation at all are unwritten.
The transfer risk assessment lives in Data Transfer and Sharing, where enacted Pasal 163 now binds the controller alone with harus, in place of the draft's wajib on controller dan/atau processor.
Running the assessment stays wajib and acting on it does not
PP 33/2026 Pasal 120(1) keeps the wajib on running the impact assessment. Pasal 121(3) and (4) then state the implementation of the identified protective measures and the documentation of the assessment in the plain indicative, where RPP Pasal 128(5) and (6) said wajib, and Pasal 121(2)(a) drops secara sistematis from the description of processing. A controller can satisfy the surviving wajib by producing an assessment it never implements.
Consultation with the Lembaga widened by one conjunction. RPP Pasal 129 joined its two grounds with dan; PP Pasal 122(1) joins them with dan/atau, so either ground alone now opens the door. The verb stays dapat, the Lembaga owes no stated answer, and Pasal 122(2) sends the rest of the impact assessment regime to a Peraturan Lembaga. Track mitigations to closure internally and do not plan around consultation.
A balancing test the subject must ask to see
RPP Pasal 71 made the controller document the legitimate interest balancing analysis and hand it to the subject as a matter of course. PP Pasal 54 keeps only the duty to document the Pasal 53 analysis, and Pasal 56 makes disclosure contingent on the subject asking for an explanation.
The burden shifts from a controller who must tell to a subject who must know to ask, which in practice means the assessment is read by regulators and litigants rather than by the people it concerns. Write it for an outside reader; it stays private until the moment it does not.
Refusal tests go the clocks soften
The rights themselves survive but the tests around refusing them are gone. Draft Pasal 83(5) obliged a controller to refuse a correction request on three closed grounds, and enacted Pasal 71(5) gives a bare discretion with only a duty to state reasons at Pasal 71(7). Those three grounds survive at Pasal 77(4) for access to change data alone.
Draft Pasal 107(1) made the controller prove there was no significant impact before refusing an objection and Pasal 95(1) now asserts it as fact, while draft Pasal 70, which stopped legitimate interest processing on objection, has no counterpart, so Pasal 93 leaves objection to solely automated decisions.
Intake runs the other way, with Pasal 20 making a recorded request the route rather than one option, Pasal 22 fixing the moment of receipt, and Pasal 21(3) requiring the answer to come back through the channel the subject used.
Almost every hard edge on rights handling came off, the closed refusal grounds, the controller's burden of proof on objections, the objection stop for legitimate interests and the 3 x 24 hour answer to a compensation claim at draft Pasal 118(5)(d), while the new duties are procedural.
- Rewrite the refusal step of the rights procedure: adopt the Pasal 77(4) grounds as the internal test for correction and rectification refusals, require written reasons on every one under Pasal 71(7), and file the accuracy and mitigation evidence behind an objection refusal in the Pasal 120 impact assessment, which is where a supervisor will look for it.
Portability is the open item: Pasal 113 defers the mechanism to a Peraturan Lembaga and the draft's five eligibility criteria at Pasal 122 are gone, so nothing yet says whether observed and inferred data must be exported or only what the subject supplied.
Two clocks slow and one disappears
The scale is calendar time. Pasal 1 angka 19 defines Hari as a working day, so the same numeral now runs about six weeks on the calendar instead of one month.
None of these three deadlines keeps the meaning it had in the draft. The copy request confirmation reads the same, 3 x 24 jam in both texts, but the draft ran the clock from permohonan diterima and enacted Pasal 78(2) runs it from permohonan diterima dan terverifikasi.
Verification now sits in front of the window, and no article caps how long it may take, so the three days begin whenever the controller is satisfied of identity. The compensation answer went further. Draft Pasal 118(5)(d) required the compensation policy to state that a claim would be answered or refused within 3 x 24 hours.
Enacted Pasal 107 asks only for a mechanism and a policy and sets no deadline, so there is no point at which delay itself becomes a breach, and a subject facing silence is left with the court route under Pasal 108(3). The quietest change is the widest.
The indirect collection notice keeps its numeral, 30 in both texts, but the draft wrote hari and the enacted text writes Hari, which Pasal 1 angka 19 defines as a working day. The same figure now runs about 42 calendar days once weekends and public holidays are counted, and the definition attaches to the capital letter, so it stretches every deadline in the regulation written that way.
Fewer hard rules more internal policy
Privacy by default kept its content and lost its own article. Draft Pasal 130(3) stated it as a standalone wajib. Enacted Pasal 124(2)(b) folds the same requirement into the technical measures a controller prepares under Pasal 123(1)(a). The position matters because Pasal 123(1), not Pasal 124, is on the sanction list at Pasal 184(1). The security choices also widened. Draft Pasal 131(2)(a) required pseudonymisation and encryption together.
Pasal 123(2)(a) now treats them as alternatives and admits any other technical measure that can prevent or mitigate the risk of a protection failure. Pasal 123(5) drops the wajib from the conformity assessment, so the adequacy of the chosen control rests on the controller's own written reasoning. Retention was reorganised rather than cut.
The definition of Masa Retensi moved to Pasal 1 angka 23, so it now reaches the whole regulation. The policy document sits at Pasal 75, stated in the indicative where the draft used harus, with one new item: huruf j asks for the legal basis of any period that rests on a statutory obligation. Erasure of unlawfully obtained data got easier to trigger.
Draft Pasal 95(2) made the duty wait for a court ruling. Pasal 82(2) now supplies three routes: unlawfulness under the legislation itself, an erasure sanction from the Lembaga, or a final judgment. A controller that concludes its own acquisition was unlawful must erase. Two deletion duties went the other way. Draft Pasal 179 told investigators, prosecutors and judges to erase case data within the statutory period.
Pasal 158(1) instead labels them controllers, so retention runs through the general controller chapter. Draft Pasal 146(3) made destruction of transferred data a wajib. Pasal 133(3)(g) keeps only a statement in the transfer notice that destruction will happen, so enforcement attaches to the notice, not to the holding.
The security design window and the erasure triggers both widen, while the camera siting bans, the mandatory conformity assessment and the standalone destruction duty on transferred data all fall away.
- Fold the default minimisation evidence into the Pasal 123 technical and organisational security file, and put the risk evaluation on a dated cycle that starts at the planning stage, which is where Pasal 124(1) now begins and Pasal 124(2)(c) requires it to run consistently.
- Write the camera policy the regulation stopped supplying: keep an internal prohibition on placement in areas of private expectation, and audit the public facing estate so every deployment maps to a Pasal 17(1)(a) purpose with identification features disabled.
- Add a legal basis column to the retention schedule for each period that rests on a statutory obligation, per the new Pasal 75 huruf j, diary the destruction of transferred data against the representation made in the Pasal 133(3)(g) notice, and put retention questions to law enforcement holders under Pasal 158(1), which now designates them as controllers.
Nothing yet fixes the standard a technical measure must meet under Pasal 123(2)(a) once the conformity assessment at Pasal 123(5) is optional, and the Lembaga has issued no rule on that or on how it will impose the erasure sanction at Pasal 82(2)(b).
Camera siting bans go and public places gain a purpose list
Dalam hal pemasangan alat pemroses atau pengolah data visual, Pengendali Data Priba di dan Prosesor Data Pribadi wajib melaksanakan pemrosesan Data Pribadi berdasarkan Peraturan Pemerintah ini.
- a.untuk tujuan keamanan, pencegahan bencana, dan/atau penyelenggaraan lalu lintas atau pengumpulan, analisis, dan pengaturan Informasi lalu lintas;
- b.harus menampilkan Informasi pada area yang telah dipasang alat pemroses atau pengolah data visual; dan
- c.tidak digunakan untuk mengidentifikasi seseorang.
The draft set two hard limits on siting. Pasal 34(4) banned placement in areas where a person has an expectation of privacy, and Pasal 34(3) required the operator to prevent or minimise recording beyond the monitoring purpose. Both are gone, and the word ekspektasi appears nowhere in the enacted text. What survives at Pasal 18(2) limits where the device points, not where it sits.
Public places got two controls the draft never had. Pasal 17(1) closes the permitted purposes to security, disaster prevention and traffic management, and forbids using the device to identify a person. The signage duty is older, carried over from draft Pasal 35 into Pasal 19. Pasal 17(2) exempts crime prevention and law enforcement from signage and the identification ban but leaves the purpose limit standing.
Facial recognition run commercially in a public place therefore has no permitted purpose. Keep an internal ban on cameras in private areas, and map every public deployment to a Pasal 17(1)(a) purpose with identification features off.
More incidents notifiable with thinner notices
PP 33/2026 Pasal 114 keeps the 3 x 24 jam clock to both the subject and the Lembaga and carries no exception, so the draft off-ramp at RPP Pasal 124(5) for failures that disclosed nothing is gone and encryption-only ransomware, accidental destruction and a botched migration are all now notifiable.
The notice itself got shorter: Pasal 114(3)(c) keeps handling and recovery but deletes dampak, which the draft required, and impact now survives only in the internal documentation at Pasal 116(1)(c) that goes to the authority rather than to the person.
Pasal 115(1) limits public notice to disruption of public service and serious harm to the public interest and drops the RPP Pasal 124(4)(c) trigger for subjects the controller cannot reach, while Pasal 116 and Pasal 117 both lost wajib and Pasal 116 is absent from the sanction list at Pasal 184(1).
The set of incidents that must be reported got wider under Pasal 114, while the mandatory content of the notice, the public notice trigger and the documentation duty all got thinner.
- Rewrite the breach triage rule so that any Kegagalan Pelindungan Data Pribadi as defined in Pasal 1 starts the 3 x 24 jam clock, not only incidents involving disclosure, and re-test last year's incident log against the new threshold to see how many would now have been reportable.
The Lembaga has issued no rule on the notification channel or form, and nothing fixes when the 3 x 24 jam clock starts: Pasal 114(1) counts from the failure rather than from the controller becoming aware of it, so a team that spends two days confirming an incident cannot tell from the text whether it is early or already late.
The breach regime compared
| Aspect | Draft · 31 August 2023 | Enacted · PP 33/2026 |
|---|---|---|
| Notification trigger and its exception | Any protection failure, but exempt where the failure disclosed no personal data (Pasal 124(5)) | Any Kegagalan Pelindungan Data Pribadi; Pasal 114 carries no exception clause |
| The clock | Written notice within 3 x 24 jam of the failure being known with certainty (Pasal 124(1) and (2)) | Unchanged: 3 x 24 jam from the same starting point (Pasal 114(1) and (2)) |
| Who is notified | The subject and the Lembaga PDP, both in writing (Pasal 124(1)) | Unchanged: the subject and the Lembaga, both in writing (Pasal 114(1)) |
| Notice content | Data exposed, when and how, impact plus handling and recovery, contact point (Pasal 124(3)) | Impact deleted; data exposed, when and how, handling and recovery, PPDP or contact point (Pasal 114(3) and (4)) |
| Public notice trigger | Public service disruption, serious public interest impact, or subjects the controller cannot reach (Pasal 124(4)) | First two triggers kept; the unreachable subjects trigger is deleted (Pasal 115(1)) |
| Breach prevention policy | Wajib to adopt and implement a prevention and handling policy (Pasal 126) | Wajib dropped; policy scoped to the controller's own organisation; four minimum contents kept (Pasal 117) |
| Incident documentation | Wajib twice, to compose the documentation and send it to the authority; eight content items (Pasal 125) | Wajib dropped in both places, five items, and absent from the sanction list (Pasal 116) |
The clock and the recipients did not move: written notice within 3 x 24 jam to the subject and the Lembaga, in draft and enacted alike. Everything around them did. The draft's exemption for failures that disclosed nothing is gone, so more incidents notify. The notice lost its impact statement, the public notice lost its unreachable subjects trigger, and the prevention policy and documentation duties both lost wajib.
Transfer gates move onto the controller
The Pasal 165 cascade survives, but the checks that used to sit elsewhere now sit with you: Pasal 163 puts the transfer risk assessment on the controller alone and drops the draft delegation at RPP Pasal 194(2), and Pasal 165(1) measures equivalence against UU 27/2022 rather than the whole body of PDP legislation.
On domestic sharing the draft's gates are gone, with no counterpart to the attachment rule at RPP Pasal 177(4), the requester-identity limb at RPP Pasal 173(d) and Pasal 175(d), or the camera-footage gateway at RPP Article 36, so Pasal 155, Pasal 151 to Pasal 153 and Pasal 30(3) leave the testing to you.
Two transfer routes closed as well: the inter-state agreement at RPP Pasal 186 is now a public-body instrument at Pasal 169(1)(a), and the foreign court order clause at RPP Pasal 191 has no replacement, while the new Pasal 166 sends outbound law enforcement exchange through the cascade.
Several transfer duties dropped from wajib to harus and the clause-tailoring test at Pasal 170(3) loosened, but the controller now carries the risk assessment alone, evidences equivalence without a list, and verifies every disclosure demand on its own judgment.
- Rewrite the processing agreement so the processor must supply the inputs for the Pasal 163 assessment, and write the Pasal 165 cascade into the onward-transfer clause by contract, because Pasal 160(4) states the duty and specifies nothing the onward recipient must satisfy.
The Lembaga has issued neither the adequacy list it must now establish under Pasal 168(2) nor the assessment method deferred by Pasal 168(4), so every equivalence call stays yours to evidence, with the consent-route detail also deferred to a Peraturan Lembaga under Pasal 174.
Later start longer clocks wider discretion
PP 33/2026 was promulgated on 16 July 2026 and binds on 16 January 2027 under Pasal 225, where draft Pasal 245 would have applied on promulgation, and the new Pasal 223 makes the enacted text itself the interim standard for processing until the Peraturan Lembaga on processing is issued, with Pasal 224 saving existing personal data rules that do not conflict with it.
Pasal 1(19) defines Hari as a working day and the defined term is used throughout, so a sanctioned party now has 30 working days at Pasal 195(5) where draft Pasal 220 gave seven calendar days, objections run 14 working days at Pasal 197 and mediation 30 at Pasal 218.
The 2 per cent ceiling holds at Pasal 185(1), but Pasal 185(2)(i) prices your compliance record into the calculation and Pasal 185(3) allows a fine of zero, while draft Pasal 119(2), Pasal 120, Pasal 211 and Pasal 222 are gone, so a refused compensation claim goes to court under Pasal 108(3), the authority cannot sue for subject compensation, and ignoring a decision draws a fresh proceeding under Pasal 188 rather than an accruing penalty.
The controller gets a six month runway, working day clocks and no arrears penalty, but also a supervision order that carries a fixed period, an action plan and progress reports under Pasal 181, a fine calculation that now reads its compliance file, and a specific data category any sectoral ministry can extend under Pasal 6(2) with the draft criteria deleted.
- Rebuild the programme calendar on working days against the Indonesian public holiday list, covering the Pasal 197 objection window at 14, the Pasal 195(5) sanction compliance window at 30 and the Pasal 211(2) first mediation meeting at 10, and reset any internal service level that was set against calendar days.
- Assemble the compliance evidence pack that Pasal 185(2)(i) now values, meaning dated board approvals, training and awareness records, DPIA sign offs and remediation logs held in a form you can hand over on the day an order is served, together with a standing argument on the Pasal 181(5) complexity ground.
- Back plan from 16 January 2027 by mapping current processing against the enacted articles under Pasal 223 instead of waiting for the delegated rules, and add sectoral regulators to the watch list alongside the Lembaga because Pasal 6(2) lets them extend the specific personal data category.
The Peraturan Lembaga are all still outstanding, and four of them decide how this domain actually bites: the residual fine variable at Pasal 185(2)(j), the pertimbangan tertentu behind a zero fine at Pasal 185(3), mediator competence at Pasal 222 and mediation fees at Pasal 210. Nothing yet defines the conflict test that Pasal 223 and Pasal 224 both turn on.
What is inside this theme
15 changes, 10 of which shift an obligation. Pick one, or step through them in order.
Three layers in order and you cannot skip one
Read it top to bottom. You only reach consent if the first two fail, and the column on the right applies whichever layer you land on.
Ban on third-party access without accepting terms is deleted
- a.informasi bahwa akan ada pengiriman Data Pribadi dari Pengendali Data Pribadi lama kepada Pengendali Data Pribadi baru;
- b.aktivitas pemrosesan yang akan dan telah dilakukan dalam rangka
transaksi ini; - c.nama
perusahaan pihakyang bertanggung jawab, alamat, nomor telepon dan informasi kontak lain yang dimiliki oleh Pengendali Data Pribadi baru; - d.metode dan prosedur penyampaian keberatan dan/atau permohonan penghentian pemrosesan, atau penolakan Subjek Data Pribadi terhadap pengiriman Data Pribadi ke Pengendali Data Pribadi baru;
- e.informasi waktu kapan pemrosesan untuk keperluan kegiatan Pengendali Data Pribadi baru akan mulai berlangsung;
- f.informasi bahwa
Data Pribadi SubjekData Pribadi dapat diakses oleh Pengendali Data Pribadi baru dan/atau pihak lainterkaityang terlibat dalamproses ini;dan - g.pernyataan bahwa Pengendali Data Pribadi lama akan memusnahkan Data Pribadi yang telah dialihkan kepada Pengendali Data Pribadi baru, pada saat
transaksiberakhir.
- a.informasi bahwa telah terjadi pengiriman Data Pribadi dari Pengendali Data Pribadi lama ke Pengendali Data Pribadi baru;
- b.aktivitas pemrosesan yang akan dan telah dilakukan dalam rangka
transaksi ini; - c.nama
perusahaan pihakyang bertanggung jawab, alamat, nomor telepon dan informasi kontak lain yang dimiliki oleh Pengendali Data Pribadi baru; - d.informasi bahwa telah terjadi pemrosesan Data Pribadi sesuai dengan tujuan awal yang dilakukan oleh Pengendali Data Pribadi lama;
- e.informasi waktu pemrosesan untuk keperluan kegiatan Pengendali Data Pribadi baru akan mulai berlangsung;
- f.metode dan
prosedurpenyampaian keberatan dan/atau permohonan penghentian pemrosesan, atau penolakan Subjek Data Pribadi terhadap pengiriman Data Pribadi ke Pengendali Data Pribadi baru; dan - g.informasi bahwa
Data Pribadi SubjekData Pribadi dapat diakses oleh Pengendali Data Pribadi baru dan/atau pihak lainterkaityang terlibat dalamproses ini.
- a.
pihak yang ditunjuk oleh Pengendali Data Pribadi lama, Pengendali Data Pribadi baru, Prosesor Data Pribadi baru, atau Prosesor Data Pribadi lama dalam memfasilitasi pelaksanaan transaksi; atau - b.
pihak yang mendapatkan akses kepada Data Pribadi yang diproses oleh Pengendali Data Pribadi lama, Pengendali Data Pribadi baru, Prosesor Data Pribadi baru, atau Prosesor Data Pribadi lama namun tidak melakukan pemrosesan Data Pribadi.
- a.
ketentuan durasi akses pihak lain dalam transaksi; dan - b.
kewajiban penghapusan atau pengembalian Data Pribadi maupun akses terhadap Data Pribadi ketika transaksi sudah selesai dan/atau tidak berlanjut.
- a.hak Subjek Data Pribadi yang masih wajib dipenuhi oleh Pengendali Data Pribadi selama dan/atau setelah proses penggabungan, pemisahan, pengambilalihan, peleburan, atau pembubaran badan hukum dilakukan; dan
- b.kewajiban Pengendali Data Pribadi dalam bidang Pelindungan Data Pribadi yang masih wajib dipenuhi oleh Pengendali Data Pribadi selama dan/atau setelah proses penggabungan, pemisahan, pengambilalihan, peleburan, atau pembubaran badan hukum.
- a.Informasi bahwa akan ada pengiriman Data Pribadi dari Pengendali Data Pribadi lama kepada Pengendali Data Pribadi baru;
- b.aktivitas pemrosesan Data Pribadi yang akan dan telah dilakukan dalam rangka penggabungan, pemisahan, pengambilalihan, peleburan, atau pembubaran badan hukum;
- c.nama badan hukum yang bertanggung jawab, alamat, nomor telepon dan Informasi kontak lain yang dimiliki oleh Pengendali Data Pribadi baru;
- d.metode dan prosedur penyampaian keberatan dan/atau permohonan penghentian pemrosesan Data Pribadi, atau penolakan Subjek Data Pribadi terhadap pengiriman Data Pribadi ke Pengendali Data Pribadi baru;
- e.Informasi waktu kapan pemrosesan Data Pribadi untuk keperluan kegiatan Pengendali Data Pribadi baru akan mulai berlangsung;
- f.Informasi bahwa Data Pribadi dapat diakses oleh Pengendali Data Pribadi baru dan/atau pihak lain yang terlibat dalam penggabungan, pemisahan, pengambilalihan, peleburan, atau pembubaran badan hukum; dan
- g.pernyataan bahwa Pengendali Data Pribadi lama akan memusnahkan Data Pribadi yang telah dialihkan kepada Pengendali Data Pribadi baru, pada saat penggabungan, pemisahan, pengambilalihan, peleburan, atau pembubaran badan hukum berakhir.
- a.Informasi bahwa telah terjadi pengiriman Data Pribadi dari Pengendali Data Pribadi lama ke Pengendali Data Pribadi baru;
- b.aktivitas pemrosesan Data Pribadi yang akan dan telah dilakukan dalam rangka penggabungan, pemisahan, pengambilalihan, peleburan, atau pembubaran badan hukum;
- c.nama badan hukum yang bertanggung jawab, alamat, nomor telepon dan Informasi kontak lain yang dimiliki oleh Pengendali Data Pribadi baru;
- d.Informasi bahwa telah terjadi pemrosesan Data Pribadi sesuai dengan tujuan awal yang dilakukan oleh Pengendali Data Pribadi lama;
- e.Informasi waktu pemrosesan Data Pribadi untuk keperluan kegiatan Pengendali Data Pribadi baru akan mulai berlangsung;
- f.metode, prosedur, dan jangka waktu penyampaian keberatan dan/atau permohonan penghentian pemrosesan Data Pribadi, atau penolakan Subjek Data Pribadi terhadap pengiriman Data Pribadi ke Pengendali Data Pribadi baru; dan
- g.Informasi bahwa Data Pribadi dapat diakses oleh Pengendali Data Pribadi baru dan/atau pihak lain yang terlibat dalam penggabungan, pemisahan, pengambilalihan, peleburan, atau pembubaran badan hukum.
RPP Pasal 152 defined the pihak lain in a transaction, required it to accept the controller's access terms before receiving any access, fixed a minimum content for those terms, and prohibited access where they were not accepted. PP 33/2026 keeps only the preparation of the terms, at Pasal 133(6).
The draft gated adviser and data-room access; the enacted text merely asks for terms to exist. RPP Pasal 152(3) to (5) made acceptance a condition precedent and fixed access duration and return or deletion as minimum content, whereas PP 33/2026 Pasal 133(6) requires only that the old controller prepare access terms for the parties involved.
Nothing in the enacted text prohibits access by a party that has not accepted them, and the deemed-processor rule at RPP Pasal 152(2) disappears with it. Diligence platforms and advisers now sit under the general appointment rules in Pasal 13 to Pasal 15 or under nothing at all.
Make acceptance of access terms a contractual condition of data-room entry.
Where Europe stands diverges GDPR Articles 6, 14
The provision. The GDPR has no article on mergers, demergers, acquisitions, consolidations or dissolution.
Against Indonesia. The GDPR reaches the notification limb through two general duties rather than a dedicated one.
Compared at UU Pasal 48, where the full comparison sits.
Duty to destroy transferred data survives only as a notice line
- a.informasi bahwa akan ada pengiriman Data Pribadi dari Pengendali Data Pribadi lama kepada Pengendali Data Pribadi baru;
- b.aktivitas pemrosesan yang akan dan telah dilakukan dalam rangka
transaksi ini; - c.nama
perusahaan pihakyang bertanggung jawab, alamat, nomor telepon dan informasi kontak lain yang dimiliki oleh Pengendali Data Pribadi baru; - d.metode dan prosedur penyampaian keberatan dan/atau permohonan penghentian pemrosesan, atau penolakan Subjek Data Pribadi terhadap pengiriman Data Pribadi ke Pengendali Data Pribadi baru;
- e.informasi waktu kapan pemrosesan untuk keperluan kegiatan Pengendali Data Pribadi baru akan mulai berlangsung;
- f.informasi bahwa
Data Pribadi SubjekData Pribadi dapat diakses oleh Pengendali Data Pribadi baru dan/atau pihak lainterkaityang terlibat dalamproses ini;dan - g.pernyataan bahwa Pengendali Data Pribadi lama akan memusnahkan Data Pribadi yang telah dialihkan kepada Pengendali Data Pribadi baru, pada saat
transaksiberakhir.
- a.informasi bahwa telah terjadi pengiriman Data Pribadi dari Pengendali Data Pribadi lama ke Pengendali Data Pribadi baru;
- b.aktivitas pemrosesan yang akan dan telah dilakukan dalam rangka
transaksi ini; - c.nama
perusahaan pihakyang bertanggung jawab, alamat, nomor telepon dan informasi kontak lain yang dimiliki oleh Pengendali Data Pribadi baru; - d.informasi bahwa telah terjadi pemrosesan Data Pribadi sesuai dengan tujuan awal yang dilakukan oleh Pengendali Data Pribadi lama;
- e.informasi waktu pemrosesan untuk keperluan kegiatan Pengendali Data Pribadi baru akan mulai berlangsung;
- f.metode dan
prosedurpenyampaian keberatan dan/atau permohonan penghentian pemrosesan, atau penolakan Subjek Data Pribadi terhadap pengiriman Data Pribadi ke Pengendali Data Pribadi baru; dan - g.informasi bahwa
Data Pribadi SubjekData Pribadi dapat diakses oleh Pengendali Data Pribadi baru dan/atau pihak lainterkaityang terlibat dalamproses ini.
- a.Informasi bahwa akan ada pengiriman Data Pribadi dari Pengendali Data Pribadi lama kepada Pengendali Data Pribadi baru;
- b.aktivitas pemrosesan Data Pribadi yang akan dan telah dilakukan dalam rangka penggabungan, pemisahan, pengambilalihan, peleburan, atau pembubaran badan hukum;
- c.nama badan hukum yang bertanggung jawab, alamat, nomor telepon dan Informasi kontak lain yang dimiliki oleh Pengendali Data Pribadi baru;
- d.metode dan prosedur penyampaian keberatan dan/atau permohonan penghentian pemrosesan Data Pribadi, atau penolakan Subjek Data Pribadi terhadap pengiriman Data Pribadi ke Pengendali Data Pribadi baru;
- e.Informasi waktu kapan pemrosesan Data Pribadi untuk keperluan kegiatan Pengendali Data Pribadi baru akan mulai berlangsung;
- f.Informasi bahwa Data Pribadi dapat diakses oleh Pengendali Data Pribadi baru dan/atau pihak lain yang terlibat dalam penggabungan, pemisahan, pengambilalihan, peleburan, atau pembubaran badan hukum; dan
- g.pernyataan bahwa Pengendali Data Pribadi lama akan memusnahkan Data Pribadi yang telah dialihkan kepada Pengendali Data Pribadi baru, pada saat penggabungan, pemisahan, pengambilalihan, peleburan, atau pembubaran badan hukum berakhir.
- a.Informasi bahwa telah terjadi pengiriman Data Pribadi dari Pengendali Data Pribadi lama ke Pengendali Data Pribadi baru;
- b.aktivitas pemrosesan Data Pribadi yang akan dan telah dilakukan dalam rangka penggabungan, pemisahan, pengambilalihan, peleburan, atau pembubaran badan hukum;
- c.nama badan hukum yang bertanggung jawab, alamat, nomor telepon dan Informasi kontak lain yang dimiliki oleh Pengendali Data Pribadi baru;
- d.Informasi bahwa telah terjadi pemrosesan Data Pribadi sesuai dengan tujuan awal yang dilakukan oleh Pengendali Data Pribadi lama;
- e.Informasi waktu pemrosesan Data Pribadi untuk keperluan kegiatan Pengendali Data Pribadi baru akan mulai berlangsung;
- f.metode, prosedur, dan jangka waktu penyampaian keberatan dan/atau permohonan penghentian pemrosesan Data Pribadi, atau penolakan Subjek Data Pribadi terhadap pengiriman Data Pribadi ke Pengendali Data Pribadi baru; dan
- g.Informasi bahwa Data Pribadi dapat diakses oleh Pengendali Data Pribadi baru dan/atau pihak lain yang terlibat dalam penggabungan, pemisahan, pengambilalihan, peleburan, atau pembubaran badan hukum.
RPP Pasal 146(3) imposed a free standing obligation on the old controller to destroy personal data it had transferred to the new controller. PP 33/2026 keeps that content only inside Pasal 133(3)(g), as a statement the old controller must include in its transfer notification to subjects.
The draft made destruction an obligation; the enacted text makes it a disclosure. RPP Pasal 146(3) used wajib and stood alone, whereas the surviving text at PP 33/2026 Pasal 133(3)(g) requires only that the notification contain a pernyataan that the old controller will destroy the transferred data when the transaction ends.
Enforcement therefore attaches to the notification rather than to the retention, since Pasal 133 ayat (1) is listed for administrative sanction at Pasal 184(1) while the promise itself founds no separate duty. Holding by the old controller after closing falls back on the general triggers in Pasal 84(1), which run off the retention period, a subject request or unlawful processing, none of which is keyed to the transfer.
Treat the notice statement as a binding representation and schedule the destruction against it.
Where Europe stands diverges GDPR Articles 6, 14
The provision. The GDPR has no article on mergers, demergers, acquisitions, consolidations or dissolution.
Against Indonesia. The GDPR reaches the notification limb through two general duties rather than a dedicated one.
Compared at UU Pasal 48, where the full comparison sits.
Equivalence is now measured against the UU alone
The draft measured the recipient country's protection against the peraturan perundang-undangan di bidang Pelindungan Data Pribadi, meaning the whole body of PDP legislation and implementing rules. Pasal 165(1) measures it against the Undang-Undang mengenai Pelindungan Data Pribadi alone. The three-step order of equivalence, adequate binding protection and consent is otherwise preserved intact.
Narrowing the comparator to UU 27/2022 excludes PP 33/2026 itself and every Peraturan Lembaga still to come, so a destination can be adequate while offering nothing that matches the enacted regulation's own operational duties. The same instrument keeps the wider comparator for binding corporate rules in Pasal 171(1)(a), where the recipient must match the peraturan perundang-undangan di bidang Pelindungan Data Pribadi, so two routes to the same destination are benchmarked differently.
That asymmetry rewards the adequacy route and penalises the group-internal one, which is the opposite of the incentive a controller-led safeguard regime needs.
Benchmark adequacy analyses to UU 27/2022 and reserve the wider corpus benchmark for binding corporate rules drafting.
Where Europe stands diverges GDPR Articles 44, 45, 46, 48, 49
The provision. Chapter V builds a three-step cascade.
Against Indonesia. The three rungs sit in Chapter V's order, ayat (2) against Article 45, ayat (3) against Article 46 and ayat (4) against Article 49(1)(a), but only the first two rungs do the same work. Also compared at UU Pasal 60.
Compared at UU Pasal 56, where the full comparison sits.
Foreign court orders lost their treaty precondition
Transfer Data Pribadi yang diperintahkan oleh putusan pengadilan, tribunal, atau putusan otoritas administrasi negara ketiga, hanya diakui dan dapat dilaksanakan apabila terdapat perjanjian internasional yang mendasarinya dengan negara yang meminta transfer Data Pribadi.
The enacted text carries nothing in its place.
The draft recognised a transfer ordered by a third-country court, tribunal or administrative authority only where an international agreement underpinned it. The enacted text has no such provision; the words tribunal and otoritas administrasi appear nowhere in it.
This was the draft's analogue of GDPR Article 48, which stops a foreign judgment or administrative order operating on its own as a ground for export. Its deletion removes the one clause in the draft that spoke to compelled disclosure to a foreign authority, and it is the exposure that an adequacy assessment is least able to price. Pasal 160 to 174 contain no replacement.
The nearest provision, Pasal 166, routes law enforcement exchange out of Indonesia back to the same transfer rules and says nothing about an order arriving from abroad.
A foreign order is no longer addressed by the transfer chapter. Handle it in contract, because the regulation now says nothing.
This finding cites no article of the enacted text, so there is no implementing provision to carry a comparison. The subject is treated in the reading pages.
Inter-state agreement route replaced by an authority-level instrument
- a.
perjanjian antarnegara tempat kedudukan Pengendali Da ta Pribadidan/atauProsesor Data Pribadi yang melakukan transfer Data Pribadi dengan negara tempat kedudukan Pengendali Data Pribadi dan/atau Prosesor Data Pribadi yang menerima transfer Data Pribadi; - b.
standar klausul kontrakPelindungan Data Pribadi; - c.
peraturan perusahaanyang mengikatuntuk suatu grup perusahaan;dan/atau - d.
instrumen PelindunganData Pribadiyang memadai dan mengikat lain yang diakui oleh Lembaga PDP.
- a.instrumen yang mengikat secara hukum dan dapat dipaksakan baik bagi instansi atau otoritas berdasarkan kewenangan sesuai dengan ketentuan peraturan perundang-undangan. b. standar klausul kontrak Pelindungan Data Pribadi;
- c.peraturan korporasi yang mengikat untuk suatu grup korporasi; dan/atau
- d.instrumen Pelindungan Data Pribadi yang memadai dan mengikat lain yang diakui oleh Lembaga.
Ketentuan lebih lanjut mengenai pelaksanaan Pelindungan Data Pribadi yang memadai dan bersifat mengikat diatur dalam Peraturan Lembaga.
Draft Pasal 185(2)(a) put an agreement between the transferor's and the recipient's home states first among the forms of adequate and binding protection, and Pasal 186 gave that route a dedicated article with its own delegation to the Lembaga PDP. Enacted Pasal 169(1)(a) substitutes a legally binding and enforceable instrument for agencies or authorities acting on statutory powers, and Pasal 186 has no counterpart.
The draft's first limb was a state-to-state treaty that no private controller could procure. PP 33/2026 Pasal 169(1)(a) replaces it with an instrument binding and enforceable on agencies or authorities acting on statutory powers, which is the construction GDPR Article 46(2)(a) uses for public bodies.
The first safeguard therefore moves out of treaty practice and into administrative practice, and private controllers are left with the three limbs at Pasal 169(1)(b) to (d) rather than four. Draft Pasal 186, which gave the treaty route its own article and its own delegation to the Lembaga PDP, has no counterpart, so the content of the new limb now rests on the general delegation at Pasal 172 and is not fixed in the regulation itself.
Private controllers should plan on standard contractual clauses or binding corporate rules; the first limb is now a public-sector route.
Where Europe stands diverges GDPR Articles 44, 45, 46, 48, 49
The provision. Chapter V builds a three-step cascade.
Against Indonesia. The three rungs sit in Chapter V's order, ayat (2) against Article 45, ayat (3) against Article 46 and ayat (4) against Article 49(1)(a), but only the first two rungs do the same work.
Compared at UU Pasal 56, where the full comparison sits.
Inter-state agreements stopped being a named route
- a.
perjanjian antarnegara tempat kedudukan Pengendali Da ta Pribadidan/atauProsesor Data Pribadi yang melakukan transfer Data Pribadi dengan negara tempat kedudukan Pengendali Data Pribadi dan/atau Prosesor Data Pribadi yang menerima transfer Data Pribadi; - b.
standar klausul kontrakPelindungan Data Pribadi; - c.
peraturan perusahaanyang mengikatuntuk suatu grup perusahaan;dan/atau - d.
instrumen PelindunganData Pribadiyang memadai dan mengikat lain yang diakui oleh Lembaga PDP.
- a.instrumen yang mengikat secara hukum dan dapat dipaksakan baik bagi instansi atau otoritas berdasarkan kewenangan sesuai dengan ketentuan peraturan perundang-undangan. b. standar klausul kontrak Pelindungan Data Pribadi;
- c.peraturan korporasi yang mengikat untuk suatu grup korporasi; dan/atau
- d.instrumen Pelindungan Data Pribadi yang memadai dan mengikat lain yang diakui oleh Lembaga.
Ketentuan lebih lanjut mengenai pelaksanaan Pelindungan Data Pribadi yang memadai dan bersifat mengikat diatur dalam Peraturan Lembaga.
The draft named an inter-state agreement as its own form of adequate binding protection. That phrase appears nowhere in the enacted text, which uses a general legally binding and enforceable instrument instead.
Perjanjian antarnegara was a distinct safeguard route in RPP Pasal 185(2)(a) and was elaborated at Pasal 186. PP Pasal 169(1)(a) replaces it with an instrument that is legally binding and enforceable for agencies or authorities, so the treaty case survives only where the instrument binds a public body, and a private controller is left with the standard contractual clauses at Pasal 169(1)(b) or the binding corporate rules at Pasal 169(1)(c).
The international agreement does not disappear from the chapter, but it is demoted: under Pasal 168(1)(c) it now appears as one of three criteria feeding the adequacy assessment rather than as a basis for transfer in its own right.
A bilateral arrangement no longer has a named slot for a private controller. It survives only where the instrument binds a public body, and otherwise counts as evidence of adequacy rather than a substitute for it.
Where Europe stands diverges GDPR Articles 44, 45, 46, 48, 49
The provision. Chapter V builds a three-step cascade.
Against Indonesia. The three rungs sit in Chapter V's order, ayat (2) against Article 45, ayat (3) against Article 46 and ayat (4) against Article 49(1)(a), but only the first two rungs do the same work.
Compared at UU Pasal 56, where the full comparison sits.
Destruction of transferred data moves from the transfer agreement to the notice to subjects
- a.
pembagian kewajiban dan tanggung jawab antaraPengendali Data Pribadilama dan Pengendali Data Pribadi baru terkait pemrosesan Data Pribadi dalam transaksi ini; - b.
pemberian aksesData PribadiPengendali Data Pribadi lama kepada Pengendali Data Pribadi baru diberikan sepanjang transaksi berlangsung; - c.
penggunaan akses terhadapData Pribaditersebut kepada Pengendali Data Pribadi baru hanya untuk keperluan penentuan apakah akan melanjutkan transaksi ini atau tidak; - d.Pengendali Data Pribadi baru
akan memusnahkan, dan/atau mengembalikan semua data PengendaliData Pribadilama dalam hal transaksi tidak berlanjut atau tidak selesai dilaksanakan; dan - e.
Pengendali Data Pribadi lama akan memusnahkan Data Pribadi yang telah dialihkan kepada Pengendali Data Pribadi baru.
- a.dasar pemrosesan Data Pribadi masing-masing Pengendali Data Pribadi;
- b.pemenuhan prinsip Pelindungan Data Pribadi;
- c.pemenuhan hak Subjek Data Pribadi; dan
- d.pembagian kewajiban dan tanggung jawab Pengendali Data Pribadi lama, Pengendali Data Pribadi baru, dan pihak yang terlibat dalam pemrosesan Data Pribadi.
RPP Pasal 144 ayat (2) put the deal mechanics in the agreement itself. Huruf b limited the new controller's access to the duration of the transaction, huruf c limited the use of that access to the decision whether to proceed, huruf d bound the new controller to destroy or return everything if the transaction failed, and huruf e bound the old controller to destroy what it had transferred.
PP 33/2026 Pasal 134 ayat (2) carries none of the four. Only huruf a survives, as PP Pasal 134 ayat (2) huruf d. The old controller's destruction undertaking reappears outside the agreement, at PP Pasal 133 ayat (3) huruf g, as mandatory content of its notification to data subjects.
The old controller's destruction undertaking changed instrument and changed form. RPP Pasal 144 ayat (2) huruf e made it a required term of the agreement between the old and the new controller. PP Pasal 133 ayat (3) huruf g makes it a pernyataan in the old controller's notification to the data subject, and fixes the stated moment of destruction at the close of the penggabungan, pemisahan, pengambilalihan, peleburan or pembubaran badan hukum.
The undertaking is now addressed to the subject rather than to the counterparty, and the agreement under PP Pasal 134 ayat (2) needs only each controller's processing basis, the principles, the rights of the subject and the division of responsibility between the old controller, the new controller and the other parties involved.
Huruf b, huruf c and huruf d of RPP Pasal 144 ayat (2) do not reappear in PP Pasal 133 or PP Pasal 134. PP Pasal 133 ayat (6) leaves the old controller to set the terms of access for the other parties involved, and imposes no purpose limit and no duration limit of its own.
Nothing says what happens to the data if the transaction collapses, so an agreement can satisfy PP Pasal 134 in full and leave the failed deal unaddressed.
Time the destruction to the close of the corporate action, which is what PP Pasal 133 ayat (3) huruf g makes the old controller state to subjects. Keep the access duration limit, the purpose limit and the failed transaction return in the deal documents, because PP Pasal 134 no longer supplies them.
Where Europe stands diverges GDPR Articles 6, 14
The provision. The GDPR has no article on mergers, demergers, acquisitions, consolidations or dissolution.
Against Indonesia. The GDPR reaches the notification limb through two general duties rather than a dedicated one.
Compared at UU Pasal 48, where the full comparison sits.
Pre-transfer information duty sheds the processor and the wajib
- a.tujuan transfer Data Pribadi ke luar wilayah hukum negara Republik Indonesia;
- b.keberadaan instrumen Pelindungan Data Pribadi;
- c.mekanisme pelindungan terkait transfer Data Pribadi untuk memastikan
SubyekData Pribadi dapat memperoleh hak-haknya; dan - d.risiko transfer Data Pribadi dan mekanisme mitigasi risiko yang ditempuh oleh Pengendali Data Pribadi.
- a.tujuan transfer Data Pribadi ke luar wilayah hukum negara Republik Indonesia;
- b.keberadaan instrumen Pelindungan Data Pribadi;
- c.mekanisme pelindungan terkait transfer Data Pribadi untuk memastikan Subjek Data Pribadi dapat memperoleh hak-haknya; dan
- d.risiko transfer Data Pribadi dan mekanisme mitigasi risiko yang ditempuh oleh Pengendali Data Pribadi.
Draft Pasal 195(1) required the Pengendali Data Pribadi dan/atau Prosesor Data Pribadi to inform the subject before the transfer, using wajib. Enacted Pasal 164 requires only the Pengendali Data Pribadi, using harus. The four minimum contents and the deferral for vital interests survive unchanged.
The information package is preserved in full, including the fourth item, disclosure of the transfer risks and the mitigation the controller has adopted, which is the most demanding of the four and the one that presupposes a completed Pasal 163 assessment. What moved is who owes it: a processor transferring under instruction has no independent notice duty, so the subject's only route to the information runs through the controller.
The vital interests deferral remains the single exception and postpones rather than removes the notice.
Build the four-item transfer notice into the controller's privacy notice and treat processor notice as a contractual pass-through.
Where Europe stands diverges GDPR Articles 44, 45, 46, 48, 49
The provision. Chapter V builds a three-step cascade.
Against Indonesia. The three rungs sit in Chapter V's order, ayat (2) against Article 45, ayat (3) against Article 46 and ayat (4) against Article 49(1)(a), but only the first two rungs do the same work.
Compared at UU Pasal 56, where the full comparison sits.
The adequacy list stopped being optional
- a.negara tempat kedudukan Pengendali Data Pribadi dan/atau Prosesor Data Pribadi yang menerima transfer Data Pribadi memiliki peraturan
hukumPelindungan Data Pribadi; - b.negara tempat kedudukan Pengendali Data Pribadi dan/atau Prosesor Data Pribadi yang menerima transfer Data Pribadi memiliki lembaga atau otoritas pengawas Pelindungan Data Pribadi; dan
- c.negara tempat kedudukan Pengendali Data Pribadi dan/atau Prosesor Data Pribadi yang menerima transfer Data Pribadi memiliki komitmen internasional atau tunduk pada kewajiban lain yang timbul dari
konvensiatau instrumen yang mengikat secara hukum serta dari partisipasinya dalam sistem multilateral atau regional terkait dengan Pelindungan Data Pribadi.
- a.negara tempat kedudukan Pengendali Data Pribadi dan/atau Prosesor Data Pribadi yang menerima transfer Data Pribadi memiliki peraturan perundang-undangan di bidang Pelindungan Data Pribadi;
- b.negara tempat kedudukan Pengendali Data Pribadi dan/atau Prosesor Data Pribadi yang menerima transfer Data Pribadi memiliki lembaga atau otoritas pengawas Pelindungan Data Pribadi; dan
- c.negara tempat kedudukan Pengendali Data Pribadi dan/atau Prosesor Data Pribadi yang menerima transfer Data Pribadi memiliki komitmen internasional atau tunduk pada kewajiban lain yang timbul dari perjanjian internasional atau instrumen yang mengikat secara hukum, serta dari partisipasinya dalam sistem multilateral atau regional terkait dengan Pelindungan Data Pribadi.
The draft said the authority may publish a list of adequate countries. The enacted text says it must.
A discretion became a duty. Under RPP Pasal 184(2) the adequacy list was something the authority could produce if it chose; PP Pasal 168(2) obliges the Lembaga to establish it.
The assessment itself was never the controller's task in either instrument, since RPP Pasal 183(2) and PP Pasal 167 both reserve the penilaian to the authority, so what the list changes is the controller's position under the standing wajib in PP Pasal 165(1) to ensure the receiving country offers equivalent protection.
PP Pasal 168(3) lets a controller transfer to a listed country subject only to compliance with prevailing law, while Pasal 168(4) leaves the method of assessment to a Peraturan Lembaga. Both the list and the method wait on the same body, and until either arrives the controller satisfies Pasal 165(1) on its own evidence or falls back to the binding safeguards in Pasal 165(2) or consent in Pasal 165(3).
Watch for the first published adequacy list. Until it appears you must evidence equivalence under Pasal 165(1) yourself, or fall back to Pasal 165(2) or (3).
Where Europe stands diverges GDPR Articles 44, 45, 46, 48, 49
The provision. Chapter V builds a three-step cascade.
Against Indonesia. The three rungs sit in Chapter V's order, ayat (2) against Article 45, ayat (3) against Article 46 and ayat (4) against Article 49(1)(a), but only the first two rungs do the same work. Also compared at UU Pasal 60.
Compared at UU Pasal 56, where the full comparison sits.
Seven transfer duties drop from wajib to harus and move to Part One
- a.melakukan perekaman dan pemetaan siklus transfer Data Pribadi dan implikasinya;
- b.memastikan bahwa Data Pribadi yang ditransfer
secukupnya,relevan, dan terbatas sesuai dengan tujuan transfer; - c.mengidentifikasi instrumen hukum yang digunakan sebagai rujukan untuk proses transfer sesuai dengan ketentuan peraturan
perundang - undangan; - d.melakukan penilaian efektivitas instrumen hukum yang digunakan untuk proses transfer Data Pribadi yang akan dilakukan sebelum melakukan transfer;
- e.menggunakan instrumen pelengkap apabila dibutuhkan, baik berupa instrumen kontraktual, teknis, dan/atau organisasional;
- f.menerapkan
langkah-langkah prosedural yang dapat ditempuh jika akan menggunakan instrumen pelengkap; dan - g.mengevaluasi ulang secara berkala dalam kurun waktu yang memadai.
Dalam melaksanakan transfer Data Pribadi sebagaimana dimaksud dalam Pasal 160, Pengendali Data Pribadi dan/atau Prosesor Data Pribadi harus:
- a.melakukan perekaman dan pemetaan siklus transfer Data Pribadi dan implikasinya;
- b.memastikan bahwa Data Pribadi yang ditransfer cukup, relevan, dan terbatas sesuai dengan tujuan transfer Data Pribadi;
- c.mengidentifikasi instrumen hukum yang digunakan sebagai rujukan untuk proses transfer Data Pribadi sesuai dengan ketentuan peraturan perundang-undangan;
- d.melakukan penilaian efektivitas instrumen hukum yang digunakan untuk proses transfer Data Pribadi yang akan dilakukan sebelum melakukan transfer Data Pribadi;
- e.menggunakan instrumen pelengkap apabila dibutuhkan, baik berupa instrumen kontraktual, teknis, dan/atau organisasional;
- f.menerapkan langkah prosedural yang dapat ditempuh jika akan menggunakan instrumen pelengkap; dan
- g.mengevaluasi ulang secara berkala dalam kurun waktu yang memadai.
Draft Pasal 192(1) imposed the seven execution duties, opening with recording and mapping the transfer cycle, using wajib. Enacted Pasal 161 imposes the same seven using harus, and moves them ahead of the consent provisions into Bagian Kesatu of BAB V, immediately after the general transfer article at Pasal 160.
The list survives item for item, but wajib is the verb Indonesian drafting reserves for a sanctioned obligation and harus for a normative requirement, and Pasal 184(1) confirms the distinction by naming only Pasal 160(2) and Pasal 165(1) to (3) as administratively sanctionable in the transfer chapter.
Draft Pasal 213(1) drew that same perimeter through draft Pasal 181(2) and Pasal 182(1) to (3), so the exposure is unchanged in substance; what changed is the label, and with it the argument that these are enforceable obligations in their own right.
The relocation is the compensating gain, since Pasal 161 now cross-refers to Pasal 160 and sits in Bagian Kesatu ahead of the three tier rule at Pasal 165, where draft Pasal 192 trailed the consent provisions at draft Pasal 189 and Pasal 190.
Keep the transfer cycle map, but expect the Lembaga to reach it through Pasal 165 compliance rather than by sanctioning Pasal 161 directly.
Where Europe stands diverges GDPR Articles 44, 45, 46, 48, 49
The provision. Chapter V builds a three-step cascade.
Against Indonesia. The three rungs sit in Chapter V's order, ayat (2) against Article 45, ayat (3) against Article 46 and ayat (4) against Article 49(1)(a), but only the first two rungs do the same work.
Compared at UU Pasal 56, where the full comparison sits.
Transfer risk assessment now binds the controller alone
Pengendali Data Pribadi harus melakukan penilaian atas kebutuhan transfer Data Pribadi dan dampak transfer Data Pribadi terhadap hak Subjek Data Pribadi melalui penilaian atas risiko transfer Data Pribadi.
Draft Pasal 194(1) placed the transfer necessity and impact assessment on the Pengendali Data Pribadi dan/atau Prosesor Data Pribadi with the verb wajib. Enacted Pasal 163 places it on the Pengendali Data Pribadi alone with the verb harus, and drops the draft's ayat (2) delegation.
Removing the processor concentrates the assessment burden on the controller, including for transfers a processor initiates under instruction, and leaves onward transfers governed only by the single sentence in Pasal 160(4), which asks both roles to comply with the prevailing legislation.
Dropping the draft's delegation at Pasal 194(2) also removes the promised Peraturan Lembaga on how the risk assessment is to be run, so its content is left to the controller. Read against Pasal 161, which still binds Pengendali dan/atau Prosesor to record and map the transfer cycle, the enacted chapter splits the assessment duties between controller and processor without saying how the two interlock.
Controllers cannot delegate the transfer risk assessment to a processor; write the input obligation into the processing contract instead.
Where Europe stands diverges GDPR Articles 44, 45, 46, 48, 49
The provision. Chapter V builds a three-step cascade.
Against Indonesia. The three rungs sit in Chapter V's order, ayat (2) against Article 45, ayat (3) against Article 46 and ayat (4) against Article 49(1)(a), but only the first two rungs do the same work.
Compared at UU Pasal 56, where the full comparison sits.
Added clauses need only avoid conflict with the UU
- a.dasar pemrosesan Data Pribadi;
- b.klausul Pelindungan Data Pribadi;
- c.kewajiban pemberitahuan dalam hal terjadi kegagalan Pelindungan Data Pribadi; dan
- d.kewajiban melakukan uji kelayakan terhadap pihak lain yang menerima transfer Data Pribadi.
- a.definisi atau istilah;
- b.dasar pemrosesan Data Pribadi;
- c.klausul Pelindungan Data Pribadi;
- d.kewajiban pemberitahuan dalam hal terjadi Kegagalan Pelindungan Data Pribadi; dan
- e.kewajiban melakukan uji kelayakan terhadap pihak lain yang menerima transfer Data Pribadi.
Draft Pasal 187(3) allowed the controller to add transfer terms sesuai kebutuhan transfer Data Pribadi dan ketentuan peraturan perundang-undangan di bidang Pelindungan Data Pribadi. Enacted Pasal 170(3) allows additions outside the fixed clauses sepanjang tidak bertentangan dengan Undang-Undang mengenai Pelindungan Data Pribadi.
The test moves from positive conformity with the whole body of PDP legislation to mere non-contradiction with UU 27/2022, mirroring the change of comparator in Pasal 165(1) and loosening the constraint in the same direction. Additional clauses that sit uneasily with PP 33/2026 or a future Peraturan Lembaga are no longer caught by the wording, though Pasal 169(3) preserves the Lembaga's power to assess whether the transfer requirements are met overall.
The consultation facility in ayat (4) remains optional, which leaves the controller carrying the drafting risk.
There is more room to tailor the clauses than the draft allowed; use the Pasal 170(4) consultation for anything touching the regulation rather than the statute.
Where Europe stands diverges GDPR Articles 44, 45, 46, 48, 49
The provision. Chapter V builds a three-step cascade.
Against Indonesia. The three rungs sit in Chapter V's order, ayat (2) against Article 45, ayat (3) against Article 46 and ayat (4) against Article 49(1)(a), but only the first two rungs do the same work.
Compared at UU Pasal 56, where the full comparison sits.
Binding corporate rules content requirement drops wajib memuat
- a.kewajiban Pengendali Data Pribadi dan/atau Prosesor Data Pribadi yang menerima transfer Data Pribadi untuk memberikan Pelindungan Data Pribadi yang setara atau lebih tinggi dari yang diatur dalam peraturan
perundang -undangandi bidang Pelindungan Data Pribadi; - b.para pihak yang terikat pada peraturan korporasi yang mengikat;
- c.menentukan negara dan wilayah tujuan transfer Data Pribadi berdasarkan peraturan korporasi yang mengikat tersebut; dan
- d.menentukan pembagian peran, hak, dan kewajiban para pihak yang terlibat.
- a.Pengendali Data Pribadi penerima mengendalikan atau dikendalikan Pengendali Data Pribadi pengirim; dan
- b.Pengendali Data Pribadi penerima dan Pengendali Data Pribadi pengirim berada di bawah kendali pihak yang sama.
- a.kewajiban Pengendali Data Pribadi dan/atau Prosesor Data Pribadi yang menerima transfer Data Pribadi untuk memberikan Pelindungan Data Pribadi yang setara atau lebih tinggi dari yang diatur dalam peraturan perundang-undangan di bidang Pelindungan Data Pribadi;
- b.para pihak yang terikat pada peraturan korporasi yang mengikat;
- c.menentukan negara dan wilayah tujuan transfer Data Pribadi berdasarkan peraturan korporasi yang mengikat tersebut; dan
- d.menentukan pembagian peran, hak, dan kewajiban para pihak yang terlibat.
- a.Pengendali Data Pribadi penerima mengendalikan atau dikendalikan Pengendali Data Pribadi pengirim; dan
- b.Pengendali Data Pribadi penerima dan Pengendali Data Pribadi pengirim berada di bawah kendali pihak yang sama.
RPP Pasal 188 ayat (1) said the rules wajib memuat persyaratan paling sedikit the four listed items. PP Pasal 171 ayat (1) says they paling sedikit memuat those items, dropping wajib and dropping persyaratan, and renames peraturan perusahaan as peraturan korporasi. The chapeau re-anchors the rules, from RPP Pasal 185 ayat (2) huruf c to PP Pasal 169 ayat (1) huruf c.
The draft delegation at RPP Pasal 188 ayat (4) has no counterpart in the enacted article, which ends at ayat (3).
The four minimum contents are identical: an undertaking by the recipient to give equal or higher protection, the parties bound, the destination countries and territories, and the division of roles, rights and obligations. What changed is the deontic framing.
Dropping wajib removes the ground for treating an incomplete set of rules as a breach in its own right, and leaves ayat (1) reading as a description of what such rules contain. The same drop runs through ayat (3). RPP Pasal 188 ayat (3) said the Pengendali Data Pribadi wajib mendapatkan persetujuan dari Lembaga PDP before transferring.
PP Pasal 171 ayat (3) states only that use of the rules follows setelah mendapatkan persetujuan dari Lembaga, with no verb of obligation. Item (a) keeps its comparator, peraturan perundang-undangan di bidang Pelindungan Data Pribadi, word for word from the draft. The delegation does not survive on the face of the article.
RPP Pasal 188 ayat (4) sent the detail of binding corporate rules to a Peraturan Lembaga PDP, and PP Pasal 171 stops at ayat (3). The nearest enacted delegation, PP Pasal 172, runs to pelaksanaan Pelindungan Data Pribadi yang memadai dan bersifat mengikat, a route rather than an instrument. Whether it reaches binding corporate rules turns on PP Pasal 169 ayat (1), the provision the enacted chapeau now points to and the one this finding does not carry.
Draft binding corporate rules to the four contents in PP Pasal 171 ayat (1), and to the comparator in huruf a, peraturan perundang-undangan di bidang Pelindungan Data Pribadi. Do not read the enacted article as delegating the operating detail. PP Pasal 171 ends at ayat (3), and PP Pasal 172 delegates the route, not the instrument.
Where Europe stands diverges GDPR Articles 44, 45, 46, 48, 49
The provision. Chapter V builds a three-step cascade.
Against Indonesia. The three rungs sit in Chapter V's order, ayat (2) against Article 45, ayat (3) against Article 46 and ayat (4) against Article 49(1)(a), but only the first two rungs do the same work.
Compared at UU Pasal 56, where the full comparison sits.
Consent-route obligations restated as tetap rather than wajib
- a.transfer tidak berulang;
- b.transfer melibatkan Subjek Data Pribadi dengan jumlah terbatas;
- c.transfer diperlukan untuk tujuan memenuhi ketentuan yang tidak mengesampingkan kepentingan atau hak dan kebebasan Subjek Data Pribadi;
- d.Pengendali Data Pribadi telah menilai risiko dan menerapkan langkah pelindungan yang sesuai; dan
- e.Pengendali Data Pribadi telah menginformasikan kepada Lembaga
PDPdan Subjek Data Pribadi tentang kegiatan transfer dan kepentingan sah yang mendesak yang dipenuhi dengan transfer tersebut.
- a.transfer Data Pribadi tidak berulang;
- b.transfer Data Pribadi melibatkan Subjek Data Pribadi dengan jumlah terbatas;
- c.transfer Data Pribadi diperlukan untuk tujuan memenuhi ketentuan yang tidak mengesampingkan kepentingan atau hak dan kebebasan Subjek Data Pribadi;
- d.Pengendali Data Pribadi telah menilai risiko dan menerapkan langkah Pelindungan Data Pribadi yang sesuai; dan
- e.Pengendali Data Pribadi telah menginformasikan kepada Lembaga dan Subjek Data Pribadi tentang kegiatan transfer Data Pribadi dan kepentingan sah yang mendesak yang dipenuhi dengan transfer Data Pribadi tersebut.
Ketentuan lebih lanjut mengenai pelaksanaan persetujuan untuk transfer Data Pribadi ke luar wilayah hukum Negara Republik Indonesia diatur dalam Peraturan Lembaga.
RPP Pasal 190 ayat (1) said that on a consent-based transfer the controller wajib melaksanakan kewajiban sesuai dengan ketentuan peraturan perundang-undangan. PP Pasal 173 ayat (1) says the controller tetap melaksanakan those obligations, and it attaches the duty to dalam mendapatkan persetujuan rather than to the transfer itself, with the cross-reference now running to PP Pasal 165 ayat (3) where the draft pointed to RPP Pasal 189.
The draft delegation at RPP Pasal 190 ayat (3) reappears as a standalone article at PP Pasal 174, rewritten to name pelaksanaan persetujuan untuk transfer Data Pribadi ke luar wilayah hukum Negara Republik Indonesia.
Tetap melaksanakan is descriptive where wajib melaksanakan was prescriptive, so the clause records that the other duties continue rather than imposing them afresh. That holds because the kewajiban arise sesuai dengan ketentuan peraturan perundang-undangan and bind independently of this article.
The five cumulative conditions in PP Pasal 173 ayat (2) carry over in substance: a non-repetitive transfer, a limited number of subjects, necessity that does not override the subject's interests, a completed risk assessment with protective measures, and notification of both the Lembaga and the subject. The wording was tidied rather than reopened, with Data Pribadi spelled out through each huruf and Lembaga PDP renamed Lembaga.
The delegation survives the move as well. RPP Pasal 190 ayat (3) sent the consent route to a Peraturan Lembaga PDP, and PP Pasal 174 defers pelaksanaan persetujuan untuk transfer Data Pribadi ke luar wilayah hukum Negara Republik Indonesia to a Peraturan Lembaga, so the operating detail of the narrowest limb is deferred rather than settled in the PP. Consent remains the narrowest of the three limbs rather than the general fallback controllers tend to treat it as.
Do not treat consent as a workaround. The five conditions in PP Pasal 173 ayat (2) rule out routine or bulk transfers, and the operating detail is deferred to a Peraturan Lembaga under PP Pasal 174.
Where Europe stands diverges GDPR Articles 44, 45, 46, 48, 49
The provision. Chapter V builds a three-step cascade.
Against Indonesia. The three rungs sit in Chapter V's order, ayat (2) against Article 45, ayat (3) against Article 46 and ayat (4) against Article 49(1)(a), but only the first two rungs do the same work.
Compared at UU Pasal 56, where the full comparison sits.
Onward transfers move from wajib tunduk to harus tunduk
- a.dilakukan oleh Pengendali Data Pribadi sesuai dengan ketentuan peraturan
perundang - undangan; - b.Pengendali Data Pribadi membuat Data Pribadi tersedia untuk Pengendali Data Pribadi dan/atau Prosesor Data Pribadi yang menerima Data Pribadi; dan
- c.Pengendali Data Pribadi dan/atau Prosesor Data Pribadi yang menerima Data Pribadi berada di luar wilayah hukum Negara Republik Indonesia.
- a.dilakukan oleh Pengendali Data Pribadi sesuai dengan ketentuan peraturan perundang-undangan;
- b.Pengendali Data Pribadi membuat Data Pribadi tersedia untuk Pengendali Data Pribadi dan/atau Prosesor Data Pribadi yang menerima Data Pribadi; dan
- c.Pengendali Data Pribadi dan/atau Prosesor Data Pribadi yang menerima Data Pribadi berada di luar wilayah hukum Negara Republik Indonesia.
Draft Pasal 181(4) said that on an onward transfer the controller or processor wajib tunduk to the applicable legislation. Enacted Pasal 160(4) says harus tunduk. Pasal 160(1) also narrows the authorising reference from peraturan perundang-undangan to the Undang-Undang mengenai Pelindungan Data Pribadi.
Onward transfer is the point at which Indonesian control over the data is weakest, and both texts dispose of it in a single sentence. Both verbs are imperative, so the duty itself survives; what falls away is the stronger label, and the sanction position is unchanged, since Pasal 184(1) reaches Pasal 160 ayat (2) only and RPP Pasal 213(1) reached Pasal 181 ayat (2) only.
A defective onward transfer must therefore be reached through the transferring controller's own protection duty rather than directly. Neither text specifies what the onward recipient must satisfy, leaving the Pasal 165 cascade to be applied by analogy or by contract.
Contract for the cascade to apply to onward transfers expressly; the regulation does not do it for you.
Where Europe stands diverges GDPR Articles 44, 45, 46, 48, 49
The provision. Chapter V builds a three-step cascade.
Against Indonesia. The three rungs sit in Chapter V's order, ayat (2) against Article 45, ayat (3) against Article 46 and ayat (4) against Article 49(1)(a), but only the first two rungs do the same work.
Compared at UU Pasal 56, where the full comparison sits.
What is inside this theme
12 changes, 6 of which shift an obligation. Pick one, or step through them in order.
Authority loses standing to sue for damages in the public interest
The enacted text carries nothing in its place.
Draft Pasal 211(1) gave the authority standing to bring a claim in the name of the public interest for compensation, with Pasal 212 allowing it to ask the prosecution service to conduct that claim. Neither provision has a counterpart in the enacted text.
The draft built a public enforcer for collective redress and gave it prosecutorial support; the enacted text keeps prosecution assistance only for enforcing a sanction decision under Pasal 198 and for dispute resolution under Pasal 221. Compensation for a mass breach therefore has no public claimant.
A data subject is left with an individual civil claim under Pasal 108(3) or mediation under Bab X, which ends in a Kesepakatan Perdamaian binding on the parties under Pasal 220(4) and enforceable against a defaulting party only if they take it back to court for an akta perdamaian under Pasal 220(5).
The regulatory response to a large breach is now confined to an administrative fine capped at 2 per cent of annual revenue under Pasal 185(1), which Pasal 185(4) routes through the non-tax state revenue rules rather than to the affected subjects. Collective redress is left unbuilt on the regulatory side of the instrument.
Advise on breach exposure on the basis that the authority cannot sue for subject compensation, and model civil claims separately.
This finding cites no article of the enacted text, so there is no implementing provision to carry a comparison. The subject is treated in the reading pages.
Cross-border law enforcement exchange now runs the transfer cascade
The draft had no such provision.
Dalam hal pertukaran Data Pribadi antar penegak hukum dilaksanakan ke luar wilayah hukum Negara Republik Indonesia, pertukaran Data Pribadi dilaksanakan sesuai dengan ketentuan transfer Data Pribadi dalam Peraturan Pemerintah ini.
PP 33/2026 adds Pasal 166, subjecting the exchange of personal data between law enforcement agencies to the transfer rules of this regulation whenever it leaves Indonesian jurisdiction. The draft dealt with inter-agency exchange only at Pasal 180, which set no condition for the cross-border case.
Draft Pasal 180 let law enforcement bodies exchange personal data through agreed inter-agency mechanisms without engaging the transfer cascade at all, and enacted Pasal 159 keeps that mechanism for the handling of criminal cases under the data protection law.
Pasal 166 closes the route at the border by directing outbound inter-agency exchange to the transfer rules of the regulation, including the Pasal 165 cascade, so an outbound exchange now requires equivalence, an adequate and binding protection, or the consent of the subject.
Draft Pasal 191, which recognised a transfer ordered by a foreign court, tribunal or third state administrative authority only where an international agreement supported it, has no enacted counterpart, so the regulation now governs outbound state exchange while saying nothing about inbound foreign compulsion.
Agencies and regulated entities answering foreign agency requests must run the Pasal 165 cascade before releasing data.
Where Europe stands diverges GDPR Articles 44, 45, 46, 48, 49
The provision. Chapter V builds a three-step cascade.
Against Indonesia. The three rungs sit in Chapter V's order, ayat (2) against Article 45, ayat (3) against Article 46 and ayat (4) against Article 49(1)(a), but only the first two rungs do the same work.
Compared at UU Pasal 56, where the full comparison sits.
Every deadline now runs in working days by definition
The draft mixed plain hari with hari kerja across the enforcement and mediation timetable. The enacted text defines Hari as hari kerja at Pasal 1 number 19 and uses the defined term throughout, so every period the draft expressed in calendar days is now counted in working days at the same numeral.
The clearest instance is the first mediation meeting: draft Pasal 234(2) gave 10 calendar days, enacted Pasal 211(2) gives 10 working days. The same conversion silently lengthens the mediation period in Pasal 218(1) from 30 calendar to 30 working days, the objection window in Pasal 197(1) from 14 calendar to 14 working days and the extension notice in Pasal 218(3) from 7 calendar to 7 working days.
Periods the draft already expressed as hari kerja, such as the 3 day document check and the 14 and 60 day examination periods, are unchanged in substance. The net effect is roughly a 40 per cent lengthening wherever the draft counted calendar days, and no period anywhere in the enacted text is calendar.
Recompute every diary entry in working days and check Indonesian public holidays before relying on any deadline.
Where Europe stands diverges GDPR Articles 58, 78
The provision. The GDPR has no single article on how a supervisory authority exercises its powers.
Against Indonesia. Both instruments leave procedure to be filled in, but they leave different things and at different levels. Also compared at UU Pasal 64.
Compared at UU Pasal 61, where the full comparison sits.
Hari is defined as a working day for the whole regulation
The draft had no such provision.
Dalam Peraturan Pemerintah ini yang dimaksud dengan:
- 1.Data Pribadi adalah data tentang orang perseorangan yang teridentifikasi atau dapat diidentifikasi secara tersendiri atau dikombinasi dengan Informasi lainnya baik secara langsung maupun tidak langsung melalui sistem elektronik atau nonelektronik.
- 2.Pelindungan Data Pribadi adalah keseluruhan upaya untuk melindungi Data Pribadi dalam rangkaian pemrosesan Data Pribadi guna menjamin hak konstitusional Subjek Data Pribadi.
- 3.Informasi adalah keterangan, pernyataan, gagasan, dan tanda-tanda yang mengandung nilai, makna, dan pesan, baik data, fakta, maupun penjelasannya yang dapat dilihat, didengar, dan dibaca yang disajikan dalam berbagai kemasan dan format sesuai dengan perkembangan teknologi informasi dan komunikasi secara elektronik ataupun nonelektronik.
- 4.Pengendali Data Pribadi adalah Setiap Orang, Badan Publik, dan Organisasi Internasional yang bertindak sendiri-sendiri atau bersama-sama dalam menentukan tujuan dan melakukan kendali pemrosesan Data Pribadi.
- 5.Prosesor Data Pribadi adalah Setiap Orang, Badan Publik, dan Organisasi Internasional yang bertindak sendiri-sendiri atau bersama-sama dalam melakukan pemrosesan Data Pribadi atas nama Pengendali Data Pribadi.
- 6.Subjek Data Pribadi adalah orang perseorangan yang pada dirinya melekat Data Pribadi.
- 7.Setiap Orang adalah orang perseorangan atau korporasi.
- 8.Badan Publik adalah lembaga eksekutif, legislatif, yudikatif, dan badan lain yang fungsi dan tugas pokoknya berkaitan dengan penyelenggaraan negara, yang sebagian atau seluruh dananya bersumber dari anggaran pendapatan dan belanja negara dan/atau anggaran pendapatan dan belanja daerah, atau organisasi nonpemerintah sepanjang sebagian atau seluruh dananya bersumber dari anggaran pendapatan dan belanja negara dan/atau anggaran pendapatan dan belanja daerah, sumbangan masyarakat, dan/atau luar negeri.
- 9.Organisasi Internasional adalah organisasi yang diakui sebagai subjek hukum internasional dan mempunyai kapasitas untuk membuat perjanjian internasional.
- 10.Mediasi Pelindungan Data Pribadi yang selanjutnya disebut sebagai Mediasi adalah cara penyelesaian Sengketa Pelindungan Data Pribadi terkait Data Pribadi melalui proses perundingan untuk memperoleh kesepakatan Para Pihak yang Bersengketa dengan dibantu Mediator.
- 11.Mediator adalah seorang atau beberapa orang yang memiliki kompetensi yang ditetapkan oleh Lembaga dan/atau terdaftar pada badan Arbitrase atau Lembaga Mediasi sesuai dengan ketentuan peraturan perundang-undangan yang berkedudukan di wilayah Negara Republik Indonesia untuk membantu Para Pihak yang Bersengketa mencari kemungkinan penyelesaian Sengketa Pelindungan Data Pribadi.
- 12.Arbitrase adalah cara penyelesaian suatu Sengketa Pelindungan Data Pribadi perdata di luar peradilan umum yang didasarkan pada perjanjian arbitrase yang dibuat secara tertulis oleh Para Pihak yang Bersengketa.
- 13.Para Pihak yang Bersengketa adalah Pengendali Data Pribadi, Prosesor Data Pribadi, atau Subjek Data Pribadi yang Bersengketa.
- 14.Kesepakatan Perdamaian adalah kesepakatan hasil Mediasi dalam bentuk dokumen yang memuat klausul perdamaian dan ketentuan penyelesaian Sengketa Pelindungan Data Pribadi serta ditandatangani oleh Para Pihak yang Bersengketa dan Mediator.
- 15.Lembaga adalah lembaga yang menyelenggarakan Pelindungan Data Pribadi sebagaimana diatur dalam Undang-Undang yang mengatur mengenai Pelindungan Data Pribadi.
- 16.Lembaga Mediasi adalah lembaga alternatif penyelesaian Sengketa Pelindungan Data Pribadi yang berkedudukan hukum dalam wilayah Negara Republik Indonesia sesuai dengan ketentuan peraturan perundang-undangan.
- 17.Sengketa Pelindungan Data Pribadi yang selanjutnya disebut sebagai Sengketa adalah perbedaan kepentingan atau perselisihan yang terjadi antara Para Pihak yang Bersengketa mengenai pelaksanaan atau pemenuhan hak dan/atau kewajiban Pelindungan Data Pribadi salah satu pihak berdasarkan hubungan hukum di antara mereka.
- 18.Kegagalan Pelindungan Data Pribadi adalah kegagalan melindungi Data Pribadi seseorang dalam hal kerahasiaan, integritas, dan ketersediaan Data Pribadi, termasuk pelanggaran keamanan, baik yang disengaja maupun tidak disengaja, yang mengarah pada perusakan, kehilangan, perubahan, pengungkapan, atau akses yang tidak sah terhadap Data Pribadi yang dikirim, disimpan, atau diproses.
- 19.Hari adalah hari kerja.
- 20.Pengendali Data Pribadi Bersama adalah Pengendali Data Pribadi yang terdiri atas 2 (dua) atau lebih Pengendali Data Pribadi yang secara bersama-sama menentukan tujuan dan melakukan kendali pemrosesan Data Pribadi.
- 21.Anak adalah setiap orang yang berusia di bawah 18 (delapan belas) tahun dan belum menikah.
- 22.Penyandang Disabilitas adalah setiap orang yang mengalami keterbatasan fisik, intelektual, mental, dan/atau sensorik dalam jangka waktu lama yang dalam berinteraksi dengan lingkungan dapat mengalami hambatan dan kesulitan untuk berpartisipasi secara penuh dan efektif dengan warga negara lainnya berdasarkan kesamaan hak.
- 23.Masa Retensi adalah periode waktu pemrosesan Data Pribadi yang diperlukan untuk pencapaian tujuan pemrosesan Data Pribadi dan/atau karena kewajiban hukum lainnya.
- 24.Kerja Sama Internasional dalam Bidang Pelindungan Data Pribadi yang selanjutnya disebut Kerja Sama Internasional adalah kegiatan secara bersama-sama yang dilakukan secara bilateral, regional, atau multilateral dalam rangka memberikan Pelindungan Data Pribadi.
- 25.Pejabat atau Petugas yang Melaksanakan Fungsi Pelindungan Data Pribadi yang selanjutnya disebut PPDP adalah pejabat atau petugas yang bertanggung jawab untuk memastikan pemenuhan kepatuhan atas prinsip Pelindungan Data Pribadi dan mitigasi risiko pelanggaran Pelindungan Data Pribadi.
- 26.Pemerintah Pusat yang selanjutnya disebut Pemerintah adalah Presiden Republik Indonesia yang memegang kekuasaan pemerintahan Negara Republik Indonesia sebagaimana dimaksud dalam Undang-Undang Dasar Negara Republik Indonesia Tahun 1945.
- 27.Kementerian atau lembaga adalah instansi penyelenggara negara yang bertugas mengawasi dan mengeluarkan pengaturan terhadap sektornya.
PP 33/2026 Article 1 point 19 defines Hari as a working day, a term the draft did not define at all. The capitalised term then governs the periods in Articles 64, 190, 192, 195, 197, 211, 213 and 218, where the draft used hari kerja only in its sanctions and mediation chapters.
The enacted text converts every period it sets into working days by a single definitional move. Article 1 point 19 defines Hari as a working day, and because the capitalised term is then used throughout, periods the draft would have counted in calendar days now exclude weekends and public holidays. A period of 14 Hari runs for roughly three calendar weeks.
Every internal service level built against the draft understates the time available, and every deadline the Lembaga sets against a controller is correspondingly longer than it reads.
Recompute every deadline in the Regulation on working days before setting internal service levels.
Where Europe stands ported from the GDPR GDPR Article 4
The provision. GDPR Article 4 is a single definitions article carrying 26 numbered terms that the rest of the Regulation runs on.
Against Indonesia. The identified-or-identifiable formula in UU Pasal 1 angka 1, with its direct and indirect limbs, tracks GDPR Article 4(1) closely enough to read as a transposition.
Compared at UU Pasal 1, where the full comparison sits.
The fine ceiling held and a door to zero opened
- a.dampak negatif yang ditimbulkan akibat pelanggaran;
- b.durasi waktu terjadinya pelanggaran;
- c.jenis Data Pribadi yang terdampak;
- d.jumlah
Orangyang terdampak; - e.proses temuan pelanggaran;
- f.tingkat keterbukaan dan
kerjasamaPengendali Data Pribadi dalam prosespenyelidikan; - g.skala usaha Pengendali Data Pribadi
atauProsesor Data Pribadi; - h.kemampuan Pengendali Data Pribadi
atauProsesor Data Pribadi untuk membayar;dan - i.
konsideran lain yang relevan.
- a.dampak negatif yang ditimbulkan akibat pelanggaran;
- b.durasi waktu terjadinya pelanggaran;
- c.jenis Data Pribadi yang terdampak;
- d.jumlah Subjek Data Pribadi yang terdampak;
- e.proses temuan pelanggaran;
- f.tingkat keterbukaan dan kerja sama Pengendali Data Pribadi dan/atau Prosesor Data Pribadi dalam proses pemeriksaan;
- g.skala usaha Pengendali Data Pribadi dan/atau Prosesor Data Pribadi;
- h.kemampuan Pengendali Data Pribadi dan/atau Prosesor Data Pribadi untuk membayar;
- i.kepatuhan Pengendali Data Pribadi dan/atau Prosesor Data Pribadi; dan/atau
- j.variabel lain yang relevan yang ditetapkan oleh Lembaga.
Both texts cap the fine at 2% of annual revenue. The enacted text adds compliance as a calculation variable, hands the residual variable to the Lembaga to determine, and creates an express power to set the fine at zero.
The headline number did not move, which makes the change easy to miss. What moved is everything beneath it. PP Pasal 185(2)(i) adds the compliance of the controller or processor to the variables used to calculate the fine, and item (j) converts the draft's konsideran lain yang relevan at RPP Pasal 225(2)(i) into a variabel lain yang relevan yang ditetapkan oleh Lembaga, so the residual limb is now the regulator's to fill rather than an open consideration.
Pasal 185(3) then permits a fine of Rp0,00 on unspecified pertimbangan tertentu, which the draft nowhere contemplated. Against GDPR Article 83, which structures severity through two fixed tiers, the enacted text concentrates a wide and largely unstructured discretion in a regulator whose own implementing rules are not yet made.
Compliance now carries a monetary value in the fine calculation. Document it before you need it.
Where Europe stands diverges GDPR Articles 58, 83, 84
The provision. GDPR Article 83 sets the conditions for administrative fines.
Against Indonesia. The gap is wider than 2 per cent against 4 per cent. Also compared at UU Pasal 60, UU Pasal 61.
Compared at UU Pasal 57, where the full comparison sits.
The window to comply with a sanction grew more than fourfold
Seven calendar days became thirty Hari, and PP Pasal 1(19) defines Hari as a working day.
The draft gave a sanctioned controller a week to comply. The enacted text gives thirty working days, which is at least six weeks once weekends and public holidays are counted. Because Pasal 1(19) defines Hari for the whole regulation, the same expansion runs through every Hari-denominated period, including the thirty-day mediation window at Pasal 218 and the fourteen-day objection period at Pasal 197.
Read every Hari deadline as working days. The enforcement calendar is materially longer than it looks.
Where Europe stands diverges GDPR Articles 58, 83, 84
The provision. GDPR Article 83 sets the conditions for administrative fines.
Against Indonesia. The gap is wider than 2 per cent against 4 per cent. Also compared at UU Pasal 60, UU Pasal 61.
Compared at UU Pasal 57, where the full comparison sits.
Public participation gains its own chapter and an oversight role
The draft had no such provision.
The draft mentioned public participation only as something the authority could involve when supervising, at Pasal 203(2). The enacted text creates a standalone chapter, Bab VII, whose Pasal 179 lets the public act directly or indirectly through education, training, advocacy, socialisation and oversight, with the detail delegated to a Peraturan Lembaga under Pasal 179(3).
Pasal 179 gives civil society a textual foothold that the draft confined to the authority's discretion, and the inclusion of pengawasan in the list means public oversight is contemplated alongside the authority's own supervision under Pasal 180. The verb is dapat berperan, so nothing here creates a right of access to documents or a right to be heard in a proceeding, and the complaint route remains Pasal 189(2).
The practical consequence is a broader pool of complainants, since Pasal 189(3) does not require the complainant to be the affected data subject. What the chapter does not do is give the public any standing once a proceeding starts.
Expect complaints from advocacy organisations as well as data subjects and prepare a single response protocol for both.
Where Europe stands diverges GDPR Articles 35, 57, 80
The provision. The GDPR gives the public no role in supervision.
Against Indonesia. UU Pasal 63 has no close GDPR counterpart, but the GDPR does address civil society, so this is a divergence rather than a subject the Regulation ignores.
Compared at UU Pasal 63, where the full comparison sits.
Objection decision can now be granted in part
- a.menerima keberatan; atau
- b.menolak keberatan disertai dengan alasan penolakan.
- a.menerima keberatan sebagian atau seluruhnya; atau
- b.menolak keberatan disertai dengan alasan penolakan.
The draft gave the head of the authority a binary choice at Pasal 223(4), accept or reject with reasons. Enacted Pasal 197(4) allows acceptance in part or in whole. The draft's statement that acceptance may revoke or annul the sanction, at Pasal 223(7), is dropped, and a deemed grant on silence can no longer be taken to the administrative court for a ruling as draft Pasal 223(9) permitted, it is simply implemented under general legislation per Pasal 197(7).
Partial acceptance changes how an objection should be pleaded, because a controller can now attack the quantum or one limb of a multiple sanction without having to defeat the decision entirely. What the enacted text does not say is what a partial grant does to the sanction, since the draft's revocation and annulment language went with Pasal 223(7).
The deemed grant on the authority's silence within 14 Hari under Pasal 197(6) is likewise left without a mechanism for giving it effect, where the draft at least pointed to the administrative court. The route to the administrative court survives only for a rejected objection under Pasal 197(8).
Plead the objection limb by limb with a fallback quantum position and record the Pasal 197(3) deadline for a deemed grant.
Where Europe stands diverges GDPR Articles 58, 83, 84
The provision. GDPR Article 83 sets the conditions for administrative fines.
Against Indonesia. The gap is wider than 2 per cent against 4 per cent. Also compared at UU Pasal 60, UU Pasal 61.
Compared at UU Pasal 57, where the full comparison sits.
Parties lose the right to put experts and fact witnesses
Draft Pasal 242(1) gave the disputing parties a right, berhak, to submit one or more experts and fact witnesses, separately from the mediator's own power at Pasal 242(2). The enacted Pasal 219 keeps only the mediator's route, and saksi fakta disappears from the chapter altogether.
Under the draft a party could bring evidence into the mediation on its own initiative; under Pasal 219(1) evidence reaches the table only if the mediator elects to call it and both sides consent. Pasal 219(2) then requires the parties to agree in advance whether the expert's assessment binds them, so a reluctant respondent can block expert input twice over.
In a data protection dispute, where the technical facts of a breach usually sit with the controller, this asymmetry falls on the data subject. The mediation is correspondingly less capable of resolving contested facts.
Secure written agreement on expert evidence before the first mediation meeting, since Pasal 219 gives no unilateral route.
Where Europe stands diverges GDPR Articles 58, 78
The provision. The GDPR has no single article on how a supervisory authority exercises its powers.
Against Indonesia. Both instruments leave procedure to be filled in, but they leave different things and at different levels. Also compared at UU Pasal 64.
Compared at UU Pasal 61, where the full comparison sits.
Parties not the authority appoint a mediator when none exists
- a.
daftarMediator pada LembagaPDP;atau - b.Lembaga Mediasi
Profesionalyang terdaftar di LembagaPDP.
- a.Mediator yang terdaftar pada Lembaga; atau
- b.Lembaga Mediasi yang terdaftar di Lembaga.
Where the authority has no mediator available, draft Pasal 231(2) let the head of the authority appoint one from a registered professional mediation institution. Enacted Pasal 207(4) transfers that appointment to the parties, and the qualifier Profesional is dropped from the institution's description at Pasal 207(2)(b).
The appointment power moves from the authority to the disputants at precisely the point where the authority is least able to help, namely before any register of mediators exists. Draft Pasal 231(2) let the head of the authority reach outside its own register, whereas enacted Pasal 207(4) leaves the parties to find an institution themselves.
Cost gives no relief either, because draft Pasal 233(1) put the fees of a Lembaga PDP mediator on the state while enacted Pasal 210 says only that the Lembaga will regulate the fees of both kinds of mediator, so who pays is now unstated.
Dropping Profesional lowers the threshold for what counts as a qualifying institution, with competence left to a Peraturan Lembaga under Pasal 222, and the authority's residual appointment power survives only where the parties fail to agree, at Pasal 208(1).
Identify a registered mediation institution before filing a dispute report, because Pasal 207(4) leaves that choice to the parties.
Where Europe stands diverges GDPR Articles 58, 78
The provision. The GDPR has no single article on how a supervisory authority exercises its powers.
Against Indonesia. Both instruments leave procedure to be filled in, but they leave different things and at different levels. Also compared at UU Pasal 64.
Compared at UU Pasal 61, where the full comparison sits.
Publication of supervision results becomes a power not a duty
The draft stated flatly that the authority publishes supervision results. The enacted Pasal 183(1) recasts publication as a power the authority is empowered to exercise, and Pasal 183(2) changes the mode from an open announcement or a publicly accessible one to an open announcement that is also publicly accessible.
The shift from melakukan to berwenang melakukan converts an operational statement into a discretionary competence, so a controller cannot assume that supervision outcomes reach the public record. The change in Pasal 183(2) from the draft's disjunctive to a conjunctive requirement means that when the authority does publish, the result must be both openly announced and publicly retrievable, which raises the reputational stakes of the decision to publish.
Sanction decisions travel a different route under Pasal 195(2), on the authority's official media and coordinated with the relevant ministry under Pasal 195(3). Whether a supervision file becomes public is now a matter of authority judgement rather than rule.
Plan reputational response for supervision outcomes on the assumption publication is discretionary and unannounced.
Where Europe stands diverges GDPR Articles 58, 84
The provision. GDPR Article 58 splits the authority's powers into three sets.
Against Indonesia. The lettered list in UU Pasal 60 reaches many of the same places by a route of its own: huruf j to huruf n answer most of GDPR Article 58(1), huruf c and huruf g answer part of GDPR Article 58(2), and huruf f, read with PP Pasal 170 and PP Pasal 171 ayat (3), answers the authorisation powers at GDPR Article 58(3)(g) to (j) rather than any corrective power. Also compared at UU Pasal 61.
Compared at UU Pasal 60, where the full comparison sits.
Supervision orders now carry a set deadline and action plan
Dalam melaksanakan tugas sebagaimana dimaksud dalam Pasal 199 ayat (2), Lembaga PDP berwenang:
- a.
merumuskan dan menetapkan kebijakan di bidang PelindunganData Pribadi; - b.
melakukan pengawasan terhadap kepatuhan Pengendali Data Pribadi; - c.
menjatuhkan sanksi administratif atas pelanggaran Pelindungan Data Pribadi yang dilakukan Pengendali Data Pribadi dan/atau Prosesor Data Pribadi; - d.
membantu aparat penegak hukum dalam penanganan dugaan tindak pidanaData Pribadisebagaimana dimaksud dalam Undang-Undang ini; - e.
bekerja sama dengan lembaga PelindunganData Pribadinegara lain dalam rangka penyelesaian dugaan pelanggaran PelindunganData Pribadilintas negara; - f.
melakukan penilaian terhadap pemenuhan persyaratan t ransferData Pribadike luar wilayah hukum Negara Republik Indonesia; - g.
memberikan perintah dalam rangka tindak lanjut hasil pengawasan kepadaPengendali Data Pribadidan/atauProsesor Data Pribadi; - h.melakukan
publikasi hasil pelaksanaan pengawasanPelindungan Data Pribadisesuai dengan ketentuan peraturan perundang-undangan; - i.
menerima aduan dan/atau laporan tentang dugaan terjadinya pelanggaran PelindunganData Pribadi; - j.
melakukan pemeriksaan dan penelusuran atas pengaduan, laporan, dan/atauhasil pengawasanterhadap dugaan terjadinya pelanggaran Pelindungan Data Pribadi; - k.memanggil dan menghadirkan Setiap Orang dan/atau Badan Publik yang terkait dengan dugaan pelanggaran Pelindungan Data Pribadi;
- l.meminta keterangan, data, Informasi, dan dokumen dari Setiap Orang dan/atau Badan Publik terkait dugaan pelanggaran Pelindungan Data Pribadi;
- m.memanggil dan menghadirkan ahli yang diperlukan dalam pemeriksaan dan penelusuran terkait dugaan pelanggaran Pelindungan Data Pribadi;
- n.melakukan pemeriksaan dan penelusuran
terhada psistem elektronik, sarana, ruang, dan/atau tempat yang digunakan Pengendali Data Pribadi dan/atau Prosesor Data Pribadi, termasuk memperoleh akses terhadap data dan/atau menunjuk pihak ketiga;dan - o.
meminta bantuan hukum kepada kejaksaandalampenyelesaian sengketa Pelindungan Data Pribadi.
- a.
memenuhi hak SubjekData Pribadi; - b.
melakukan kewajibanPengendali Data Pribadi dan/atau Prosesor Data Pribadi; - c.
menghentikan atau membatasi pemrosesan Data Pribadi; - d.
menghentikan atau mengubah perjanjian antara Pengendali Data Pribadi atau Prosesor Data Pribadi dengan pihak lain yang diduga merugikan Subjek Data Pribadi atau masyarakat; - e.
melakukan atau tidak melakukan kegiatan tertentu guna memenuhi ketentuan peraturan perundang-undangan di bidang Pelindungan Data Pribadi;dan - f.
melakukan atau tidak melakukan kegiatan tertentu u ntuk mencegah atau mengurangi kerugian SubjekData Pribadiatau masyarakat.
- a.
mendengarkan keterangan saksi, ahli, dan/atau pihak lain yang terkait dengan pemrosesan Data Pribadi; - b.
melakukan pemeriksaan dan penelusuran terhadap sistem elektronik, sarana, ruang, dan/atau tempat yang digunakan Pengendali Data Pribadi dan/atau Prosesor Data Pribadi; - c.
memperoleh akses terhadap Data Pribadi yang diproses Pengendali Data Pribadi dan/atau Prosesor Data Pribadi; - d.
menunjuk pihak ketiga untuk melakukan pemeriksaan dan penelusuran terhadap sistem elektronik, sarana, ruang, dan/atau tempat yang digunakan Pengendali Data Pribadi dan/atau Prosesor Data Pribadi; dan/atau - e.
melakukan tindakan dalam ran gka menjalankan kewenangan sesuai dengan ketentuan peraturan perundang-undangan.
- a.
dasar hukum pemeriksaan; - b.
tujuan dan ruang lingkup pemeriksaan; - c.
daftar sistem elektronik, sarana, ruang, dan/atau tempat yang digunakan yang akan diperiksa; dan - d.
relevansi sistem elektronik, sarana, ruang, dan/atau tempat yang digunakan yang akan diperiksa dengan dugaan pelanggaran Pelindungan Data Pribadi oleh Pengendali Data Pribadi dan/atau Prosesor Data Pribadi.
- a.
dasar hukum pemeriksaan; - b.
tujuan dan ruang lingkup pemeriksaan; - c.deskripsi mengenai jenis Data Pribadi yang dimintakan akses;
- d.deskripsi mengenai cara akses terhadap Data Pribadi; dan
- e.jangka waktu pemberian akses terhadap Data Pribadi.
Lembaga dapat bekerja sama dengan lembaga Pelindungan Data Pribadi negara lain dalam rangka penyelesaian dugaan pelanggaran Pelindungan Data Pribadi lintas negara.
- a.memenuhi hak Subjek Data Pribadi;
- b.melakukan kewajiban Pengendali Data Pribadi dan/atau Prosesor Data Pribadi;
- c.menghentikan atau membatasi pemrosesan Data Pribadi;
- d.menghentikan atau mengubah perjanjian antara Pengendali Data Pribadi dan Prosesor Data Pribadi dengan pihak lain yang diduga merugikan Subjek Data Pribadi atau masyarakat;
- e.melakukan atau tidak melakukan kegiatan tertentu guna memenuhi ketentuan peraturan perundang-undangan di bidang Pelindungan Data Pribadi; dan/atau
- f.melakukan atau tidak melakukan kegiatan tertentu untuk mencegah atau mengurangi kerugian Subjek Data Pribadi atau masyarakat.
- a.penyusunan rencana tindak serta pelaksanaan rencana tindak; dan/atau
- b.penyampaian laporan perkembangan pelaksanaan rencana tindak, oleh Pengendali Data Pribadi dan/atau Prosesor Data Pribadi dalam menindaklanjuti perintah dalam rangka tindak lanjut hasil pengawasan.
- a.memanggil dan menghadirkan Setiap Orang dan/atau Badan Publik yang terkait dengan dugaan pelanggaran Pelindungan Data Pribadi;
- b.meminta keterangan, data, Informasi, dan dokumen dari Setiap Orang dan/atau Badan Publik terkait dugaan pelanggaran Pelindungan Data Pribadi;
- c.memanggil dan menghadirkan ahli yang diperlukan dalam pemeriksaan dan penelusuran terkait dugaan pelanggaran Pelindungan Data Pribadi;
- d.melakukan pemeriksaan dan penelusuran terhadap sistem elektronik, sarana, ruang, dan/atau tempat yang digunakan Pengendali Data Pribadi dan/atau Prosesor Data Pribadi, termasuk memperoleh akses terhadap data dan/atau menunjuk pihak ketiga; dan/atau
- e.melakukan tindakan dalam rangka menjalankan kewenangan sesuai dengan ketentuan peraturan perundang-undangan.
- a.dasar hukum;
- b.tujuan dan ruang lingkup;
- c.daftar sistem elektronik, sarana, ruang, dan/atau tempat yang digunakan; dan
- d.relevansi antara sistem elektronik, sarana, ruang, dan/atau tempat yang digunakan dan dugaan terjadinya pelanggaran Pelindungan Data Pribadi oleh Pengendali Data Pribadi dan/atau Prosesor Data Pribadi.
- a.dasar hukum;
- b.tujuan dan ruang lingkup;
- c.deskripsi mengenai jenis Data Pribadi yang dimintakan akses;
- d.deskripsi mengenai cara akses terhadap Data Pribadi; dan
- e.jangka waktu pemberian akses terhadap Data Pribadi.
Draft Pasal 204 listed six things the authority could order but attached no period for compliance and no form requirement. The enacted Pasal 181 requires the order in writing at ayat (2), requires the authority to fix a compliance period calibrated to supervisory need and complexity at ayat (4) and (5), and lets it demand an action plan and progress reports at ayat (6).
The draft order was an instruction with no clock, which made non-compliance difficult to establish. Pasal 181(4) supplies the clock and Pasal 181(6) converts the order into a supervised remediation programme with its own reporting duty on the controller or processor.
Because the period is set case by case rather than in the regulation, its length is a matter for negotiation at the point the order is issued, and Pasal 181(5) supplies the two grounds on which to argue for more time. Pasal 182 adds a further constraint where the addressee is a public body, requiring the authority to weigh the legislation governing that body's functions.
Argue the Pasal 181(5) complexity ground when the order is served rather than after the period has run.
Where Europe stands diverges GDPR Articles 58, 83, 84
The provision. GDPR Article 83 sets the conditions for administrative fines.
Against Indonesia. The gap is wider than 2 per cent against 4 per cent. Also compared at UU Pasal 60, UU Pasal 61, UU Pasal 62.
Compared at UU Pasal 57, where the full comparison sits.
What is inside this theme
34 changes, 22 of which shift an obligation. Pick one, or step through them in order.
Processor contract terms on deletion and security parity dropped
Dalam melakukan pengawasan, Pengendali Data Pribadi wajib menyiapkan:
- a.kebijakan terkait pemrosesan Data Pribadi;
- b.perjanjian yang mengatur kewajiban dan tanggung jawab Pelindungan Data Pribadi; dan
- c.kanal komunikasi pelaporan bagi masyarakat
dalam hal terjadi dugaan pelanggaran pemrosesan Data Pribadi oleh Prosesor Data Pribadi.
Perjanjian sebagaimana dimaksud dalam Pasal 134 huruf b terdiri atas:
- a.
perjanjian antara Pengendali Data Pribadi dan Prosesor Data Pribadi; atau - b.
perjanjian antara Pengendali Data Pribadi dengan pihak yang merupakan suatu badan hukum yang mayoritas sahamnya dimiliki atau dikendalikan dalam bentuk lainnya sesuai dengan ketentuan peraturan perundang- undangan oleh Pengendali Data Pribadi.
- a.
hak untuk melakukan audit; - b.
kewajiban bagi Prosesor Data Pribadi mematuhi instruksi Pengendali Data Pribadi; - c.
instruksi pemrosesan dari Pengendali Data Pribadi kepada Prosesor Data Pribadi; - d.
kewajiban bagi Prosesor Data Pribadi untuk meminta persetujuan Pengendali Data Pribadi secara tertulis dalam hal melakukan sub - processing; - e.
kewajiban Pr osesor Data Pribadi menginformasikan Pengendali Data Pribadi ketika terjadi perubahan kebijakan keamanan dan/atau Pelindungan Data Pribadi Prosesor Data Pribadi; - f.
kewajiban Pengendali Data Pribadi menginformasikan Prosesor Data Pribadi ketika terjadi perubahan kebijakan keamanan dan/atau Pelindungan Data Pribadi Prosesor Data Pribadi; - g.
pernyataan bahwa Prosesor Data Pribadi akan menerapkan standar Pelindungan Data Pribadi yang sama dengan standar Pengendali Data Pribadi; - h.
larangan bagi Prosesor Data Pribadi me mbuat kebijakan dan tindakan yang mengurangi pelindungan terhadap keamanan Data Pribadi; - i.
mekanisme pengembalian atau penghapusan Data Pribadi oleh Prosesor Data Pribadi dalam hal berakhirnya pemberian perintah pemrosesan dari Pengendali Data Pribadi terhadap Prosesor Data Pribadi; - j.
tanggung jawab Prosesor Data Pribadi dalam kegiatan pemrosesan; dan - k.
prosedur Prosesor Data Pribadi dalam hal terjadi insiden keamanan.
Dalam melakukan kewajiban pengawasan sebagaimana dimaksud dalam Pasal 126 ayat (1), Pengendali Data Pribadi harus memiliki:
- a.kebijakan terkait pemrosesan Data Pribadi;
- b.perjanjian pemrosesan Data Pribadi yang mengatur kewajiban dan tanggung jawab Pelindungan Data Pribadi; dan
- c.kanal komunikasi pelaporan bagi masyarakat.
Ketentuan lebih lanjut mengenai pengawasan oleh Pengendali Data Pribadi sebagaimana dimaksud dalam Pasal 126 dan Pasal 127 diatur dalam Peraturan Lembaga.
RPP Pasal 137(1) prescribed eleven minimum terms for the controller to processor agreement inside the supervision chapter, covering audit rights, adherence to instructions, written approval for sub-processing, notification of security policy changes, equivalence of protection standards, return or deletion on termination, liability and incident procedure. PP 33/2026 Pasal 127(b) requires only that an agreement exist and regulate obligations and responsibilities, with Pasal 128 delegating the detail to a Peraturan Lembaga.
The draft's other contract provision, RPP Pasal 21, survives intact as PP Pasal 14 with the same eleven items.
The enacted text keeps the draft's appointment agreement and drops its supervision chapter counterpart. PP Pasal 14 reproduces RPP Pasal 21 item for item, including the mekanisme pengawasan, pendokumentasian, audit, dan inspeksi at huruf h, and PP Pasal 15(2) keeps the processor's duty to obtain the controller's written approval before engaging another processor, so the audit mechanism and the control over sub-processing both survive.
What goes is the RPP Pasal 137(1) list: PP Pasal 127(b) reduces it to a single clause about kewajiban dan tanggung jawab and Pasal 128 sends the detail to a Peraturan Lembaga that has not been made. No enacted provision now requires the contract to address return or deletion of data when the engagement ends, equivalence between the processor's protection standard and the controller's, notification of a change in the processor's security policy, or an incident procedure.
Those four controls survive only where a contract already states them.
Keep the RPP Pasal 137 clauses on return or deletion, security parity and incident handling, since Pasal 14 and Pasal 15 already carry audit and sub-processing.
Where Europe stands diverges GDPR Articles 24, 28
The provision. The GDPR imposes no free-standing duty of supervision.
Against Indonesia. GDPR Article 28 attaches to a moment and to an instrument.
Compared at UU Pasal 37, where the full comparison sits.
Internal and external audit programme deleted and delegated
Dalam melakukan pengawasan, Pengendali Data Pribadi wajib menyiapkan:
- a.kebijakan terkait pemrosesan Data Pribadi;
- b.perjanjian yang mengatur kewajiban dan tanggung jawab Pelindungan Data Pribadi; dan
- c.kanal komunikasi pelaporan bagi masyarakat
dalam hal terjadi dugaan pelanggaran pemrosesan Data Pribadi oleh Prosesor Data Pribadi.
- a.
kebijakan pemrosesan Data Pribadi untuk karyawan, individual, dan/atau pihak yang menjalankan kegiatan pemrosesan Data Pribadi untuk Pengendali Data Pribadi; dan - b.
kebijakan audit yang berlaku baik pihak internal maupun eksternal untuk memeriksa kepatuhan pihak di bawah kendali Pengendali Data Pribadi.
- a.
tujuan; - b.
ruang lingkup; - c.
informasi jenis Data Pribadi yang diproses; - d.
kegiatan pemrosesan yang dilakukan oleh Pengendali Data Pribadi; - e.
informasi umum pihak yang terlibat dalam pemrosesan data Pengendali Data Pribadi; - f.
pemetaan kegiatan pemrosesan Data Pribadi yang dilakukan oleh Pengendali Data Pribadi; - g.
risiko pemrosesan Data Pribadi yang dapat diterima oleh Pengendali Data Pribadi; - h.
pembagian tugas pihak yang terlibat dalam pemrosesan data Pengendali Data Pribadi; - i.
kewajiban pihak yang terlibat dalam pemrosesan data Pengendali Data Pribadi; - j.
tanggung jawab pihak yang terlibat dalam pemrosesan data Pengendali Data Pribadi; - k.
mekanisme pemeriksaan kepatuhan terhadap kebijakan (audit); - l.
kewajiban pelatihan dan peningkatan kapasitas berkala; - m.
sanksi dalam hal kebijakan tidak dipatuhi; - n.
ruang lingkup kebijakan turunan yang dapat disusun oleh setiap bagian dari Pengendali Data Pribadi jika diperlukan; - o.
peranan dan fungsi Pejabat Pelindung Data Pribadi; dan - p.
informasi kontak Pejabat Pelindung Data Pribadi.
- a.
kriteria pihak yang merupakan pihak internal di bawah kendali Pengendali Data Pribadi; - b.
ruang lingkup audit untuk memastikan kepatuhan Pengendali Data Pribadi yang paling sedikit meliputi: 1. pemeriksaan pemenuhan tanggung jawab pihak yang terlibat dalam pemrosesan Data Pribadi; 2. dampak dari terpenuhi dan/atau tidak terpenuhinya tanggung jawab; dan 3. kesesuaian upaya penanganan atau pemulihan yang telah dilakukan oleh pihak yang diaudit dalam hal tidak dipenuhinya kewajiban dalam kebijakan tersebut. c. waktu pelaksanaan audit yang paling sedikit dilaksanakan: 1. berkala; dan 2. sewaktu-waktu jika terjadi dugaan kegagalan pemenuhan tanggung jawab sesuai kebijakan Pengendali Data Pribadi yang berlaku. d. kriteria pihak yang dapat melaksanakan audit; - e.
tindak lanjut audit yang paling sedikit berupa: 1. rekomendasi peningkatan kinerja; 2. pelibatan pihak lain untuk membantu pemulihan dan/atau pemenuhan tanggung jawab; dan/atau 3. pelaporan kepada Lembaga PDP sebagai bentuk permohonan rekomendasi peningkatan kinerja; dan - f.
mekanisme publikasi hasil audit kepada: 1. manajemen internal Pengendali; 2. masyarakat luas dalam hal telah dilakukan audit pasca pelanggaran pemrosesan Data Pribadi; dan 3. Lembaga PDP dalam hal telah dilakukan audit pasca pelanggaran pemrosesan Data Pribadi atau Pengendali Data Pribadi mengajukan permohonan rekomendasi peningkatan kinerja kepada Lembaga PDP.
- a.
kriteria pihak yang merupakan pihak eksternal di bawah kendali Pengendali Data Pribadi; - b.
ruang lingkup audit untuk memastikan kepatuhan Pengendali Data Pribadi yang paling sedikit meliputi: 1. pemeriksaan pemenuhan tanggung jawab pihak yang terlibat dalam pemrosesan Data Pribadi; 2. dampak dari terpenuhi dan/atau tidak terpenuhinya tanggung jawab; dan 3. kesesuaian upaya penanganan atau pemulihan yang telah dilakukan oleh pihak yang diaudit dalam hal tidak dipenuhinya kewajiban dalam kebijakan tersebut. c. waktu pelaksanaan audit yang paling sedikit dilaksanakan: 1. sebelum Pengendali Data Pribadi memerintahkan pihak eksternal melakukan pemrosesan Data Pribadi; 2. berkala sepanjang pihak eksternal melakukan pemrosesan Data Pribadi untuk Pengendali Data Pribadi; dan 3. sewaktu-waktu jika terjadi dugaan: a) pelanggaran pelaksanaan perintah Pengendali Data Pribadi; b) pemrosesan dilakukan di luar ruang lingkup kerjasama Pengendali Data Pribadi dan Prosesor Data Pribadi; atau c) terdapat dugaan pelanggaran pemrosesan Data Pribadi; dan 4. setelah Prosesor Data Pribadi berhenti melakukan pemrosesan berdasarkan perintah Pengendali Data Pribadi. d. Pelaksanaan audit secara berkala sepanjang pihak eksternal melakukan pemrosesan Data Pribadi untuk Pengendali Data Pribadi, atau sewaktu - waktu jika terjadi dugaan: 1. pelanggaran pelaksanaan perintah Pengendali Data Pribadi; 2. pemrosesan dilakukan di luar ruan g lingkup kerjasama Pengendali Data Pribadi dan Prosesor Data Pribadi; atau 3. terdapat dugaan pelanggaran pemrosesan Data Pribadi, dilakukan sesuai ketentuan ruang lingkup audit sebagaimana diatur pada ayat (4) huruf b. e. ruang lingkup pelaksanaan audit sebel um Pengendali Data Pribadi memerintahkan pihak eksternal melakukan pemrosesan Data Pribadi paling sedikit melakukan pemeriksaan terhadap: 1. informasi legalitas Prosesor Data Pribadi; 2. pengalaman Prosesor Data Pribadi dalam melakukan pemrosesan Data Pribadi; 3. kepatuhan Prosesor Data Pribadi terhadap peraturan perundangundangan terkait Data Pribadi; 4. pelanggaran pemrosesan Data Pribadi oleh Prosesor Data Pribadi dan upaya penanggulangan yang dilakukan; 5. kesiapan teknis, organisasi, dan sumber daya manusia Prosesor Data Pribadi dalam melakukan pemrosesan; dan 6. referensi Prosesor Data Pribadi dari pihak lain yang pernah menggun akan jasa Prosesor Data Pribadi. f. hasil audit yang dilakukan oleh Pengendali Data Pribadi sebelum memerintahkan pihak eksternal melakukan pemrosesan Data Pribadi wajib dijadikan dasar pertimbangan pemilihan Prosesor Data Pribadi, dan dapat menjadi panduan bagi Pengendali Data Pribadi dalam menerapkan langkah mitigasi risiko pemros esan oleh Prosesor Data Pribadi; - g.
ruang lingkup pelaksanaan audit setelah Prosesor Data Pribadi berhenti melakukan pemrosesan berdasarkan perintah Pengendali Data Pribadi paling sedikit melakukan pemeriksaan terhadap: 1. pemenuhan kewajiban sesuai dengan perjanjian dan/atau kebijakan yang berlaku; 2. dampak dan/atau risiko dari pemrosesan Data Pribadi yang dilakukan Prosesor Data Pribadi; dan 3. upaya pemulihan dampak dan/atau risiko tersebut. h. kriteria pihak yang dapat melaksanakan audit; - i.
tindak lanjut audit yang paling sedikit berupa: 1. rekomendasi peningkatan kinerja; 2. pelibatan pihak lain untuk membantu pemulihan dan/atau pemenuhan tanggung jawab; dan/atau 3. pelaporan kepada Lembaga PDP sebagai bentuk permohonan rekomendasi peningkatan kinerja; dan - j.
mekanisme publikasi hasil audit kepada: 1. manajemen internal; 2. masyarakat luas dalam hal telah dilakukan audit pasca pelanggaran pemrosesan Data Pribadi; dan 3. Lembaga PDP dalam hal telah dilakukan audit pasca pelanggaran pemrosesan D ata Pribadi atau Pengendali Data Pribadi mengajukan permohonan rekomendasi peningkatan kinerja kepada Lembaga PDP.
Dalam melakukan kewajiban pengawasan sebagaimana dimaksud dalam Pasal 126 ayat (1), Pengendali Data Pribadi harus memiliki:
- a.kebijakan terkait pemrosesan Data Pribadi;
- b.perjanjian pemrosesan Data Pribadi yang mengatur kewajiban dan tanggung jawab Pelindungan Data Pribadi; dan
- c.kanal komunikasi pelaporan bagi masyarakat.
Ketentuan lebih lanjut mengenai pengawasan oleh Pengendali Data Pribadi sebagaimana dimaksud dalam Pasal 126 dan Pasal 127 diatur dalam Peraturan Lembaga.
RPP Pasal 134 and PP 33/2026 Pasal 127 list the same three supervision instruments in the same order, a processing policy, a protection agreement and a public reporting channel, with the draft's wajib menyiapkan becoming harus memiliki.
What goes is RPP Pasal 135, which filled those headings out over four ayat, including the internal and external audit policy at Pasal 135(1)(b), pre engagement vetting of a processor, periodic and ad hoc audits, exit audits, audit follow up and publication of results to management, the public and the authority. PP 33/2026 Pasal 128 sends the whole of that detail to a future Peraturan Lembaga.
The most detailed accountability machinery in the draft chapter was removed in a single stroke. RPP Pasal 135(4)(e) obliged a controller to check a processor's legality, experience, compliance history, breach record, technical readiness and references before instructing it, and Pasal 135(4)(f) made that assessment the basis for selection.
PP 33/2026 requires no pre engagement audit of a processor; the nearest survivor is Pasal 125(2), which asks only that the controller ensure an appointed processor can support the confidentiality duty.
Pasal 127 keeps the three headings without their contents and Pasal 128 places the audit regime in a Peraturan Lembaga that does not yet exist, so controller supervision of processors is the least operationalised duty in the chapter even though Pasal 126(1) keeps wajib and appears in the sanction list at Pasal 184(1).
Run the RPP Pasal 135 due diligence and audit programme as internal policy and watch for the Peraturan Lembaga.
Where Europe stands diverges GDPR Articles 24, 28
The provision. The GDPR imposes no free-standing duty of supervision.
Against Indonesia. GDPR Article 28 attaches to a moment and to an instrument.
Compared at UU Pasal 37, where the full comparison sits.
Penalty for late compliance with a decision is gone
The enacted text carries nothing in its place.
Draft Pasal 222 exposed a controller or processor that failed to carry out an authority decision to a separate fine for delay, payable to the state as non-tax revenue. The word keterlambatan appears nowhere in the enacted text.
The draft paired a short compliance window in Pasal 220(4) with an arrears penalty in Pasal 222, so delay had its own price. The enacted text sets a longer window of 30 Hari in Pasal 195(5) and removes the penalty, leaving the Lembaga with a discretionary request for prosecutorial assistance under Pasal 198 and the debt recovery route in Pasal 186(2), which presupposes a fine already final and binding.
A controller that simply ignores an order to delete data or to suspend processing therefore faces no automatic escalation within the sanctions chapter, only a fresh proceeding through the stages set out in Pasal 188. Non-monetary sanctions are left without any arrears mechanism at all.
Expect enforcement of an ignored decision to come as a new proceeding rather than an accruing penalty.
This finding cites no article of the enacted text, so there is no implementing provision to carry a comparison. The subject is treated in the reading pages.
Bahasa Indonesia requirement for processor contracts deleted
- a.
hak untuk melakukan audit; - b.
kewajiban bagi Prosesor Data Pribadi mematuhi instruksi Pengendali Data Pribadi; - c.
instruksi pemrosesan dari Pengendali Data Pribadi kepada Prosesor Data Pribadi; - d.
kewajiban bagi Prosesor Data Pribadi untuk meminta persetujuan Pengendali Data Pribadi secara tertulis dalam hal melakukan sub - processing; - e.
kewajiban Pr osesor Data Pribadi menginformasikan Pengendali Data Pribadi ketika terjadi perubahan kebijakan keamanan dan/atau Pelindungan Data Pribadi Prosesor Data Pribadi; - f.
kewajiban Pengendali Data Pribadi menginformasikan Prosesor Data Pribadi ketika terjadi perubahan kebijakan keamanan dan/atau Pelindungan Data Pribadi Prosesor Data Pribadi; - g.
pernyataan bahwa Prosesor Data Pribadi akan menerapkan standar Pelindungan Data Pribadi yang sama dengan standar Pengendali Data Pribadi; - h.
larangan bagi Prosesor Data Pribadi me mbuat kebijakan dan tindakan yang mengurangi pelindungan terhadap keamanan Data Pribadi; - i.
mekanisme pengembalian atau penghapusan Data Pribadi oleh Prosesor Data Pribadi dalam hal berakhirnya pemberian perintah pemrosesan dari Pengendali Data Pribadi terhadap Prosesor Data Pribadi; - j.
tanggung jawab Prosesor Data Pribadi dalam kegiatan pemrosesan; dan - k.
prosedur Prosesor Data Pribadi dalam hal terjadi insiden keamanan.
The enacted text carries nothing in its place.
RPP Pasal 137(2) required the controller to processor agreement to be in Bahasa Indonesia. PP 33/2026 contains no language requirement for that agreement anywhere in Bagian Kedelapan Belas.
The language rule disappeared with the rest of RPP Pasal 137, and no minimum content list for the controller to processor agreement survives anywhere in the enacted text. Its deletion does not make English-only data processing agreements safe, because UU 24/2009 Pasal 31 independently requires Indonesian for agreements involving Indonesian parties.
What changes is the forum: the point is no longer a data protection compliance item the Lembaga can raise, and becomes a contract validity risk argued in the civil courts. Cross-border groups that standardise on English master agreements should not read the deletion as a relaxation.
Keep executing processor agreements bilingually; UU 24/2009 Pasal 31 still applies.
This finding cites no article of the enacted text, so there is no implementing provision to carry a comparison. The subject is treated in the reading pages.
Supervision scope loses affiliates and the catch-all limb
- a.Prosesor Data Pribadi;
- b.pihak yang merupakan unit, satuan kerja, atau perwakilan Pengendali Data Pribadi yang
melakukankegiatanpemrosesannyasendiri; - c.
pihak yang merupakan suatu badan hukum yang mayoritas sahamnya dimiliki atau dikendalikan dalam bentuk lainnya sesuai dengan ketentuan peraturan perundang -undangan olehPengendali Data Pribadi;dan - d.
pihak selain sebagaimana yang dimaksud pada huruf a sampai dengan huruf c yang terlibat dalam pemrosesan Data Pribadi.
- a.Prosesor Data Pribadi;
- b.pihak yang merupakan unit, satuan kerja, atau perwakilan Pengendali Data Pribadi yang kegiatan pemrosesan Data Pribadi dilakukan sendiri; dan/atau
- c.Pengendali Data Pribadi lain yang terlibat dalam pemrosesan Data Pribadi.
RPP Pasal 133(2) listed four categories under controller supervision: processors, internal units, majority-owned or otherwise controlled legal entities, and a catch-all covering any other party involved in processing. PP 33/2026 Pasal 126(2) lists three, replacing the affiliate limb and the catch-all with Pengendali Data Pribadi lain.
Group companies moved from supervised subordinates to independent controllers. RPP Pasal 133(2)(c) captured majority-owned entities as parties under the controller's kendali, which brought intra-group data flows inside the supervision duty and inside the RPP Pasal 138 agreement requirement; PP 33/2026 Pasal 126(2)(c) substitutes Pengendali Data Pribadi lain, a category that by definition determines its own purposes.
The deletion of the draft's catch-all at huruf d removes the residual limb that would otherwise have caught arrangements fitting none of the named categories. Intra-group processing must now be characterised as joint control under Pasal 1 angka 20 or as a controller to controller transfer, each carrying a different documentation set.
Recharacterise intra-group flows; affiliates are no longer supervised parties by default.
Where Europe stands diverges GDPR Articles 24, 28
The provision. The GDPR imposes no free-standing duty of supervision.
Against Indonesia. GDPR Article 28 attaches to a moment and to an instrument.
Compared at UU Pasal 37, where the full comparison sits.
Accountability documents must now be shown to the Lembaga
- a.
perjanjian antarnegara tempat kedudukan Pengendali Da ta Pribadidan/atauProsesor Data Pribadi yang melakukan transfer Data Pribadi dengan negara tempat kedudukan Pengendali Data Pribadi dan/atau Prosesor Data Pribadi yang menerima transfer Data Pribadi; - b.
standar klausul kontrakPelindungan Data Pribadi; - c.
peraturan perusahaanyang mengikatuntuk suatu grup perusahaan;dan/atau - d.
instrumen PelindunganData Pribadiyang memadai dan mengikat lain yang diakui oleh Lembaga PDP.
- a.instrumen yang mengikat secara hukum dan dapat dipaksakan baik bagi instansi atau otoritas berdasarkan kewenangan sesuai dengan ketentuan peraturan perundang-undangan. b. standar klausul kontrak Pelindungan Data Pribadi;
- c.peraturan korporasi yang mengikat untuk suatu grup korporasi; dan/atau
- d.instrumen Pelindungan Data Pribadi yang memadai dan mengikat lain yang diakui oleh Lembaga.
Ketentuan lebih lanjut mengenai pelaksanaan Pelindungan Data Pribadi yang memadai dan bersifat mengikat diatur dalam Peraturan Lembaga.
Draft Pasal 185(3) required the controller to demonstrate accountability for the adequate and binding safeguard in written or recorded form. Enacted Pasal 169(2) adds kepada Lembaga as the addressee and changes wajib to harus.
The draft required the controller to demonstrate the accountability in written or recorded form without naming anyone to demonstrate it to; the enacted duty runs to the Lembaga, which converts a documentation obligation into a production obligation without stating a trigger, a form or a deadline. Pasal 169(3) then preserves the regulator's power to assess compliance notwithstanding the documents, so production settles nothing on its own.
Nothing in the chapter says whether production is on request or on adoption of the safeguard, which is the first question a controller relying on standard contractual clauses needs answered.
Keep the safeguard file in a form that can be handed to the Lembaga on demand and seek clarification on whether filing is proactive.
Where Europe stands diverges GDPR Articles 44, 45, 46, 48, 49
The provision. Chapter V builds a three-step cascade.
Against Indonesia. The three rungs sit in Chapter V's order, ayat (2) against Article 45, ayat (3) against Article 46 and ayat (4) against Article 49(1)(a), but only the first two rungs do the same work.
Compared at UU Pasal 56, where the full comparison sits.
Appointing a contact point on dissolution falls from wajib to dapat
- a.
Pemberitahuantelah terjadi pembubaran Pengendali Data Pribadi sehingga akan dilakukan penghapusanataupemusnahan Data Pribadi; - b.
informasipihak lain yang bekerja sama dengan Pengendali Data Pribadi untuk memproses Data Pribadi; dan - c.narahubung
eksternalatauPejabat Petugas Pelindung Data Pribadiyangdapat meresponpertanyaan ataukomentar Subjek Data Pribaditerkait pemrosesan DataPribadinyahingga beberapa waktu tertentu yang wajar.
- a.telah terjadi pembubaran Pengendali Data Pribadi sehingga akan dilakukan penghapusan dan/atau pemusnahan Data Pribadi;
- b.pihak lain yang bekerja sama dengan Pengendali Data Pribadi untuk memproses Data Pribadi; dan
- c.narahubung atau PPDP yang ditugaskan untuk merespons pertanyaan atau permintaan Informasi terkait pemrosesan Data Pribadi hingga beberapa waktu tertentu yang wajar.
RPP Pasal 147(3) obliged a dissolving controller to appoint a contact person or data protection officer to answer subject queries for a defined period. PP 33/2026 Pasal 136(2) makes that appointment discretionary and drops the duration.
The draft guaranteed a surviving point of contact; the enacted text leaves it to the entity being wound up. RPP Pasal 147(3) used wajib menunjuk and sepanjang waktu tertentu, whereas PP 33/2026 Pasal 136(2) reads dapat menunjuk with no period attached.
The notification content at Pasal 136(1)(c) still names a narahubung or PPDP as the route for subject queries, so the enacted text compels disclosure of a contact that need never be appointed. Subjects of a dissolved controller may be left with a named right and no addressee.
Do not assume a post-dissolution contact will exist; secure it in the winding-up resolution.
Where Europe stands diverges GDPR Articles 6, 14
The provision. The GDPR has no article on mergers, demergers, acquisitions, consolidations or dissolution.
Against Indonesia. The GDPR reaches the notification limb through two general duties rather than a dedicated one.
Compared at UU Pasal 48, where the full comparison sits.
Ban on cameras in areas of private expectation is deleted
RPP Article 34(3) required prevention or minimisation of recordings of persons and property beyond the monitoring purpose, and Article 34(4) prohibited placement in areas where an individual has an expectation of privacy. PP 33/2026 Article 18(2) retains only the requirement that placement and use serve the intended monitoring purpose.
The two hard limits the draft placed on camera siting are gone. The word ekspektasi appears nowhere in PP 33/2026, so the prohibition on placement in private areas has no successor, and the minimisation duty in RPP Article 34(3) disappears with it. What survives at Article 18(2) constrains the direction of monitoring, not the location of the device.
Placement in workplaces, fitting rooms and similar areas is now governed only by the general processing bases in Article 30(3), and the visual device provisions are absent from the sanctions list in Article 184(1), as they were from RPP Article 213(1).
Keep an internal prohibition on cameras in private areas because the Regulation no longer supplies one.
Where Europe stands diverges GDPR Articles 5, 6, 9, 13, 35
Bank Indonesia OJK and LPS no longer named as sole requesters
Penerapan pengecualian hak Subjek Data Pribadi untuk kepentingan pengawasan sektor jasa keuangan, moneter, sistem pembayaran, dan stabilitas sistem keuangan yang dilakukan dalam rangka penyelenggaraan negara sebagaimana dimaksud dalam Pasal 170 ayat (1) huruf d dan pengecualian kewajiban Pengendali Data Pribadi untuk kepentingan pengawasan sektor jasa keuangan, moneter, sistem pembayaran, dan stabilitas sistem keuangan yang dilakukan dalam rangka penyelenggaraan negara Pasal 171 ayat (1) huruf d harus memenuhi kriteria:
- a.pemrosesan Data Pribadi diperlukan secara wajar dan dilakukan secara proporsional terbatas untuk memenuhi kepentingan pengawasan sektor jasa keuangan, moneter, sistem pembayaran, dan stabilitas sistem keuangan yang dilakukan dalam rangka penyelenggaraan negara;
- b.memiliki dasar pemrosesan Data Pribadi yang sah dan dapat menunjukkan bahwa pemrosesan Data Pribadi dilakukan sesuai dengan ketentuan peraturan perundang-undangan di bidang Pelindungan Data Pribadi;
- c.melakukan penilaian keseimbangan antara kepatuhan terhadap ketentuan peraturan perundang-undangan di bidang Pelindungan Data Pribadi dan potensi risiko terhadap kepentingan pengawasan sektor jasa keuangan, moneter, sistem pembayaran, dan stabilitas sistem keuangan yang dilakukan
da lamrangka penyelenggaraan negara; - d.
pihak yang mengajukan pengecualian kepada PengendaliData Pribadiadalah Bank Indonesia, Otoritas Jasa Keuangan, dan Lembaga Penjamin Simpanan; dan - e.
memiliki upaya pelindungan untuk mencegah penyalahgunaan, transfer, dan/a tau akses terhadap Data Pribadi secara melawan hukum.
Penerapan pengecualian hak Subjek Data Pribadi untuk kepentingan pengawasan sektor jasa keuangan, moneter, sistem pembayaran, dan stabilitas sistem keuangan yang dilakukan dalam rangka penyelenggaraan negara sebagaimana dimaksud dalam Pasal 148 ayat (1) huruf d dan pengecualian kewajiban Pengendali Data Pribadi untuk kepentingan pengawasan sektor jasa keuangan, moneter, sistem pembayaran, dan stabilitas sistem keuangan yang dilakukan dalam rangka penyelenggaraan negara Pasal 149 ayat (1) huruf d harus memenuhi kriteria:
- a.pemrosesan Data Pribadi diperlukan secara wajar dan dilakukan secara proporsional terbatas untuk memenuhi kepentingan pengawasan sektor jasa keuangan, moneter, sistem pembayaran, dan stabilitas sistem keuangan yang dilakukan dalam rangka penyelenggaraan negara;
- b.memiliki dasar pemrosesan Data Pribadi yang sah dan dapat menunjukkan bahwa pemrosesan Data Pribadi dilakukan sesuai dengan ketentuan peraturan perundang-undangan di bidang Pelindungan Data Pribadi;
- c.melakukan penilaian keseimbangan antara kepatuhan terhadap ketentuan peraturan perundang-undangan di bidang Pelindungan Data Pribadi dan potensi risiko terhadap kepentingan pengawasan sektor jasa keuangan, moneter, sistem pembayaran, dan stabilitas sistem keuangan yang dilakukan dalam rangka penyelenggaraan negara; dan
- d.memiliki upaya pelindungan untuk mencegah penyalahgunaan, transfer, dan/atau akses terhadap Data Pribadi secara melawan hukum.
RPP Pasal 175(d) restricted the financial supervision exception to requests from Bank Indonesia, the Otoritas Jasa Keuangan and the Lembaga Penjamin Simpanan. PP 33/2026 Pasal 153 keeps the necessity, balancing and safeguards criteria and deletes the named list.
The draft closed the financial supervision exception to three named authorities; the enacted text leaves the class open. RPP Pasal 175(d) named Bank Indonesia, OJK and LPS exhaustively, whereas PP 33/2026 Pasal 153 ends at the safeguards limb.
The deletion is systematic rather than sector specific, because Pasal 151 and Pasal 152 drop the same requester limb that RPP Pasal 173(d) and Pasal 174(d) carried for law enforcement and for the public interest. Any body able to characterise its work as pengawasan sektor jasa keuangan, moneter, sistem pembayaran, dan stabilitas sistem keuangan in the conduct of the state can now engage the criteria, subject only to Pasal 149(2), which confines every exception to the implementation of a statute.
For a bank or payment institution the question shifts from who is asking to whether the requester's own statute supports the request.
Test each financial supervision request against the requester's own statutory basis rather than a fixed list of three.
Where Europe stands diverges GDPR Article 23
The provision. GDPR Article 23(1) lets Union or Member State law restrict the rights in Articles 12 to 22 and Article 34, and the Article 5 principles so far as they correspond, but only by a legislative measure that respects the essence of the right and is necessary and proportionate in a democratic society, and only for one of ten listed objectives.
Against Indonesia. GDPR Article 23 assumes two instruments: the Regulation, and a later national law that does the restricting under the GDPR Article 23(2) checklist. Also compared at UU Pasal 50.
Compared at UU Pasal 15, where the full comparison sits.
Cameras in public places gain a purpose and identification limit
Dalam hal pemasangan alat pemroses atau pengolah data visual, Pengendali Data Priba di dan Prosesor Data Pribadi wajib melaksanakan pemrosesan Data Pribadi berdasarkan Peraturan Pemerintah ini.
- a.untuk tujuan keamanan, pencegahan bencana, dan/atau penyelenggaraan lalu lintas atau pengumpulan, analisis, dan pengaturan Informasi lalu lintas;
- b.harus menampilkan Informasi pada area yang telah dipasang alat pemroses atau pengolah data visual; dan
- c.tidak digunakan untuk mengidentifikasi seseorang.
PP 33/2026 Article 17(1) permits installation in public places and public service facilities only for security, disaster prevention or traffic purposes, and forbids use of the device to identify a person. The draft set no list of permitted purposes and contained no non-identification rule, tying use only to the operator's own monitoring purpose at RPP Article 34(2). The signage duty is not new, since RPP Article 35 already imposed it and enacted Article 19 carries it over.
The enacted text introduces two controls the draft never contained. Article 17(1)(a) closes the permitted purposes to security, disaster prevention and traffic management, where RPP Article 34(2) had asked only that the operator consider its own monitoring purpose, and Article 17(1)(c) forbids use of the device to identify a person, a restriction with no draft analogue.
Article 17(2) exempts crime prevention and law enforcement from the information and non-identification limbs while leaving the purpose limitation intact. Facial recognition deployed in a public place for a commercial purpose therefore has no permitted purpose under Article 17(1), which is the sharpest new constraint in this chapter for retail, venue and transport operators.
Audit any public facing camera estate for identification features and map each deployment to Article 17(1)(a).
Where Europe stands diverges GDPR Articles 5, 6, 9, 13, 35
Controller instruction to a processor need no longer be written
RPP Pasal 155(2) required the controller's instruction to be delivered secara tertulis dan terdokumentasi. PP 33/2026 Pasal 139(2) requires only that the instruction be terdokumentasi and executed in line with the controller and processor agreement.
The draft required both a written form and a record; the enacted text keeps only the record. RPP Pasal 155(2) coupled tertulis to terdokumentasi as a free-standing rule, whereas PP 33/2026 Pasal 139(2) drops the written form and recasts the clause as an attribute of the kewajiban in ayat (1).
A ticket entry or call log can now satisfy Pasal 139(2), which weakens the position of a processor later asked to prove that it acted on instruction, and matters directly under the new liability rule in ayat (3). The evidential burden shifts to whatever documentation system the parties happen to operate.
Keep instructions in writing anyway and name the documented channel in the Pasal 14 agreement.
Where Europe stands diverges GDPR Article 28
The provision. GDPR Article 28(1) lets a controller use only processors that provide sufficient guarantees of appropriate technical and organisational measures.
Against Indonesia. UU Pasal 51 reaches the same allocation of responsibility, then parts company with Article 28 on two mechanisms. Also compared at UU Pasal 52.
Compared at UU Pasal 51, where the full comparison sits.
DPIA mitigation and documentation lose the wajib marker
- a.deskripsi
secara sistematismengenai kegiatan pemrosesan Data Pribadi dan tujuan pemrosesan Data Pribadi, termasuk kepentingan dari Pengendali Data Pribadidaripemrosesanini; - b.penilaian kebutuhan dan proporsionalitas antara tujuan dan kegiatan pemrosesan Data Pribadi;
- c.penilaian risiko terhadap
pelindunganhak Subjek Data Pribadi; dan - d.langkah
yang digunakanPengendali Data Pribadi untuk melindungi Subjek Data Pribadi dari risiko pemrosesan Data Pribadi.
- a.deskripsi mengenai kegiatan pemrosesan Data Pribadi dan tujuan pemrosesan Data Pribadi, termasuk kepentingan dari Pengendali Data Pribadi atas pemrosesan Data Pribadi;
- b.penilaian kebutuhan dan proporsionalitas antara tujuan dan kegiatan pemrosesan Data Pribadi;
- c.penilaian risiko terhadap hak Subjek Data Pribadi; dan
- d.langkah Pengendali Data Pribadi untuk melindungi Subjek Data Pribadi dari risiko pemrosesan Data Pribadi.
RPP Pasal 128(5) and (6) used wajib for implementing the identified mitigation measures and for documenting the assessment. PP 33/2026 Pasal 121(3) and (4) state both in the plain indicative, and Pasal 121(2)(a) also drops secara sistematis from the description requirement.
The obligation to conduct the assessment survived; the obligation to act on it did not. PP 33/2026 Pasal 120(1) keeps wajib for carrying out the penilaian dampak, while Pasal 121(3) removes wajib from the step that gives the assessment effect, namely implementing the protective measures identified at ayat (2) huruf d. A controller can therefore satisfy the surviving wajib by producing an assessment it never implements.
The deletion of secara sistematis from Pasal 121(2)(a) compounds this, since the description of processing no longer has to be methodical, leaving the enacted DPIA weaker on both rigour and follow-through than RPP Pasal 128.
Track DPIA mitigations to closure internally; the enacted text no longer compels implementation.
Where Europe stands diverges GDPR Articles 35, 36
The provision. GDPR Article 35(1) requires a data protection impact assessment before processing likely to result in a high risk to rights and freedoms, in particular where new technologies are used.
Against Indonesia. The seven triggers at UU Pasal 34 ayat (2) do not track GDPR Article 35(3), which names three.
Compared at UU Pasal 34, where the full comparison sits.
DPO appointment triggers become alternative not cumulative
- a.pemrosesan Data Pribadi untuk kepentingan pelayanan publik;
- b.kegiatan inti Pengendali Data Pribadi memiliki sifat, ruang lingkup,
dan/atautujuan yang memerlukan pemantauan secara teratur dan sistematis atas Data Pribadi dengan skala besar;dan - c.kegiatan inti Pengendali Data Pribadi terdiri dari pemrosesan Data Pribadi dalam skala besar untuk Data Pribadi yang bersifat spesifik dan/atau Data Pribadi yang berkaitan dengan tindak pidana.
- a.pemrosesan Data Pribadi untuk kepentingan pelayanan publik;
- b.kegiatan inti Pengendali Data Pribadi memiliki sifat, ruang lingkup, atau tujuan yang memerlukan pemantauan secara teratur dan sistematis atas Data Pribadi dengan skala besar; dan/atau
- c.kegiatan inti Pengendali Data Pribadi terdiri dari pemrosesan Data Pribadi dalam skala besar untuk Data Pribadi yang bersifat spesifik dan/atau Data Pribadi yang berkaitan dengan tindak pidana.
RPP Pasal 165(1) joined the three appointment triggers with dan, requiring all three to be met at once. PP 33/2026 Pasal 142(1) joins them with dan/atau, so any single trigger suffices.
The draft's conjunction made the appointment duty nearly unreachable, and it tracked UU 27/2022 Pasal 53(1), which also closes limb b with dan, so the enacted text departs from the statute it implements. RPP Pasal 165(1) huruf b closed with dan, meaning public service processing, large-scale systematic monitoring and large-scale specific or criminal data all had to coincide, whereas PP 33/2026 Pasal 142(1) huruf b closes with dan/atau.
Public bodies processing for public services now fall within the duty on that ground alone, as does a controller running large-scale systematic monitoring. The population of controllers required to appoint a PPDP expands sharply against the draft, and Pasal 142(2) leaves the detail of the duty to a Peraturan Lembaga.
Re-run the appointment test on each limb separately because the cumulative reading no longer holds.
Where Europe stands ported from the GDPR GDPR Article 37
The provision. GDPR Article 37(1) requires a controller or processor to designate a data protection officer in three cases.
Against Indonesia. The tracking is limb for limb: UU Pasal 53 ayat (1) huruf b carries the Article 37(1)(b) formula intact, with kegiatan inti and sifat, ruang lingkup, dan/atau tujuan sitting where core activities and nature, scope and/or purposes sit, huruf c carries Article 37(1)(c) down to the criminal offence category, ayat (2) follows Article 37(5) in the same order and ayat (3) is Article 37(6).
Compared at UU Pasal 53, where the full comparison sits.
DPO loses the direct reporting line to the authority
- a.memberikan rekomendasi dan saran kepada unit, pejabat, atau pihak yang bertanggung jawab dalam keamanan pemrosesan Data Pribadi yang diproses oleh Pengendali Data Pribadi agar penyelenggaraan keamanan pemrosesan Data Pribadi sesuai dengan ketentuan peraturan perundang-undangan;
- b.melakukan upaya yang dibutuhkan untuk memastikan unit, pejabat, atau pihak yang bertanggung jawab dalam keamanan pemrosesan Data Pribadi yang diproses oleh Pengendali Data Pribadi menerapkan langkah teknis dan operasional yang turut mempertimbangkan pelindungan hak dan kebebasan Subjek Data Pribadi; dan
- c.melaporkan kinerja unit, pejabat, atau pihak yang bertanggung jawab dalam keamanan pemrosesan Data Pribadi kepada
direksi dan/ata u Lembaga PDP dalam hal Pejabat PelindungData Pribadimenilaiunit, pejabat,ataupihak tersebuttelah atau tidak menerapkanlangkah teknis dan operasionalyang turutmempertimbangkan pelindungan Subjek Data Pribadi sesuai kebutuhan Pengendali Data Pribadi.
- a.memberikan rekomendasi dan saran kepada unit, pejabat, atau pihak yang bertanggung jawab dalam keamanan pemrosesan Data Pribadi yang diproses oleh Pengendali Data Pribadi agar penyelenggaraan keamanan pemrosesan Data Pribadi sesuai dengan ketentuan peraturan perundang-undangan;
- b.melakukan upaya yang dibutuhkan untuk memastikan unit, pejabat, atau pihak yang bertanggung jawab dalam keamanan pemrosesan Data Pribadi yang diproses oleh Pengendali Data Pribadi menerapkan langkah teknis dan operasional yang turut mempertimbangkan pelindungan hak dan kebebasan Subjek Data Pribadi; dan
- c.melaporkan kinerja unit, pejabat, atau pihak yang bertanggung jawab dalam keamanan pemrosesan Data Pribadi kepada pemimpin di internal Pengendali Data Pribadi mengenai penilaian unit, pejabat, dan/atau pihak tersebut terhadap penerapan langkah teknis dan operasional dengan mempertimbangkan pelindungan Subjek Data Pribadi sesuai kebutuhan Pengendali Data Pribadi.
RPP Pasal 169(2)(c) allowed the officer to report the performance of the unit responsible for processing security to the board and/or to the Lembaga PDP. PP 33/2026 Pasal 147(2)(c) directs that report to internal leadership only.
The draft gave the officer an external escalation route; the enacted text closes it. RPP Pasal 169(2)(c) read direksi dan/atau Lembaga PDP, whereas PP 33/2026 Pasal 147(2)(c) reads pemimpin di internal Pengendali Data Pribadi. Combined with the loss of the dismissal protection at Pasal 146(1)(c), an officer who finds security measures inadequate must escalate inside the organisation that employs them, with no channel of their own to the regulator.
Inadequate security now reaches the Lembaga only through the controller's own breach and documentation duties under Pasal 114 and Pasal 116.
Log escalations internally with dates because the internal record is now the only trace.
Where Europe stands ported from the GDPR GDPR Articles 38, 39
The provision. GDPR Article 39(1) gives the officer at least five tasks: informing and advising the controller, processor and staff who process; monitoring compliance with the GDPR and with internal policies, including allocation of responsibilities, awareness raising, training and audits; advising on a data protection impact assessment and monitoring its performance under Article 35; cooperating with the supervisory authority; and acting as its contact point, including for prior consultation under Article 36.
Against Indonesia. UU Pasal 54 ayat (1) is Article 39(1) in the same order with the last two limbs folded into one: huruf a is Article 39(1)(a), huruf b is Article 39(1)(b), huruf c sits where Article 39(1)(c) sits, and huruf d merges cooperation with the authority and the contact point role from Article 39(1)(d) and (e), with paling sedikit doing the work of at least in the chapeau.
Compared at UU Pasal 54, where the full comparison sits.
DPO protection against dismissal replaced by non-interference
- a.memastikan
Pejabat Petugas Pelindung Data Pribaditerlibat,dengan benar dan te pat waktu,dalam semuamasalah yang berkaitan denganpemrosesan Data Pribadi; - b.memastikan
Pejabat Petugas Pelindung Data Pribadimemiliki akses pelaporan ke tingkat manajemen tertinggi; - c.memastikan
Pejabat Petugas Pelindung Data Pribadiberoperasi secara objektif dantidak diberhentikan atau dihukum karenamenjalankan tugasnya sesuai dengan ketentuan peraturan perundang-undangan; - d.menyediakan sumber daya yang memadai untuk memungkinkan
Pejabat Petugas Pelindung Data Pribadimemenuhi tugasnya dan mempertahankan tingkat keahliannya; - e.memastikan
Pejabat Petugas Pelindung Data Pribadimendapatkan akses yang sesuai dengan aktivitas pemrosesan; - f.memberikan akses yang sesuai ke layanan lainnya untuk mendapatkan informasi penting yang berkaitan dengan pemrosesan Data Pribadi;
- g.meminta saran dari
Pejabat Petugas Pelindung Data Pribadipada saat melakukan penilaian dampak Pelindungan Data Pribadi; dan - h.mendokumentasikan detail
dankegiatandari Pejabat Petugas Pelindung Data Pribadi.
- a.memastikan PPDP terlibat dalam semua kegiatan pemrosesan Data Pribadi;
- b.memastikan PPDP memiliki akses pelaporan ke tingkat manajemen tertinggi;
- c.memastikan PPDP beroperasi secara objektif, tidak diintervensi, dan independen dalam menjalankan tugasnya sesuai dengan ketentuan peraturan perundang-undangan;
- d.menyediakan sumber daya yang memadai untuk memungkinkan PPDP memenuhi tugasnya dan mempertahankan tingkat keahliannya;
- e.memastikan PPDP mendapatkan akses yang sesuai dengan aktivitas pemrosesan Data Pribadi;
- f.memberikan akses yang sesuai ke layanan lainnya untuk mendapatkan Informasi penting yang berkaitan dengan pemrosesan Data Pribadi;
- g.meminta saran dari PPDP pada saat melakukan penilaian dampak Pelindungan Data Pribadi; dan
- h.mendokumentasikan secara detail kegiatan pelaksanaan tugas PPDP.
RPP Pasal 168(1)(c) required the controller to ensure the officer was not dismissed or punished for carrying out the role. PP 33/2026 Pasal 146(1)(c) requires instead that the officer operate objectively, free from intervention and independently.
The draft protected the officer's tenure; the enacted text protects the officer's conduct. RPP Pasal 168(1)(c) named diberhentikan atau dihukum, a concrete employment consequence, whereas PP 33/2026 Pasal 146(1)(c) substitutes tidak diintervensi dan independen, which speaks to interference in the task rather than to retaliation for completing it.
Dismissal following an unwelcome recommendation is no longer expressly prohibited, so the officer's remedy sits in employment law rather than in the data protection instrument. The independence guarantee is genuine but far harder to evidence than a tenure rule.
Write the no-dismissal-for-performing-the-role term into the officer's engagement contract.
Where Europe stands ported from the GDPR GDPR Articles 38, 39
The provision. GDPR Article 39(1) gives the officer at least five tasks: informing and advising the controller, processor and staff who process; monitoring compliance with the GDPR and with internal policies, including allocation of responsibilities, awareness raising, training and audits; advising on a data protection impact assessment and monitoring its performance under Article 35; cooperating with the supervisory authority; and acting as its contact point, including for prior consultation under Article 36.
Against Indonesia. UU Pasal 54 ayat (1) is Article 39(1) in the same order with the last two limbs folded into one: huruf a is Article 39(1)(a), huruf b is Article 39(1)(b), huruf c sits where Article 39(1)(c) sits, and huruf d merges cooperation with the authority and the contact point role from Article 39(1)(d) and (e), with paling sedikit doing the work of at least in the chapeau.
Compared at UU Pasal 54, where the full comparison sits.
Data demands may now be signed far down the command chain
- a.nama dan jabatan penyidik, penuntut umum, atau hakim;
- b.identitas pihak yang terindikasi sebagai tersangka atau terdakwa;
- c.uraian singkat tindak pidana yang disangkakan atau didakwakan;
- d.jenis Data Pribadi yang diminta;
- e.jangka waktu pemrosesan Data Pribadi;
dan - f.pernyataan telah memiliki mekanisme pelindungan
d anpengamanan yang layak dan memadai dalam memproses Data Pribadi.
- a.
laporan polisi dan surat perintah penyelidikan dan/atau penyidikan; - b.
surat penunjukan sebagai penuntut umum; atau - c.
surat penetapan majelis hakim.
- a.kepala Kepolisian Negara Republik Indonesia
ataukepala kepolisian daerah dalam hal permintaan diajukan olehpenyelidik danpenyidik dari Kepolisian Negara Republik Indonesia; - b.pimpinan instansi atau
lemb agadalam hal permintaan diajukan olehpenyelidik dan/ataupenyidik selainpenyelidik dan/ataupenyidik Kepolisian Negara Republik Indonesia; - c.Jaksa Agung
ataukepala kejaksaan tinggi dalam hal permintaan diajukan oleh jaksapenyidikdan/atau penuntut umum; atau - d.
hakimketuamajelisyang memeriksa perkara yang bersangkutan dalam hal permintaan diajukan oleh hakim.
- a.nama dan jabatan penyidik, penuntut umum, atau hakim;
- b.identitas pihak yang terindikasi sebagai tersangka atau terdakwa;
- c.uraian singkat tindak pidana yang disangkakan atau didakwakan;
- d.jenis Data Pribadi yang diminta dan relevansinya dengan penanganan dalam perkara tindak pidana Pelindungan Data Pribadi;
- e.jangka waktu pemrosesan Data Pribadi;
- f.pernyataan telah memiliki dan menerapkan mekanisme pelindungan dan pengamanan yang layak dan memadai dalam memproses Data Pribadi sesuai dengan ketentuan peraturan perundang-undangan di bidang Pelindungan Data Pribadi; dan
- g.dasar kewenangan untuk meminta Data Pribadi.
- a.Kepala Kepolisian Negara Republik Indonesia, kepala kepolisian daerah, kepala kepolisian resor, atau pejabat yang ditunjuk dalam hal permintaan diajukan oleh penyidik dari Kepolisian Negara Republik Indonesia;
- b.pimpinan instansi atau lembaga, atau penjabat yang ditunjuk dalam hal permintaan diajukan oleh penyidik selain penyidik Kepolisian Negara Republik Indonesia;
- c.Jaksa Agung, kepala kejaksaan tinggi, kepala kejaksaan negeri, kepala cabang kejaksaan negeri, atau pejabat yang ditunjuk dalam hal permintaan diajukan oleh jaksa dan/atau penuntut umum; atau
- d.Ketua Mahkamah Agung, ketua pengadilan tinggi, atau ketua pengadilan negeri yang memeriksa perkara yang bersangkutan dalam hal permintaan diajukan oleh hakim.
RPP Pasal 177(5) confined signature to the national or provincial police chief, the head of the requesting agency, the Attorney General or a high prosecution office head, and the presiding judge of the panel. PP 33/2026 Pasal 155(4) adds the district police chief, the district and branch prosecution heads, and in every limb a pejabat yang ditunjuk, while moving the judicial signature from the presiding judge to the Supreme Court, high court or district court chair.
The draft reserved the police and prosecution demand to a small set of senior offices; the enacted text pushes it down to district level and to any designated official. RPP Pasal 177(5)(a) stopped at kepala kepolisian daerah, whereas PP 33/2026 Pasal 155(4)(a) adds kepala kepolisian resor and the open ended atau pejabat yang ditunjuk, with the same designation clause repeated for other investigating agencies at ayat (4)(b) and for prosecutors at ayat (4)(c).
The volume of validly signed demands a controller may receive rises accordingly. Two changes cut the other way and neither closes the gap. Pasal 155(1) drops penyelidik from the officers who may ask, and Pasal 155(2)(g) requires the demand to state the basis of the authority relied on, which partly replaces the police report and warrants that RPP Pasal 177(4) required and the enacted text no longer does.
The copy to the pimpinan Lembaga under Pasal 155(5) remains the only external check.
Build a verification workflow for district-level demands and treat the Pasal 155(5) copy as the audit trail.
Where Europe stands diverges GDPR Article 23
The provision. GDPR Article 23(1) lets Union or Member State law restrict the rights in Articles 12 to 22 and Article 34, and the Article 5 principles so far as they correspond, but only by a legislative measure that respects the essence of the right and is necessary and proportionate in a democratic society, and only for one of ten listed objectives.
Against Indonesia. GDPR Article 23 assumes two instruments: the Regulation, and a later national law that does the restricting under the GDPR Article 23(2) checklist. Also compared at UU Pasal 50.
Compared at UU Pasal 15, where the full comparison sits.
Duty to explain a refusal after legal dissolution is deleted
- a.
Pengendali Data Pribadi lama sebelum Pengendali Data Pribadi lama mengirimkan pemberitahuan bahwa terjadi transaksi penggabungan, pemisahan, pengambilalihan, peleburan, atau pembubaran badan hukum; - b.
Pengendali Data Pribadi lama setelah Pengendali Data Pribadi lama mengirimkan pemberitahuan bahwa terjadi transaksi penggabungan, pemisahan, pengambilalihan, peleburan, ata u pembubaran badan hukum namun sebelum Pengendali Data Pribadi baru mengirimkan pemberitahuan bahwa terjadi transaksi penggabungan, pemisahan, pengambilalihan, peleburan, atau pembubaran badan hukum; atau - c.
Pengendali Data Pribadi baru setelah Pengendali Data Pribadi baru mengirimkan pemberitahuan bahwa terjadi transaksi penggabungan, pemisahan, pengambilalihan, peleburan, atau pembubaran badan hukum.
- a.
Pengendali Data Pribadi yang melakukan pembubaran, sebelum pemberitahuan pembubaran dikirimkan oleh Pengendali Data Pribadi kepada Subjek Data Pribadi; atau - b.
Pejabat Petugas Pelindung Data Pribadi atau narahubung eksternal yang ditunjuk Pengendali Data Pribadi dalam hal Pengendali Data Pribadi yang melakukan pembubaran telah mengirimkan pemberitahuan.
The enacted text carries nothing in its place.
RPP Pasal 153(4) required the appointed officer or external contact to explain the basis of a refusal where a subject right could not be honoured because the controller had been legally dissolved. PP 33/2026 Pasal 137 carries no equivalent.
The draft closed the loop on rights that die with the entity; the enacted text leaves it open. RPP Pasal 153(4) attached an explanation duty to the officer or external contact, whereas PP 33/2026 Pasal 137(2) stops at naming the two controllers to whom a request may be addressed.
Read with the discretionary appointment at Pasal 136(2), a subject facing a dissolved controller has neither a guaranteed addressee nor a right to reasons. This is the sharpest gap the corporate-actions bagian now leaves.
Record refusal reasons in the winding-up file regardless; a complaint to the Lembaga will still ask for them.
This finding cites no article of the enacted text, so there is no implementing provision to carry a comparison. The subject is treated in the reading pages.
Duty to hand data to investigators loses wajib and lawfulness test
RPP Pasal 178(1) obliged the controller or processor to hand over data wajib and only on a permintaan yang sah. PP 33/2026 Pasal 157(1) states that the controller or processor memberikan the data on a request under Pasal 155, with neither the mandatory verb nor the lawfulness qualifier.
The draft framed disclosure as a duty owed on a lawful request; the enacted text states it as a description of what happens. RPP Pasal 178(1) used wajib memberikan and permintaan yang sah, whereas PP 33/2026 Pasal 157(1) reads memberikan atas permintaan Data Pribadi and cross-refers to Pasal 155 as a whole.
Losing yang sah removes the express hook for refusing a defective demand, and losing wajib leaves the disclosure in the indicative, though the sanction position is unchanged, since RPP Pasal 213(1) omitted Pasal 178 and PP Pasal 184(1) omits Pasal 157. The enacted text also drops penyelidik from the officers who may demand, so compliance turns entirely on whether a demand from a penyidik, penuntut umum or hakim meets the Pasal 155 formalities.
Test every demand against each limb of Pasal 155 because Pasal 157 no longer states a lawfulness condition.
Where Europe stands diverges GDPR Article 23
The provision. GDPR Article 23(1) lets Union or Member State law restrict the rights in Articles 12 to 22 and Article 34, and the Article 5 principles so far as they correspond, but only by a legislative measure that respects the essence of the right and is necessary and proportionate in a democratic society, and only for one of ten listed objectives.
Against Indonesia. GDPR Article 23 assumes two instruments: the Regulation, and a later national law that does the restricting under the GDPR Article 23(2) checklist. Also compared at UU Pasal 50.
Compared at UU Pasal 15, where the full comparison sits.
Exception letter may now come from one body instead of two
Penerapan pengecualian hak Subjek Data Pribadi untuk kepentingan pertahanan dan keamanan nasional sebagaimana dimaksud dalam Pasal 170 ayat (1) huruf a dan pengecualian kewajiban Pengendali Data Pribadi untuk kepentingan pertahanan dan keamanan nasional sebagaimana dimaksud dalam Pasal 171 ayat (1) huruf a harus memenuhi kriteria:
- a.pemrosesan Data Pribadi diperlukan secara wajar dan dilakukan secara proporsional terbatas untuk memenuhi kepentingan pertahanan dan keamanan nasional
yang mendesak; - b.memiliki dasar pemrosesan Data Pribadi yang sah dan dapat menunjukkan bahwa pemrosesan Data Pribadi dilakukan sesuai dengan ketentuan peraturan perundang-undangan di bidang Pelindungan Data Pribadi;
- c.melakukan penilaian keseimbangan antara kepatuhan terhadap ketentuan peraturan perundang-undangan di bidang Pelindungan Data Pribadi dan potensi risiko terhadap pertahanan dan keamanan nasional;
- d.mendapatkan surat keterangan dari Lembaga
PDP dankementerian yang menyelenggarakan urusan pemerintahan di bidang pertahanan dankea manan yang menyatakan bahwa Pengendali Data Pribadi mendapatkan pengecualian terhadap ketentuan pemrosesan Data Pribadi tertentu yang dilakukan berkaitan dengan pertahanandankeamanan nasional; - e.
pihak yang mengajukan pengecualian kepada Pengendali Data Pr ibadi ialah Kementerian atau Lembaga yang menjalankan pelaksanaan Undang - Undang; dan - f.memiliki upaya pelindungan untuk mencegah penyalahgunaan, transfer, dan/atau akses terhadap Data Pribadi secara melawan hukum.
Penerapan pengecualian hak Subjek Data Pribadi untuk kepentingan pertahanan dan keamanan nasional sebagaimana dimaksud dalam Pasal 148 ayat (1) huruf a dan pengecualian kewajiban Pengendali Data Pribadi untuk kepentingan pertahanan dan keamanan nasional sebagaimana dimaksud dalam Pasal 149 ayat (1) huruf a harus memenuhi kriteria:
- a.pemrosesan Data Pribadi diperlukan secara wajar dan dilakukan secara proporsional terbatas untuk memenuhi kepentingan pertahanan dan keamanan nasional;
- b.memiliki dasar pemrosesan Data Pribadi yang sah dan dapat menunjukkan bahwa pemrosesan Data Pribadi dilakukan sesuai dengan ketentuan peraturan perundang-undangan di bidang Pelindungan Data Pribadi;
- c.melakukan penilaian keseimbangan antara kepatuhan terhadap ketentuan peraturan perundang-undangan di bidang Pelindungan Data Pribadi dan potensi risiko terhadap pertahanan dan keamanan nasional;
- d.mendapatkan surat keterangan dari Lembaga atau Kementerian atau lembaga terkait yang menyelenggarakan urusan pemerintahan di bidang pertahanan dan keamanan; dan
- e.memiliki upaya pelindungan untuk mencegah penyalahgunaan, transfer, dan/atau akses terhadap Data Pribadi secara melawan hukum.
RPP Pasal 172(d) required a letter from both the Lembaga PDP and the defence ministry, stating that the controller was exempt from identified processing requirements. PP 33/2026 Pasal 150(d) accepts a letter from the Lembaga or the relevant ministry or agency and drops the content requirement.
The draft made the data protection authority a co-signatory to every defence exception; the enacted text makes it optional. RPP Pasal 172(d) used dan and specified what the letter had to state, whereas PP 33/2026 Pasal 150(d) uses atau twice and is silent on content.
A defence or security body can therefore certify the exception without the Lembaga seeing the case, and the certificate need not identify which requirements are disapplied. The authority's structural check on the widest exception in the instrument is removed at the point where it would have operated.
Ask which body issued the surat keterangan and what it disapplies before relying on a counterparty's exception claim.
Where Europe stands diverges GDPR Article 23
The provision. GDPR Article 23(1) lets Union or Member State law restrict the rights in Articles 12 to 22 and Article 34, and the Article 5 principles so far as they correspond, but only by a legislative measure that respects the essence of the right and is necessary and proportionate in a democratic society, and only for one of ten listed objectives.
Against Indonesia. GDPR Article 23 assumes two instruments: the Regulation, and a later national law that does the restricting under the GDPR Article 23(2) checklist. Also compared at UU Pasal 50.
Compared at UU Pasal 15, where the full comparison sits.
Investigator duty to delete data after use is replaced by a label
RPP Pasal 179 imposed three duties on investigators, prosecutors and judges: specific and proportionate processing that guarantees subject rights, protection and security of the data, and destruction or erasure within the statutory period. PP 33/2026 Pasal 158 replaces all three with a designation of those officers as controllers of the data they process.
The draft regulated the criminal justice recipient directly; the enacted text regulates it by classification. RPP Pasal 179(1) to (3) used wajib three times, including an express pemusnahan dan/atau penghapusan duty, whereas PP 33/2026 Pasal 158(1) declares the officers to be Pengendali Data Pribadi and Pasal 158(2) says the processing follows this regulation.
The controller duty set does reach retention through the Masa Retensi rules, so the substance is not wholly lost, but the article-level deletion duty for case data is. A subject must now locate the obligation inside the general controller chapter rather than in a single provision addressed to prosecutors.
Cite Pasal 158(1) when asking a law enforcement recipient about retention because it is a controller on the enacted text.
Where Europe stands diverges GDPR Article 23
The provision. GDPR Article 23(1) lets Union or Member State law restrict the rights in Articles 12 to 22 and Article 34, and the Article 5 principles so far as they correspond, but only by a legislative measure that respects the essence of the right and is necessary and proportionate in a democratic society, and only for one of ten listed objectives.
Against Indonesia. GDPR Article 23 assumes two instruments: the Regulation, and a later national law that does the restricting under the GDPR Article 23(2) checklist. Also compared at UU Pasal 50.
Compared at UU Pasal 15, where the full comparison sits.
Periodic verification becomes mandatory not a controller judgement
- a.tingkat kebenaran dan/atau ketepercayaan Data Pribadi;
- b.kelengkapan
atributData Pribadi yang dibutuhkan untuk memenuhi tujuan pemrosesan Data Pribadi; - c.jenis atau keseragaman bentuk, tipe, atau format Data Pribadi yang dapat diterima oleh Pengendali Data Pribadi; dan
- d.kebutuhan Pengendali Data Pribadi untuk melakukan verifikasi Data Pribadi secara berkala
atau tidak.
- a.tingkat kebenaran dan/atau ketepercayaan Data Pribadi;
- b.kelengkapan Data Pribadi yang dibutuhkan untuk memenuhi tujuan pemrosesan Data Pribadi;
- c.jenis atau keseragaman bentuk, tipe, atau format Data Pribadi yang dapat diterima oleh Pengendali Data Pribadi; dan
- d.kebutuhan Pengendali Data Pribadi untuk melakukan verifikasi Data Pribadi secara berkala.
RPP Pasal 82(3)(d) listed the need for periodic verification as something the controller assessed, expressly including the option not to verify periodically through the words atau tidak. PP 33/2026 Pasal 69(4) makes periodic or ad hoc verification a standing requirement and Pasal 69(5)(d) drops atau tidak from the same item.
The draft let a controller conclude that periodic verification was unnecessary; the enacted text removes that conclusion from its reach. PP 33/2026 Pasal 69(4) states that verification is carried out secara berkala dan/atau sewaktu-waktu, and Pasal 69(3) adds a prior step of fixing a data quality mechanism or standard, with Pasal 69(8) requiring the results to be documented.
Accuracy has therefore moved from a one-off gate at intake to a maintained control with an evidential trail. A controller with no verification schedule and no recorded quality standard is now non-compliant on the face of Pasal 69 rather than merely unpersuasive.
Publish a data quality standard and a verification schedule and keep the verification records.
Where Europe stands diverges GDPR Articles 5, 16
The provision. GDPR Article 5(1)(d) requires personal data to be accurate and, where necessary, kept up to date.
Against Indonesia. Article 5(1)(d) is purpose relative, so the reasonable steps to erase or rectify are measured against what the data is used for.
Compared at UU Pasal 29, where the full comparison sits.
Police report and court order no longer attach to a data demand
- a.nama dan jabatan penyidik, penuntut umum, atau hakim;
- b.identitas pihak yang terindikasi sebagai tersangka atau terdakwa;
- c.uraian singkat tindak pidana yang disangkakan atau didakwakan;
- d.jenis Data Pribadi yang diminta;
- e.jangka waktu pemrosesan Data Pribadi;
dan - f.pernyataan telah memiliki mekanisme pelindungan
d anpengamanan yang layak dan memadai dalam memproses Data Pribadi.
- a.
laporan polisi dan surat perintah penyelidikan dan/atau penyidikan; - b.
surat penunjukan sebagai penuntut umum; atau - c.
surat penetapan majelis hakim.
- a.kepala Kepolisian Negara Republik Indonesia
ataukepala kepolisian daerah dalam hal permintaan diajukan olehpenyelidik danpenyidik dari Kepolisian Negara Republik Indonesia; - b.pimpinan instansi atau
lemb agadalam hal permintaan diajukan olehpenyelidik dan/ataupenyidik selainpenyelidik dan/ataupenyidik Kepolisian Negara Republik Indonesia; - c.Jaksa Agung
ataukepala kejaksaan tinggi dalam hal permintaan diajukan oleh jaksapenyidikdan/atau penuntut umum; atau - d.
hakimketuamajelisyang memeriksa perkara yang bersangkutan dalam hal permintaan diajukan oleh hakim.
- a.nama dan jabatan penyidik, penuntut umum, atau hakim;
- b.identitas pihak yang terindikasi sebagai tersangka atau terdakwa;
- c.uraian singkat tindak pidana yang disangkakan atau didakwakan;
- d.jenis Data Pribadi yang diminta dan relevansinya dengan penanganan dalam perkara tindak pidana Pelindungan Data Pribadi;
- e.jangka waktu pemrosesan Data Pribadi;
- f.pernyataan telah memiliki dan menerapkan mekanisme pelindungan dan pengamanan yang layak dan memadai dalam memproses Data Pribadi sesuai dengan ketentuan peraturan perundang-undangan di bidang Pelindungan Data Pribadi; dan
- g.dasar kewenangan untuk meminta Data Pribadi.
- a.Kepala Kepolisian Negara Republik Indonesia, kepala kepolisian daerah, kepala kepolisian resor, atau pejabat yang ditunjuk dalam hal permintaan diajukan oleh penyidik dari Kepolisian Negara Republik Indonesia;
- b.pimpinan instansi atau lembaga, atau penjabat yang ditunjuk dalam hal permintaan diajukan oleh penyidik selain penyidik Kepolisian Negara Republik Indonesia;
- c.Jaksa Agung, kepala kejaksaan tinggi, kepala kejaksaan negeri, kepala cabang kejaksaan negeri, atau pejabat yang ditunjuk dalam hal permintaan diajukan oleh jaksa dan/atau penuntut umum; atau
- d.Ketua Mahkamah Agung, ketua pengadilan tinggi, atau ketua pengadilan negeri yang memeriksa perkara yang bersangkutan dalam hal permintaan diajukan oleh hakim.
RPP Pasal 177(4) required a demand to be accompanied by a police report and investigation order, a prosecutor's appointment letter or a panel determination. PP 33/2026 Pasal 155 imposes no attachment requirement and instead adds a self-stated basis of authority at ayat (2)(g).
The draft required documentary proof of authority; the enacted text accepts an assertion of it. RPP Pasal 177(4) used wajib disertai and named the instrument for each class of requester, whereas PP 33/2026 Pasal 155(2)(g) asks only that the dasar kewenangan be stated in the request letter itself.
The controller loses the independent artefact against which a demand could be tested and retains only the signature rule at Pasal 155(4) and the copy to the Lembaga at Pasal 155(5). That residue is thinner than it looks, because Pasal 155(4) extends signing authority down to a kepala kepolisian resor, a kepala kejaksaan negeri and a pejabat yang ditunjuk, where draft Pasal 177(5) stopped at national and provincial heads and at the presiding judge.
Request the underlying order regardless and record it if the requester declines to produce one.
Where Europe stands diverges GDPR Article 23
The provision. GDPR Article 23(1) lets Union or Member State law restrict the rights in Articles 12 to 22 and Article 34, and the Article 5 principles so far as they correspond, but only by a legislative measure that respects the essence of the right and is necessary and proportionate in a democratic society, and only for one of ten listed objectives.
Against Indonesia. GDPR Article 23 assumes two instruments: the Regulation, and a later national law that does the restricting under the GDPR Article 23(2) checklist. Also compared at UU Pasal 50.
Compared at UU Pasal 15, where the full comparison sits.
Preliminary investigators lose the power to demand personal data
- a.nama dan jabatan penyidik, penuntut umum, atau hakim;
- b.identitas pihak yang terindikasi sebagai tersangka atau terdakwa;
- c.uraian singkat tindak pidana yang disangkakan atau didakwakan;
- d.jenis Data Pribadi yang diminta;
- e.jangka waktu pemrosesan Data Pribadi;
dan - f.pernyataan telah memiliki mekanisme pelindungan
d anpengamanan yang layak dan memadai dalam memproses Data Pribadi.
- a.
laporan polisi dan surat perintah penyelidikan dan/atau penyidikan; - b.
surat penunjukan sebagai penuntut umum; atau - c.
surat penetapan majelis hakim.
- a.kepala Kepolisian Negara Republik Indonesia
ataukepala kepolisian daerah dalam hal permintaan diajukan olehpenyelidik danpenyidik dari Kepolisian Negara Republik Indonesia; - b.pimpinan instansi atau
lemb agadalam hal permintaan diajukan olehpenyelidik dan/ataupenyidik selainpenyelidik dan/ataupenyidik Kepolisian Negara Republik Indonesia; - c.Jaksa Agung
ataukepala kejaksaan tinggi dalam hal permintaan diajukan oleh jaksapenyidikdan/atau penuntut umum; atau - d.
hakimketuamajelisyang memeriksa perkara yang bersangkutan dalam hal permintaan diajukan oleh hakim.
- a.nama dan jabatan penyidik, penuntut umum, atau hakim;
- b.identitas pihak yang terindikasi sebagai tersangka atau terdakwa;
- c.uraian singkat tindak pidana yang disangkakan atau didakwakan;
- d.jenis Data Pribadi yang diminta dan relevansinya dengan penanganan dalam perkara tindak pidana Pelindungan Data Pribadi;
- e.jangka waktu pemrosesan Data Pribadi;
- f.pernyataan telah memiliki dan menerapkan mekanisme pelindungan dan pengamanan yang layak dan memadai dalam memproses Data Pribadi sesuai dengan ketentuan peraturan perundang-undangan di bidang Pelindungan Data Pribadi; dan
- g.dasar kewenangan untuk meminta Data Pribadi.
- a.Kepala Kepolisian Negara Republik Indonesia, kepala kepolisian daerah, kepala kepolisian resor, atau pejabat yang ditunjuk dalam hal permintaan diajukan oleh penyidik dari Kepolisian Negara Republik Indonesia;
- b.pimpinan instansi atau lembaga, atau penjabat yang ditunjuk dalam hal permintaan diajukan oleh penyidik selain penyidik Kepolisian Negara Republik Indonesia;
- c.Jaksa Agung, kepala kejaksaan tinggi, kepala kejaksaan negeri, kepala cabang kejaksaan negeri, atau pejabat yang ditunjuk dalam hal permintaan diajukan oleh jaksa dan/atau penuntut umum; atau
- d.Ketua Mahkamah Agung, ketua pengadilan tinggi, atau ketua pengadilan negeri yang memeriksa perkara yang bersangkutan dalam hal permintaan diajukan oleh hakim.
RPP Pasal 177(1) empowered penyelidik, penyidik, penuntut umum and hakim to demand personal data from a controller or processor. PP 33/2026 Pasal 155(1) removes penyelidik and conditions the power on the prevailing legislation.
The draft reached the preliminary inquiry stage; the enacted text starts at formal investigation. RPP Pasal 177(1) listed penyelidik first, whereas PP 33/2026 Pasal 155(1) begins at penyidik and adds sesuai dengan ketentuan peraturan perundang-undangan, with the signature list at Pasal 155(4)(a) likewise naming only penyidik. A controller served with a demand issued in a penyelidikan therefore has a textual basis to refuse.
The framing also moves from pemeriksaan to penanganan of a personal data protection offence, which covers the case as a whole rather than the examination stage.
Check the stage of the case because a penyelidik demand has no basis under Pasal 155.
Where Europe stands diverges GDPR Article 23
The provision. GDPR Article 23(1) lets Union or Member State law restrict the rights in Articles 12 to 22 and Article 34, and the Article 5 principles so far as they correspond, but only by a legislative measure that respects the essence of the right and is necessary and proportionate in a democratic society, and only for one of ten listed objectives.
Against Indonesia. GDPR Article 23 assumes two instruments: the Regulation, and a later national law that does the restricting under the GDPR Article 23(2) checklist. Also compared at UU Pasal 50.
Compared at UU Pasal 15, where the full comparison sits.
Privacy by default moved inside the security design duty
- a.mempertimbangkan teknologi, biaya implementasi, sifat, ruang lingkup, konteks, dan tujuan pemrosesan Data Pribadi serta risiko yang ditimbulkan oleh pemrosesan Data Pribadi;
- b.memastikan secara baku (default) Data Pribadi yang diproses terbatas hanya pada Data Pribadi yang diperlukan untuk tujuan pemrosesan Data Pribadi; dan
- c.melakukan evaluasi risiko dan tindakan pencegahan yang diperlukan untuk melindungi Data Pribadi secara berkala dan konsisten.
RPP Pasal 130(3) stated privacy by default as its own wajib, a free standing duty to implement organisational and technical measures ensuring default minimisation. PP 33/2026 Pasal 124(2)(b) restates the same requirement as one of three things a controller harus do when preparing the technical operational measures required by Pasal 123(1)(a).
Default minimisation survives in substance and changes its enforcement route. Pasal 124(2)(b) still requires the controller to ensure by default that the data processed is limited to what the purpose needs, but it now hangs off Pasal 123(1)(a), and it is Pasal 123 ayat (1), not Pasal 124, that appears in the administrative sanction list at Pasal 184(1).
Pasal 124(1) extends the design window, running the measures dari tahapan perencanaan rather than the draft's tahap pengembangan, and huruf c requires risk evaluation and preventive action secara berkala dan konsisten. The draft was no better placed on enforcement, since RPP Pasal 130 was itself absent from the draft sanction list at Pasal 213(1), so the shift is one of drafting position rather than of whether the duty exists.
Evidence default minimisation inside the Pasal 123 security file, because that is the provision the sanction list reaches.
Where Europe stands diverges GDPR Article 32
The provision. GDPR Article 32(1) requires the controller and the processor to implement technical and organisational measures appropriate to the risk, judged against the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing.
Against Indonesia. Both texts calibrate security to risk and UU Pasal 35 huruf b does the work of GDPR Article 32(2), but the calibration inputs and the addressee both differ.
Compared at UU Pasal 35, where the full comparison sits.
Protection audit moves from optional to a mandatory minimum
- a.
mendokumentasikan seluruh kegiatan pemrosesan Data Pribadi, termasukyangdilakukan oleh Prosesor Data Pribadi; - b.
merespon permintaan informasi dari Lembaga PDP; dan - c.
menunjukkan pemenuhan kepatuhan dan bukti dokumentasi seluruh kegiatan pemrosesan Da ta Pribadi.
- a.menetapkan dan menerapkan langkah teknis dan organisasi yang sesuai untuk memenuhi persyaratan akuntabilitas atau pertanggungjawaban;
- b.mendokumentasikan seluruh kegiatan pemrosesan Data Pribadi;
- c.merespons permintaan Informasi dari Lembaga;
- d.menunjukkan pemenuhan kepatuhan dan bukti dokumentasi seluruh kegiatan pemrosesan Data Pribadi; dan
- e.melakukan audit Pelindungan Data Pribadi secara internal dan eksternal.
RPP Pasal 154(3) said a controller dapat conduct an internal or external protection audit. PP 33/2026 Pasal 138(2)(e) lists internal and external audit among the things a controller paling sedikit harus do, and Pasal 138(2)(a) adds appropriate technical and organisational measures for accountability.
The draft made auditing a permission; the enacted text makes it a floor. RPP Pasal 154(3) used dapat and kept audit outside the accountability list, whereas PP 33/2026 Pasal 138(2) folds it into a five-item minimum introduced by paling sedikit harus and joins internal and external with dan rather than the draft's maupun.
Every controller therefore owes both an internal and an external audit, with no threshold by size, sector or risk. Audit budget and report retention become a standing compliance line rather than a discretionary one.
Schedule both an internal and an external protection audit and retain the reports as accountability evidence.
Where Europe stands ported from the GDPR GDPR Articles 5, 24, 30
The provision. GDPR Article 5(2) makes the controller responsible for the Article 5(1) principles and requires it to be able to demonstrate compliance with them, a pairing the Regulation itself names accountability.
Against Indonesia. Pasal 47 pairs responsibility with the ability to show it, in the same order as Article 5(2).
Compared at UU Pasal 47, where the full comparison sits.
Pseudonymisation and encryption become alternatives not a pair
- a.penyusunan dan penerapan langkah teknis operasional untuk melindungi Data Pribadi dari gangguan pemrosesan Data Pribadi yang bertentangan dengan ketentuan peraturan perundang-undangan.
b. penentuan tingkat keamanan Data Pribadi dengan memperhatikan sifatdanrisiko dari Data Pribadi yang har us dilindungi dalam pemrosesan Data Pribadi.
- a.pseudonimisasi
danenkripsi Data Pribadi; - b.memastikan sistem dan layanan yang digunakan memiliki keamanan Data Pribadi dan ketahanan secara konsisten dalam pemrosesan Data Pribadi;
- c.memastikan sistem dan layanan yang digunakan memiliki kemampuan untuk mengembalikan akses dan ketersediaan Data Pribadi secara tepat waktu dalam hal terjadi insiden fisik atau teknis; dan/atau
- d.memiliki proses untuk melakukan pengujian, evaluasi, dan penilaian secara berkala untuk mengetahui tingkat efektivitas langkah teknis dan operasional sehingga menjamin keamanan pemrosesan.
- a.pemusnahan Data Pribadi secara tanpa hak;
- b.kehilangan, perubahan, atau pembukaan Data Pribadi secara tanpa hak;
- c.akses dari Data Pribadi yang disimpan, dikirim, atau diproses dalam bentuk lain; dan/atau
- d.pelanggaran pemrosesan Data Pribadi.
- a.penyusunan dan penerapan langkah teknis operasional untuk melindungi Data Pribadi dari gangguan pemrosesan Data Pribadi yang bertentangan dengan ketentuan peraturan perundang-undangan; dan
- b.penentuan tingkat keamanan Data Pribadi dengan memperhatikan sifat dan risiko dari Data Pribadi yang harus dilindungi dalam pemrosesan Data Pribadi.
- a.pseudonimisasi, enkripsi Data Pribadi, dan/atau langkah teknis lainnya yang mampu mencegah atau melindungi risiko terjadinya Kegagalan Pelindungan Data Pribadi;
- b.memastikan sistem dan layanan yang digunakan memiliki keamanan Data Pribadi dan ketahanan secara konsisten dalam pemrosesan Data Pribadi;
- c.memastikan sistem dan layanan yang digunakan memiliki kemampuan untuk mengembalikan akses dan ketersediaan Data Pribadi secara tepat waktu dalam hal terjadi insiden fisik atau teknis; dan/atau
- d.memiliki proses untuk melakukan pengujian, evaluasi, dan penilaian secara berkala untuk mengetahui tingkat efektivitas langkah teknis dan operasional sehingga menjamin keamanan pemrosesan Data Pribadi.
- a.pemusnahan Data Pribadi secara tanpa hak;
- b.kehilangan, perubahan, atau pembukaan Data Pribadi secara tanpa hak;
- c.akses dari Data Pribadi yang disimpan, dikirim, atau diproses dalam bentuk lain; dan/atau
- d.pelanggaran pemrosesan Data Pribadi.
RPP Pasal 131(2)(a) required pseudonymisation and encryption together. PP 33/2026 Pasal 123(2)(a) makes them alternatives to each other and to any other technical measure capable of preventing or mitigating the risk of a protection failure.
The change sits inside one limb of a list that was already disjunctive. RPP Pasal 131(2) joined its four items with dan/atau, so a controller could always satisfy the provision through item (b), (c) or (d) without deploying cryptography. What item (a) did was fix the content of the cryptographic route by coupling pseudonimisasi and enkripsi with dan.
PP 33/2026 Pasal 123(2)(a) unbundles that pair and adds an open ended third limb, langkah teknis lainnya yang mampu mencegah atau melindungi risiko terjadinya Kegagalan Pelindungan Data Pribadi, so the one place in the chapter that named a specific control now names none. Pasal 123(5) removes the wajib from the conformity assessment that would have tested the choice, which leaves the adequacy of the measure resting on the controller's own judgement.
Document why the chosen technical measure meets Pasal 123(2)(a) if encryption is not deployed.
Where Europe stands diverges GDPR Article 32
The provision. GDPR Article 32(1) requires the controller and the processor to implement technical and organisational measures appropriate to the risk, judged against the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing.
Against Indonesia. Both texts calibrate security to risk and UU Pasal 35 huruf b does the work of GDPR Article 32(2), but the calibration inputs and the addressee both differ.
Compared at UU Pasal 35, where the full comparison sits.
Record production to the authority drops from wajib to harus
- a.nama dan detail kontak Pengendali Data Pribadi, Pengendali Data Pribadi Bersama, dan/atau Prosesor Data Pribadi;
- b.kontak
Pejabat Pelindung Data Pribadi; - c.sumber pengumpulan dan tujuan pengiriman Data Pribadi;
- d.dasar pemrosesan Data Pribadi;
- e.tujuan pemrosesan Data Pribadi;
- f.jenis Data Pribadi;
- g.kategori Subjek Data Pribadi;
- h.pihak selain Pengendali Data Pribadi yang dapat mengakses Data Pribadi;
- i.pemenuhan hak Subjek Data Pribadi;
- j.pemetaan aliran Data Pribadi;
- k.masa retensi;
dan - l.langkah teknis dan organisasi dalam rangka pengamanan Data Pribadi.
- a.nama dan kontak Prosesor Data Pribadi;
- b.lingkup kegiatan pemrosesan Data Pribadi;
- c.rincian transfer Data Pribadi; dan
- d.deskripsi umum langkah organisasi dan teknis pengamanan Data Pribadi.
- a.nama dan detail kontak Pengendali Data Pribadi, Pengendali Data Pribadi Bersama, dan/atau Prosesor Data Pribadi;
- b.kontak PPDP;
- c.sumber pengumpulan dan tujuan pengiriman Data Pribadi;
- d.dasar pemrosesan Data Pribadi;
- e.tujuan pemrosesan Data Pribadi;
- f.jenis Data Pribadi;
- g.kategori Subjek Data Pribadi;
- h.pihak selain Pengendali Data Pribadi yang dapat mengakses Data Pribadi;
- i.pemenuhan hak Subjek Data Pribadi;
- j.pemetaan aliran Data Pribadi;
- k.Masa Retensi;
- l.langkah teknis dan organisasi dalam rangka pengamanan Data Pribadi; dan
- m.rincian transfer Data Pribadi.
- a.nama dan kontak Prosesor Data Pribadi;
- b.lingkup kegiatan pemrosesan Data Pribadi;
- c.rincian transfer Data Pribadi; dan
- d.deskripsi umum langkah organisasi dan teknis pengamanan Data Pribadi.
RPP Pasal 87(8) placed a wajib on the controller alone to hand over processing records when the authority asked. PP 33/2026 Pasal 74(9) recasts the same duty as harus and extends it to the processor, while Pasal 74(10) adds a further duty on both to make the records available for audit and supervision.
The duty spread across both parties as its deontic marker weakened. PP 33/2026 Pasal 74(9) substitutes harus for wajib and adds dan/atau Prosesor Data Pribadi, so the authority may now demand records directly from a processor rather than only through its controller. Pasal 74(10) is new and converts the obligation from responsive to standing, since records must be available whenever audit or supervision requires them rather than only on request.
Whether harus carries the same sanction exposure as wajib under UU PDP Pasal 57 is unresolved, which makes the extension of the duty the more reliable half of the change.
Hold processing records in a produce-on-demand state and put the same obligation into processor contracts.
Where Europe stands diverges GDPR Article 30
The provision. GDPR Article 30 requires a written register, not a log.
Against Indonesia. Two differences run here, and the exemption is only the visible one.
Compared at UU Pasal 31, where the full comparison sits.
Requester need no longer be a competent law enforcement officer
Penerapan pengecualian hak Subjek Data Pribadi untuk kepentingan proses penegakan hukum sebagaimana dimaksud dalam Pasal 170 ayat (1) huruf b dan pengecualian kewajiban Pengendali Data Pribadi untuk kepentingan proses penegakan hukum sebagaimana dimaksud dalam Pasal 171 ayat (1) huruf b harus memenuhi kriteria:
- a.pemrosesan Data Pribadi diperlukan secara wajar dan dilakukan secara proporsional terbatas untuk memenuhi tujuan penegakan hukum;
- b.memiliki dasar pemrosesan Data Pribadi yang sah dan dapat menunjukkan bahwa
pem rosesanData Pribadi dilakukan sesuai dengan ketentuan peraturan perundang-undangan di bidang Pelindungan Data Pribadi; - c.melakukan penilaian keseimbangan antara kepatuhan terhadap ketentuan peraturan perundang-undangan di bidang Pelindungan Data Pribadi dan potensi risiko terhadap kepentingan proses penegakan hukum;
- d.
pihak yang mengajukan pengecualian kepada Pengendali Data Pribadi adalah aparat penegak hukum yang berwenang menjalankan pelaksanaan Undang - Undang; dan - e.memiliki upaya pelindungan untuk mencegah penyalahgunaan, transfer, dan/atau akses terhadap Data Pribadi secara melawan hukum.
Penerapan pengecualian hak Subjek Data Pribadi untuk kepentingan proses penegakan hukum sebagaimana dimaksud dalam Pasal 148 ayat (1) huruf b dan pengecualian kewajiban Pengendali Data Pribadi untuk kepentingan proses penegakan hukum sebagaimana dimaksud dalam Pasal 149 ayat (1) huruf b harus memenuhi kriteria:
- a.pemrosesan Data Pribadi diperlukan secara wajar dan dilakukan secara proporsional terbatas untuk memenuhi tujuan penegakan hukum;
- b.memiliki dasar pemrosesan Data Pribadi yang sah dan dapat menunjukkan bahwa pemrosesan Data Pribadi dilakukan sesuai dengan ketentuan peraturan perundang-undangan di bidang Pelindungan Data Pribadi;
- c.melakukan penilaian keseimbangan antara kepatuhan terhadap ketentuan peraturan perundang-undangan di bidang Pelindungan Data Pribadi dan potensi risiko terhadap kepentingan proses penegakan hukum; dan
- d.memiliki upaya pelindungan untuk mencegah penyalahgunaan, transfer, dan/atau akses terhadap Data Pribadi secara melawan hukum.
RPP Pasal 173(d) required the party invoking the law enforcement exception before a controller to be a law enforcement officer authorised to execute the statute. PP 33/2026 Pasal 151 carries four criteria and no requester-identity limb.
The draft made the identity of the requester a condition of the exception; the enacted text makes it irrelevant. RPP Pasal 173(d) sat between the balancing test and the safeguards limb, whereas PP 33/2026 Pasal 151 runs from necessity through balancing straight to safeguards. The same deletion appears at Pasal 152 for the public interest ground and Pasal 153 for financial supervision, so it is systematic rather than an oversight.
A controller assessing an exception request has lost the one criterion that told it who was entitled to make one.
Verify statutory authority yourself because Pasal 151 no longer requires the requester to hold it.
Where Europe stands diverges GDPR Article 23
The provision. GDPR Article 23(1) lets Union or Member State law restrict the rights in Articles 12 to 22 and Article 34, and the Article 5 principles so far as they correspond, but only by a legislative measure that respects the essence of the right and is necessary and proportionate in a democratic society, and only for one of ten listed objectives.
Against Indonesia. GDPR Article 23 assumes two instruments: the Regulation, and a later national law that does the restricting under the GDPR Article 23(2) checklist. Also compared at UU Pasal 50.
Compared at UU Pasal 15, where the full comparison sits.
Consultation trigger becomes disjunctive not cumulative
Pengendali Data Pribadi yang melakukan penilaian dampak Pelindungan Data Pribadi sebagaimana dimaksud Pasal 128 ayat (1), dapat berkonsultasi kepada Lembaga PDP dalam hal:
- a.pemrosesan
membawakerugianmaterieldan/ataunon-materielpada Subjek Data Pribadi;dan - b.tidak
ada kebijakanteknisdan organisasi yang Pengendali Data Pribadi dapat sediakan untuk meminimalisasi dampak negatif tersebut.
- a.Pemrosesan Data Pribadi menimbulkan kerugian materiil dan/atau imateriil pada Subjek Data Pribadi; dan/atau
- b.tidak tersedianya langkah teknis operasional.
RPP Pasal 129 joined its two consultation grounds with dan, so both had to be satisfied. PP 33/2026 Pasal 122(1) joins them with dan/atau, so either suffices, and recasts limb b from the absence of technical and organisational policy to the absence of langkah teknis operasional.
Access to the authority widened by one conjunction. Under RPP Pasal 129 a controller could consult only where the processing caused loss and no mitigating measures existed, whereas PP 33/2026 Pasal 122(1) permits consultation on either ground alone. The verb remains dapat in both instruments, so neither creates the prior consultation duty that a high-risk processing regime would ordinarily carry, and the Lembaga retains no stated obligation to respond.
Pasal 122(2) then sends the remaining detail of the impact assessment regime to a Peraturan Lembaga, which is where any consultation procedure will actually be built.
Consultation is available on either ground now but remains optional and unanswered; do not plan around it.
Where Europe stands diverges GDPR Articles 35, 36
The provision. GDPR Article 35(1) requires a data protection impact assessment before processing likely to result in a high risk to rights and freedoms, in particular where new technologies are used.
Against Indonesia. The seven triggers at UU Pasal 34 ayat (2) do not track GDPR Article 35(3), which names three.
Compared at UU Pasal 34, where the full comparison sits.
Disclosure gateway for camera recordings is deleted
Pengendali Data Pribadi dapat mengungkap rekaman yang dihasilkan alat pemroses atau pengolah data visual untuk, tetapi tidak terbatas pada tujuan berikut:
- a.
penegakan hukumdaninvestigasi kriminal; - b.
perintah pengadilan;atau - c.
investigasi administratif.
- a.untuk tujuan keamanan, pencegahan bencana, dan/atau penyelenggaraan lalu lintas atau pengumpulan, analisis, dan pengaturan Informasi lalu lintas;
- b.harus menampilkan Informasi pada area yang telah dipasang alat pemroses atau pengolah data visual; dan
- c.tidak digunakan untuk mengidentifikasi seseorang.
RPP Article 36 gave controllers a non-exhaustive gateway to disclose camera recordings for law enforcement and criminal investigation, court order or administrative investigation. PP 33/2026 contains no disclosure provision for visual recordings; Article 17(2) instead exempts crime prevention and law enforcement from the information and non-identification requirements on installation.
The draft gave camera operators an express route to release footage; the enacted text withdraws it. RPP Article 36 was permissive and open-ended, the phrase tetapi tidak terbatas pada extending it beyond the three named purposes, and nothing in PP 33/2026 replaces it. Article 17(2) operates one step earlier, exempting law enforcement contexts from the signage and non-identification limbs of Article 17(1), which concern installation rather than release.
Any disclosure of footage must now be justified under the processing bases in Article 30(3) and the Chapter IV exemptions, which is a higher evidential burden per request than the draft imposed.
Rebuild footage disclosure procedures on Article 30(3) bases with a documented legal basis recorded for each request.
Where Europe stands diverges GDPR Articles 5, 6, 9, 13, 35
Minimisation restated as a three-factor test
Pemrosesan Data Pribadi dilakukan dengan Prinsip Pelindungan Data Pribadi yang meliputi:
- a.pengumpulan Data Pribadi dilakukan secara terbatas dan spesifik, sah secara hukum, dan transparan;
- b.pemrosesan Data Pribadi dilakukan sesuai dengan tujuannya;
- c.pemrosesan Data Pribadi dilakukan dengan menjamin hak Subjek Data Pribadi;
- d.pemrosesan Data Pribadi dilakukan secara akurat, lengkap, tidak menyesatkan, mutakhir, dan dapat dipertanggungjawabkan;
- e.pemrosesan Data Pribadi dilakukan dengan melindungi keamanan Data Pribadi dari pengaksesan yang tidak sah, pengungkapan yang tidak sah, pengubahan yang tidak sah,
penyalahgunaa n,perusakan, dan/atau penghilangan Data Pribadi; - f.pemrosesan Data Pribadi dilakukan dengan memberitahukan tujuan dan aktivitas pemrosesan, serta kegagalan Pelindungan Data Pribadi;
- g.Data Pribadi dimusnahkan dan/atau dihapus setelah masa retensi berakhir
ata uberdasarkan permintaan Subjek Data Pribadi, kecuali ditentukan lain oleh peraturan perundang-undangan; dan - h.pemrosesan Data Pribadi dilakukan secara bertanggung jawab dan dapat dibuktikan secara jelas.
Pemrosesan Data Pribadi sebagaimana dimaksud dalam Pasal 8 dilakukan sesuai dengan prinsip Pelindungan Data Pribadi meliputi:
- a.pengumpulan Data Pribadi dilakukan secara terbatas dan spesifik, sah secara hukum, dan transparan;
- b.pemrosesan Data Pribadi dilakukan sesuai dengan tujuannya;
- c.pemrosesan Data Pribadi dilakukan dengan menjamin hak Subjek Data Pribadi;
- d.pemrosesan Data Pribadi dilakukan secara akurat, lengkap, tidak menyesatkan, mutakhir, dan dapat dipertanggungjawabkan;
- e.pemrosesan Data Pribadi dilakukan dengan melindungi keamanan Data Pribadi dari pengaksesan yang tidak sah, pengungkapan yang tidak sah, pengubahan yang tidak sah, penyalahgunaan, perusakan, dan/atau penghilangan Data Pribadi;
- f.pemrosesan Data Pribadi dilakukan dengan memberitahukan tujuan dan aktivitas pemrosesan Data Pribadi, serta Kegagalan Pelindungan Data Pribadi;
- g.Data Pribadi dimusnahkan dan/atau dihapus setelah Masa Retensi berakhir atau berdasarkan permintaan Subjek Data Pribadi, kecuali ditentukan lain oleh ketentuan peraturan perundang-undangan; dan
- h.pemrosesan Data Pribadi dilakukan secara bertanggung jawab dan dapat dibuktikan secara jelas.
Pengendali Data Pribadi wajib melakukan pemrosesan Data Pribadi secara terbatas dan spesifik, sah secara hukum, dan transparan.
- a.hubungan antara Data Pribadi yang diproses dan tujuan pemrosesan Data Pribadi;
- b.kecukupan Data Pribadi yang diproses untuk mencapai tujuan pemrosesan Data Pribadi; dan
- c.Data Pribadi yang diproses tidak melebihi dari yang dibutuhkan untuk mencapai tujuan pemrosesan Data Pribadi.
RPP Pasal 74(2) stated minimisation as an open standard, processing seminimal mungkin while remaining relevant and adequate to the purpose. PP 33/2026 Pasal 59(2) replaces it with three named factors: the relationship between the data and the purpose, the sufficiency of the data for the purpose, and that the data not exceed what is needed.
The compliance test changed from a superlative to a structure. RPP Pasal 74(2) asked whether processing was as minimal as possible, which is unfalsifiable in practice, while PP 33/2026 Pasal 59(2) asks three answerable questions that map onto relevance, adequacy and necessity.
Pasal 58 also merges the draft's separate duties into one, requiring processing to be terbatas dan spesifik, sah secara hukum, dan transparan in a single wajib, with Pasal 59 and Pasal 60 supplying the definitions of the first and third limbs. The rewrite gives a controller something to document against and gives the Lembaga three specific questions at inspection.
Record the three Pasal 59(2) factors for each data field rather than asserting minimisation.
Where Europe stands diverges GDPR Article 5
The provision. GDPR Article 5(1) sets six processing principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; and integrity and confidentiality.
Against Indonesia. UU Pasal 3 is an asas provision in the Indonesian drafting tradition, addressed to how the statute is read; GDPR Article 5 is addressed to the controller and enforced on its own, in the higher fine tier under GDPR Article 83(5)(a). Also compared at UU Pasal 16, UU Pasal 27.
Compared at UU Pasal 3, where the full comparison sits.
Processor accountability softened to harus but gains an audit duty
- a.
mendokumentasikan seluruh kegiatan pemrosesan Data Pribadi, termasukyangdilakukan oleh Prosesor Data Pribadi; - b.
merespon permintaan informasi dari Lembaga PDP; dan - c.
menunjukkan pemenuhan kepatuhan dan bukti dokumentasi seluruh kegiatan pemrosesan Da ta Pribadi.
Prosesor Data Pribadi wajib bertanggung jawab atas pemrosesan Data Pribadi dan menunjukkan pertanggungiawaban dalam pemenuhan kewajiban sesuai dengan ketentuan peraturan perundang-undangan.
- a.menetapkan dan menerapkan langkah teknis dan organisasi yang sesuai untuk memenuhi persyaratan akuntabilitas atau pertanggungjawaban;
- b.mendokumentasikan seluruh kegiatan pemrosesan Data Pribadi;
- c.merespons permintaan Informasi dari Lembaga;
- d.menunjukkan pemenuhan kepatuhan dan bukti dokumentasi seluruh kegiatan pemrosesan Data Pribadi; dan
- e.melakukan audit Pelindungan Data Pribadi secara internal dan eksternal.
- a.mendokumentasikan seluruh kegiatan pemrosesan Data Pribadi;
- b.merespons permintaan Informasi dari Lembaga;
- c.menunjukkan pemenuhan kepatuhan dan bukti dokumentasi seluruh kegiatan pemrosesan Data Pribadi; dan
- d.melakukan audit.
RPP Pasal 163 stated that the processor wajib bertanggung jawab and show accountability under the prevailing legislation, with no itemised content. PP 33/2026 Pasal 141(1) uses harus and Pasal 141(2) adds a four-item minimum covering documentation, responding to the Lembaga, demonstrating compliance and conducting an audit.
The draft asserted processor accountability; the enacted text operationalises it while softening the verb. PP 33/2026 Pasal 141(2) gives the processor its own documentation, response and audit duties, mirroring the controller list at Pasal 138(2) but stopping at melakukan audit without specifying internal and external and without the technical and organisational measures limb.
The verb moves from wajib to harus, yet neither instrument attaches administrative sanctions to the article, since RPP Pasal 213(1) omitted Pasal 163 and PP 33/2026 Pasal 184(1) omits Pasal 141, so the four items sit outside the sanction list in both. The duty to respond to information requests from the Lembaga is new for processors, the draft binding them only to carry out the authority's orders under RPP Pasal 164.
Have processors document and audit to the Pasal 141(2) list because those four items are what the Lembaga will request.
Where Europe stands ported from the GDPR GDPR Articles 5, 24, 30
The provision. GDPR Article 5(2) makes the controller responsible for the Article 5(1) principles and requires it to be able to demonstrate compliance with them, a pairing the Regulation itself names accountability.
Against Indonesia. Pasal 47 pairs responsibility with the ability to show it, in the same order as Article 5(2). Also compared at UU Pasal 52.
Compared at UU Pasal 47, where the full comparison sits.
Retention definition moves to Pasal 1 and the policy document gains a legal basis item
- a.
definisi periode retensi; - b.
ketentuan retensi arsip dan ketentuan lainnya: - c.Subjek Data Pribadi yang diatur:
- d.komponen Data Pribadi yang diatur:
- e.ketentuan
diidentifikasiuntuk kepentingan statistik dan penelitian; - f.metode pemusnahan secara elektronik dan
non- elektronik; - g.ketentuan untuk Prosesor Data Pribadi;
- h.penanggung jawab;
dan - i.dokumentasi dan pemberitahuan.
- a.definisi dan periode Masa Retensi;
- b.ketentuan Masa Retensi arsip dan ketentuan lainnya;
- c.Subjek Data Pribadi yang diatur;
- d.jenis dan komponen Data Pribadi yang diatur;
- e.ketentuan deidentifikasi, jika digunakan untuk kepentingan statistik dan penelitian ilmiah;
- f.metode pemusnahan secara elektronik dan nonelektronik;
- g.ketentuan untuk Prosesor Data Pribadi;
- h.penanggung jawab;
- i.dokumentasi dan pemberitahuan; dan
- j.dasar hukum pengaturan, jika Masa Retensi karena kewajiban hukum sesuai dengan ketentuan peraturan perundang-undangan.
RPP Pasal 101 carried four things: the definition of masa retensi at ayat (1), the rule at ayat (2) that a period resting on a legal obligation is set by legislation, the bar at ayat (3) on using data held on that footing for other purposes, and the retention policy document at ayat (4) and ayat (5) with nine minimum contents. PP 33/2026 splits them.
The definition sits at PP Pasal 1 angka 23, differing from the draft only in reading adalah for merupakan. The document sits at PP Pasal 75, without the harus of RPP Pasal 101 ayat (4), and with a tenth item at huruf j requiring dasar hukum pengaturan where the Masa Retensi arises from a legal obligation.
The retention period definition was not dropped. PP Pasal 1 angka 23 repeats RPP Pasal 101 ayat (1) almost word for word, adalah for merupakan, so the term is now defined once for the whole regulation instead of inside the retention article, and it reaches every provision that uses it.
What has no counterpart in PP Pasal 75 is RPP Pasal 101 ayat (2) and ayat (3), the rule that retention on a legal obligation is set by legislation and the bar on using data held on that footing for other purposes.
Huruf j picks up part of ayat (2), but as a content item of the policy document rather than a rule of law, and it applies only jika Masa Retensi karena kewajiban hukum. A period justified by pencapaian tujuan pemrosesan alone sits outside huruf j, so the item bites on statutory retention and nothing else.
Two other content items shifted: huruf d now covers jenis dan komponen rather than komponen alone, and huruf e confines deidentifikasi to kepentingan statistik dan penelitian ilmiah, adding the qualifier ilmiah absent from the draft. PP Pasal 75 ayat (1) states the duty in the indicative where the draft used harus.
Read the definition from PP Pasal 1 angka 23, and add a legal basis column to the retention schedule for every period that rests on a statutory obligation, since huruf j reaches those and no others.
Where Europe stands diverges GDPR Article 30
The provision. GDPR Article 30 requires a written register, not a log.
Against Indonesia. Two differences run here, and the exemption is only the visible one.
Compared at UU Pasal 31, where the full comparison sits.
Sub-processor assurance duty falls from wajib to harus
The draft obliged a processor with wajib to ensure that any further processor it involves complies with the Regulation. The enacted Article 15(3) states the same duty with harus, while the written consent requirement at Article 15(2) keeps wajib.
The duty on a processor to police its sub-processor is downgraded in register. Indonesian legislative drafting separates wajib, which marks an obligation, from harus, which marks a directive, and PP 33/2026 Article 15 now uses both within a single article, wajib for the written consent in paragraph (2) and harus for the assurance duty in paragraph (3).
Article 15(2) appears in the sanctions list at Article 184(1); Article 15(3) does not, as RPP Article 22(3) did not appear in RPP Article 213(1). Assurance over sub-processors therefore rests on the contractual route in Article 15(4) and on the controller's residual liability under Article 15(5) rather than on the duty itself.
Push sub-processor assurance into the processing agreement because Article 15(3) alone will not carry it.
Where Europe stands diverges GDPR Article 28
The provision. GDPR Article 28(1) lets a controller use only processors that provide sufficient guarantees of appropriate technical and organisational measures.
Against Indonesia. UU Pasal 51 reaches the same allocation of responsibility, then parts company with Article 28 on two mechanisms.
Compared at UU Pasal 51, where the full comparison sits.
What is inside this theme
20 changes, 14 of which shift an obligation. Pick one, or step through them in order.
Alternative basis carve out on withdrawal is deleted
Draft Pasal 104(2) excused a controller from stopping processing after a withdrawal of consent if it could show another lawful basis applied. Enacted Pasal 92 contains no such exception and instead adds a verification step and a duty to confirm cessation.
The draft's carve-out let a controller answer a withdrawal by re-characterising the processing as contractual necessity or legitimate interests and carrying on. Enacted Pasal 92(1) keeps the obligation to stop, deletes the exception, gates it on verification at Pasal 92(3) and requires the controller to tell the subject that processing has stopped at Pasal 92(4).
Basis switching after a withdrawal therefore has no textual footing, which sits consistently with Pasal 36(2) treating consent evidence as an accountability record and with Pasal 30(2) requiring the basis to be settled before processing begins. A controller relying on consent must choose its basis at the outset rather than after the subject moves.
Fix and record the lawful basis at the point of collection, since you cannot swap out of consent once it is withdrawn.
Where Europe stands diverges GDPR Article 7
The provision. GDPR Article 7(3) gives the data subject the right to withdraw consent at any time.
Against Indonesia. Under GDPR Article 7(3) withdrawal is a unilateral act: the moment it is made the GDPR Article 6(1)(a) basis falls away, and further processing has no lawful ground unless the controller can stand on another GDPR Article 6(1) basis, which is why GDPR Article 17(1)(b) conditions erasure on there being no other legal ground. Also compared at UU Pasal 40.
Compared at UU Pasal 9, where the full comparison sits.
Child identification no longer keyed to child directed services
The draft imposed a wajib duty to take steps to identify service users and expressly extended it to services directed at children or capable of being accessed by children. PP 33/2026 Pasal 38(1) states a harus duty calibrated to the purpose of processing and deletes the child directed and child accessible trigger.
The deleted phrase was the age assurance hook, mirroring the trigger used in the UK Age Appropriate Design Code, and it captured general audience platforms that children reach in practice. Calibrating the duty to the purpose of processing instead lets a controller argue that its purpose does not concern children and therefore requires no identification step, which is circular where the risk arises precisely from unintended child users.
The parental consent duty in Pasal 38(2) keeps wajib, so the substantive obligation survives while the mechanism for knowing when it bites has been weakened.
Keep age assurance on any service children can reach; Pasal 38(1) no longer compels it but Pasal 38(2) still applies.
Where Europe stands ported from the GDPR GDPR Articles 5, 6
The provision. GDPR Article 6(1) makes processing lawful only where one of six bases applies: consent, necessity for a contract or for pre-contractual steps, a legal obligation, vital interests, a task in the public interest or official authority, and legitimate interests.
Against Indonesia. UU Pasal 20 ayat (2) huruf a to f is the six limb list of GDPR Article 6(1)(a) to (f) in the same order, and the transposition shows in the detail. Also compared at UU Pasal 25.
Compared at UU Pasal 20, where the full comparison sits.
Commercial benefit no longer bars the public interest basis
Pengendali Data Pribadi tidak dapat menggunakan kepentingan umum atau pelayanan publik sebagai dasar pemrosesan Data Pribadi jika pemrosesan dilakukan untuk tujuan pemrosesan yang memiliki dampak atau keuntungan komersil bagi Pengendali Data Pribadi.
The enacted text carries nothing in its place.
The draft prohibited use of the public interest or public service basis where the processing carried a commercial impact or benefit for the controller. PP 33/2026 contains no equivalent prohibition anywhere in the lawful bases part.
Pasal 65 of the draft was the anti arbitrage rule that stopped a commercially motivated activity being dressed as public service, and it mattered most for state owned enterprises and licensed operators delivering public services on commercial terms. Its removal means the only remaining filter is Pasal 49(2), which asks whether legislation mandates the action, not who profits from it. Mixed motive processing by a concessionaire now passes the enacted test that the draft would have failed.
Commercial upside no longer defeats the public task basis but it should still be disclosed in the Pasal 50 policy document.
This finding cites no article of the enacted text, so there is no implementing provision to carry a comparison. The subject is treated in the reading pages.
Consent must now be free conscious specific and unambiguous
The draft had no such provision.
The draft barred deceptive consent requests and the conditioning of goods or services on consent but never stated what qualities valid consent must have. PP 33/2026 Pasal 32(2) adds a four part test requiring consent to be obtained freely, consciously, specifically and unambiguously.
The draft regulated the mechanism, the prior information and the proof of consent but never stated what makes the consent itself valid. Pasal 32(2) supplies that test, so a flow that satisfies the mechanism rules in Pasal 34 can still fail because consent was bundled across purposes or inferred from a pre-ticked box.
The draft's own quality controls were narrower and both survive, since RPP Pasal 49(1) barred any reduction in goods or services where consent was refused, now Pasal 35(1), and RPP Pasal 49(5) barred deceptive or misleading requests, now Pasal 35(3). Read with the proof duty in Pasal 36(1) and its accountability framing in Pasal 36(2), the controller must evidence not only that consent was given but that each of the four qualities was present.
Re-test every consent flow against the four qualities and record which design feature evidences each one.
Where Europe stands ported from the GDPR GDPR Articles 5, 6
The provision. GDPR Article 6(1) makes processing lawful only where one of six bases applies: consent, necessity for a contract or for pre-contractual steps, a legal obligation, vital interests, a task in the public interest or official authority, and legitimate interests.
Against Indonesia. UU Pasal 20 ayat (2) huruf a to f is the six limb list of GDPR Article 6(1)(a) to (f) in the same order, and the transposition shows in the detail. Also compared at UU Pasal 21.
Compared at UU Pasal 20, where the full comparison sits.
Legal obligation list turns from exhaustive to illustrative
- a.
ketentuan peraturan perundang-undangan sesuai dengan hierarki yang diatur oleh Undang-Undang; - b.perintah dan/atau putusan pengadilan; atau
- c.perintah
berdasarkankeputusan pejabat tata usaha negara.
- a.perintah dan/atau putusan pengadilan; atau
- b.perintah keputusan pejabat tata usaha negara yang ditetapkan berdasarkan ketentuan peraturan perundang-undangan.
The draft closed the legal obligation basis with an exhaustive dilaksanakan dalam hal list of three sources anchored to the statutory hierarchy. PP 33/2026 Pasal 45(2) opens it with termasuk, keeps two sources and deletes both the hierarchy limb and the draft Pasal 59(3) rule that the obligation need not affect the public interest.
Replacing an exhaustive formula with termasuk converts the enumeration into examples, so the two named sources no longer exhaust what can ground the basis. The hierarchy limb is gone from the list, but Pasal 45(1) still requires the obligation to arise sesuai dengan ketentuan peraturan perundang-undangan, and Pasal 45(2)(b) now requires the administrative decision itself to be established on that footing, so the anchor to legislation survives outside the list.
The clear loss is draft Pasal 59(3), which confirmed that the basis was available for an obligation serving only the subject or the controller with no public interest dimension, and no enacted provision replaces it.
Treat the Pasal 45(2) list as illustrative but record the instrument, its footing in legislation and the specific duty it imposes.
Where Europe stands ported from the GDPR GDPR Articles 5, 6
The provision. GDPR Article 6(1) makes processing lawful only where one of six bases applies: consent, necessity for a contract or for pre-contractual steps, a legal obligation, vital interests, a task in the public interest or official authority, and legitimate interests.
Against Indonesia. UU Pasal 20 ayat (2) huruf a to f is the six limb list of GDPR Article 6(1)(a) to (f) in the same order, and the transposition shows in the detail.
Compared at UU Pasal 20, where the full comparison sits.
Nullity of the contract replaced by loss of the basis
- a.
mendapatkan persetujuanyang sahsecara eksplisit dariSubjek Data Pribadi; - b.
memenuhi langkah -langkah PelindunganData Pribadiyang akan diberikan kepada SubjekData Pribadi; - c.
mempertimbangkan dampak risiko dari pemrosesanData Pribadi kepada Subjek Data Pribadi; - d.mempertimbangkan
keseimbangan kepentingan antaraSubjek Data Pribadi danPengendali Data Pribadi; dan - e.
melaksanakanhak Subjek Data Pribadi dalam pemrosesan Data Pribadi.
- a.
terdapat hak dan/atau kewajiban Pengendali Data Pribadi kepada atau dari Subjek Data Pribadi yang perlu diatur melalui suatuperjanjian; - b.
terdapat perjanjian yang sah sesuai peraturan perundang-undangan; dan - c.
pemrosesan Data Pribadi dibutuhkan oleh Pengendali Data Pribadi untuk melaksanakan perjanjian.
Perjanjian yang digunakan sebagai dasar pemrosesan perjanjian harus mengatur paling sedikit memuat:
- a.rincian tujuan dan penjelasan tujuan pemrosesan Data Pribadi;
- b.keterangan keterkaitan antara tujuan pemrosesan Data Pribadi dan tujuan perjanjian yang akan dipenuhi;
- c.jenis dan karakteristik kebutuhan atau layanan yang akan diberikan kepada Subjek Data Pribadi;
- d.konsekuensi dalam hal pemrosesan Data Pribadi tidak dilakukan oleh Pengendali Data Pribadi;
- e.dampak pemrosesan Data Pribadi terhadap pelindungan hak Subjek Data Pribadi;
- f.jaminan Pengendali Data Pribadi untuk
menjaga keamanan, ketahanan, integritas, ke rahasiaan danPelindungan Data Pribadi; - g.
pihak yang terlibat dalam pemrosesanData Pribadi; dan - h.
dasarpemrosesan Data Pribadilain yang akan digunakan oleh Pengendali Data Pribadi, dalam hal terdapat kegiatan pemrosesan Data Pribadi di luar pemrosesan untuk pemenuhan tujuan perjanjian.
- a.terdapat perjanjian yang sah antara Pengendali Data Pribadi dan Subjek Data Pribadi sesuai dengan ketentuan peraturan perundang-undangan;
- b.terdapat kebutuhan pemrosesan Data Pribadi oleh Pengendali Data Pribadi untuk melaksanakan perjanjian;
- c.terpenuhinya langkah Pelindungan Data Pribadi yang akan diberikan kepada Subjek Data Pribadi;
- d.telah mempertimbangkan dampak risiko dari pemrosesan Data Pribadi kepada Subjek Data Pribadi; dan
- e.telah mempertimbangkan kemampuan untuk memenuhi hak Subjek Data Pribadi dan melaksanakan kewajiban Pengendali Data Pribadi dalam pemrosesan Data Pribadi sesuai dengan ketentuan dalam Peraturan Pemerintah ini.
- a.rincian tujuan dan penjelasan tujuan pemrosesan Data Pribadi;
- b.keterangan keterkaitan antara tujuan pemrosesan Data Pribadi dan tujuan perjanjian yang akan dipenuhi;
- c.hak Subjek Data Pribadi dan kewajiban Pengendali Data Pribadi;
- d.jenis dan karakteristik kebutuhan atau layanan yang akan diberikan kepada Subjek Data Pribadi;
- e.konsekuensi dalam hal pemrosesan Data Pribadi tidak dilakukan oleh Pengendali Data Pribadi;
- f.dampak pemrosesan Data Pribadi terhadap pelindungan hak Subjek Data Pribadi;
- g.jaminan Pengendali Data Pribadi untuk melakukan pemrosesan Data Pribadi sesuai dengan ketentuan peraturan perundang-undangan di bidang Pelindungan Data Pribadi;
- h.jaminan Pengendali Data Pribadi untuk memenuhi hak Subjek Data Pribadi; dan
- i.pihak yang terlibat dalam pemrosesan Data Pribadi.
- a.terbatas untuk memenuhi tujuan tertentu yang disampaikan kepada Subjek Data Pribadi secara eksplisit dan tegas; dan
- b.mempertimbangkan keseimbangan kepentingan Subjek Data Pribadi dengan tujuan pemrosesan Data Pribadi.
The draft declared a non compliant contract void by operation of law. PP 33/2026 Pasal 43(2) instead disqualifies the contract as a lawful basis while leaving the contract itself intact.
The phrase batal demi hukum appears nowhere in the enacted text, which removes a private law consequence that a data protection regulation was poorly placed to impose in the first place. The replacement is confined to data protection effect: the commercial bargain survives and only the processing loses its ground, which converts a contract drafting defect into an unlawful processing exposure under the administrative sanction regime.
The trigger also broadens, because Pasal 43(2) attaches to failure on any of the nine content requirements rather than to the single consent limb.
Audit contracts against all nine items in Pasal 43(1); any gap invalidates the basis rather than the agreement.
Where Europe stands ported from the GDPR GDPR Articles 5, 6
The provision. GDPR Article 6(1) makes processing lawful only where one of six bases applies: consent, necessity for a contract or for pre-contractual steps, a legal obligation, vital interests, a task in the public interest or official authority, and legitimate interests.
Against Indonesia. UU Pasal 20 ayat (2) huruf a to f is the six limb list of GDPR Article 6(1)(a) to (f) in the same order, and the transposition shows in the detail. Also compared at UU Pasal 28.
Compared at UU Pasal 20, where the full comparison sits.
Objection no longer stops legitimate interest processing
- a.
telah melakukan analisis terhadap keperluan, tujuan, dan keseimbangan antara hak Subjek Data Pribadi dan kepentingan Pengendali Data Pribadi dengan hasil analisis menunjukkan bahwa Pengendali Data Pribadi memiliki kepentingan yang sah untuk melakukan pemro sesan Data Pribadi; dan - b.
telah melakukan penilaian bahwa pemrosesan yang menggunakan dasar pemrosesan Data Pribadi pemenuhan kepentingan yang sah lainnya tidak berdampak hukum atau merugikan Subjek Data pribadi dengan hasil Pengendali Data Pribadi memiliki dan telah melakukan langkah untuk mengurangi dampak dari pemrosesan Data Pribadi.
The enacted text carries nothing in its place.
The draft obliged the controller to stop legitimate interest processing when the subject objected. PP 33/2026 carries no counterpart; the objection right in Pasal 93 is confined to decisions based solely on automated processing including profiling.
The draft paired a self assessed basis with a subject held stop switch, which is the structural safeguard that makes legitimate interests tolerable in the GDPR Article 21 model. The enacted text keeps the basis and removes the switch, leaving only withdrawal of consent in Pasal 92, which by definition does not reach processing grounded on legitimate interests.
Combined with the public body extension in Pasal 55, the result is a self certified basis with no subject initiated exit and no time limit.
Do not promise an objection based stop for legitimate interests; the regulation no longer supplies one.
This finding cites no article of the enacted text, so there is no implementing provision to carry a comparison. The subject is treated in the reading pages.
Public bodies gained a basis the draft denied them
Pengendali Data Pribadi yang merupakan Badan Publik tidak dapat menggunakan kepentingan yang sah sebagai dasar pemrosesan Data Pribadi.
A flat prohibition on public bodies relying on legitimate interest became a permission, bounded by Pasal 55(2) to purposes outside the public task.
RPP Pasal 72 closed legitimate interest to public bodies outright. PP Pasal 55(1) opens it, and Pasal 55(2) confines it to purposes other than performing a public-interest task, public service or the exercise of public authority. GDPR Article 6(1)(f) runs the other way, excluding public authorities acting in the performance of their tasks, so Indonesia now permits the basis in the narrow space the GDPR leaves and the draft had sealed.
For a public body the question is no longer whether legitimate interest is available, but whether the purpose sits outside its public task.
Where Europe stands ported from the GDPR GDPR Articles 5, 6
The provision. GDPR Article 6(1) makes processing lawful only where one of six bases applies: consent, necessity for a contract or for pre-contractual steps, a legal obligation, vital interests, a task in the public interest or official authority, and legitimate interests.
Against Indonesia. UU Pasal 20 ayat (2) huruf a to f is the six limb list of GDPR Article 6(1)(a) to (f) in the same order, and the transposition shows in the detail.
Compared at UU Pasal 20, where the full comparison sits.
Public body processing rulebook replaced by a two item policy
- a.
kegiatan pemrosesan Data Pribadi yang dilakukan oleh Badan Publik; - b.
pemberian pemberitahuanpemrosesan Data Pribadi; - c.
unit kerja atau pejabatpadaBadan Publik yang bertindak selaku Pejabat Pelindung Data Pribadi; - d.
informasi tentang penunjukkan Prosesor Data Pribadi dan pihak yang menjadi Prosesor Data Pribadi; - e.
informasi tentang penunjukkan Prosesor Data Pribadi lainnya dan pihak yang menjadi Prosesor Data Pribadi lainnya; - f.
risiko pemrosesan dan upaya mitigasi; dan - g.
klausa wajib yang menyatakan: 1. pemrosesan Data Pribadi sesuai tujuan; 2. pemrosesan Data Pribadi tidak akan mempengaruhi pemberian layanan; dan 3. permintaan penetapan pengadilan dilakukan sebelum pemrosesan Data Pribadi atau setelah pemrosesan Data Pribadi berlangsung dalam hal pelaksanaan pemrosesan Data Pribadi berdampak pada hak asasi manusia.
- a.
menyediakan akses bagi masyarakat untuk mengunduh ketentuan pemrosesan Data Pribadi sebagaimana dimaksud pada ayat (2) tersebut dengan mudah; dan - b.
menyampaikan ketentuan pemrosesan Data Pribadi sebagaimana dimak sud pada ayat (2) kepada Lembaga PDP dalam kesempatan pertama setelah diundangkan.
- a.ruang lingkup pelaksanaan tugas; dan
- b.tujuan pemrosesan Data Pribadi.
The draft required every public body to adopt an internal processing instrument with seven mandatory contents, to publish it for download and to file it with the authority. PP 33/2026 Pasal 50 requires an adequate policy document with two mandatory contents and no publication or filing duty, and it attaches that document to any controller relying on the public task basis under Pasal 49 rather than to Badan Publik as such.
The draft package in Pasal 67 was the accountability spine for state processing: it named the data protection officer, disclosed processors, recorded risk and mitigation, and carried a mandatory clause requiring a court determination where processing affected human rights. All of that content disappears, and with it the two transparency duties that made the instrument checkable, easy public download and filing with the authority at the first opportunity.
What survives at Pasal 50(2) is an internal document of two headings, the scope of the task and the purpose of processing, whose preparation is left to a Peraturan Lembaga under Pasal 50(3) that does not yet exist. The addressee moves as well, because Pasal 50(1) binds any controller acting on the Pasal 49 basis, which brings private bodies exercising a statutory task inside a rule the draft aimed at public bodies alone.
Public bodies should keep the draft's seven headings as internal good practice; nothing in the enacted text compels disclosure.
Where Europe stands ported from the GDPR GDPR Articles 5, 6
The provision. GDPR Article 6(1) makes processing lawful only where one of six bases applies: consent, necessity for a contract or for pre-contractual steps, a legal obligation, vital interests, a task in the public interest or official authority, and legitimate interests.
Against Indonesia. UU Pasal 20 ayat (2) huruf a to f is the six limb list of GDPR Article 6(1)(a) to (f) in the same order, and the transposition shows in the detail.
Compared at UU Pasal 20, where the full comparison sits.
The balancing test became a document nobody has to send
Pengendali Data Pribadi wajib mendokumenta sikan dan menyampaikan hasil analisis dan penilaian sebagaimana dimaksud dalam Pasal 70 ayat (1) kepada Subjek Data Pribadi.
Hasil analisis dan penilaian sebagaimana dimaksud dalam Pasal 53 didokumentasikan oleh Pengendali Data Pribadi.
A duty to document and convey the balancing assessment to the subject became a duty only to document it, disclosed on request under Pasal 56.
Under RPP Pasal 71 the controller had to hand the analysis to the subject as a matter of course. PP Pasal 54 requires only that it be documented, and Pasal 56 makes disclosure contingent on the subject asking for an explanation. The burden shifts from a controller who must tell to a subject who must know to ask, which in practice means the assessment is now read by regulators and litigants rather than by the people it concerns.
Write the balancing assessment for an outside reader. It stays private until the moment it does not.
Where Europe stands ported from the GDPR GDPR Articles 5, 6
The provision. GDPR Article 6(1) makes processing lawful only where one of six bases applies: consent, necessity for a contract or for pre-contractual steps, a legal obligation, vital interests, a task in the public interest or official authority, and legitimate interests.
Against Indonesia. UU Pasal 20 ayat (2) huruf a to f is the six limb list of GDPR Article 6(1)(a) to (f) in the same order, and the transposition shows in the detail.
Compared at UU Pasal 20, where the full comparison sits.
Threatened public interest limb removed from public task basis
Pengendali Data Pribadi dapat menggunakan dasar pemrosesan Data Pribadi berupa pelaksanaan tugas dalam rangka kepentingan umum, pelayanan publik, atau pelaksanaan kewenangan Pengendali Data Pribadi sebagaimana dimaksud dalam Pasal 44 ayat (2) huruf e.
Pemrosesan Data Pribadi berdasarkan pelaksanaan tugas dalam rangka kepentingan umum atau pelayanan publik sebagaimana dimaksud dalam Pasal 63 dilakukan dalam hal:
- a.
melaksanakan ketentuan peraturan perundang - undangan yang memerintahkan Pengendali Da ta Pribadi untuk melakukan suatu tindakan dalam rangka kepentingan umum dan/ataupelayanan publik;dan/atau - b.
terdapat kepentingan publik yang secara langsung terancam jika pemrosesan Data Pribadi tidak dilakukan oleh Pengendali Data Pribadi.
- a.kepentingan umum;
- b.pelayanan publik; atau
- c.pelaksanaan kewenangan, berdasarkan peraturan perundang-undangan.
The draft allowed the public task basis on either of two limbs, a statutory mandate or a directly threatened public interest, joined by dan/atau. PP 33/2026 Pasal 49(2) retains only the statutory mandate limb.
The enacted basis is now purely derivative, existing only where legislation commands the controller to act, which makes the mandate instrument the operative source and the regulation a pointer to it. Emergency style processing that the draft would have grounded on a directly threatened public interest must now find either a statute or the vital interests basis in Pasal 46, whose own conditions were cut from the three in RPP Pasal 61 to two.
The statutory mandate condition also now reaches the exercise of authority limb that the draft left unconditioned, since RPP Pasal 64 applied only to kepentingan umum and pelayanan publik while Pasal 49(2) governs all three limbs of ayat (1). How the basis operates in practice is left to a Peraturan Lembaga under Pasal 52.
Cite the specific legislative provision that commands the action; a general public interest rationale no longer qualifies.
Where Europe stands ported from the GDPR GDPR Articles 5, 6
The provision. GDPR Article 6(1) makes processing lawful only where one of six bases applies: consent, necessity for a contract or for pre-contractual steps, a legal obligation, vital interests, a task in the public interest or official authority, and legitimate interests.
Against Indonesia. UU Pasal 20 ayat (2) huruf a to f is the six limb list of GDPR Article 6(1)(a) to (f) in the same order, and the transposition shows in the detail.
Compared at UU Pasal 20, where the full comparison sits.
Vital interest notice loses wajib and its post processing timing
- a.tindakan yang dilakukan pasca berakhirnya tujuan pemrosesan;
dan - b.jenis ancaman
hidup, tubuh dan/atau fisik, properti dan/atau asetyang akan terjadi kepada Subjek Data Pribadidalam halpemrosesan tidak dilakukan.
- a.tindakan yang dilakukan pasca berakhirnya tujuan pemrosesan Data Pribadi;
- b.jenis ancaman yang akan terjadi kepada Subjek Data Pribadi atau pihak lainnya jika pemrosesan Data Pribadi tidak dilakukan; dan
- c.Informasi lainnya sesuai dengan ketentuan dalam Peraturan Pemerintah ini.
The draft imposed a wajib duty to notify the subject and the subject's parent or guardian after vital interest processing had taken place. PP 33/2026 Pasal 47(1) states the duty in the bare indicative, drops the parent and guardian addressees and fixes no time.
The deontic downgrade matters because the administrative sanction regime attaches most cleanly to wajib obligations, so the notice becomes hard to enforce as a discrete breach. Losing the parent and guardian addressees is the sharper practical loss, since vital interest processing frequently concerns an incapacitated or minor subject who cannot receive the notice personally.
The general information duty at PP 33/2026 Pasal 62(1) is still wajib and Pasal 62(2) applies it to every processing basis, but Pasal 62(4) requires that information before processing begins, so it does not substitute for an after the fact notice. Nothing in the enacted text now fixes when the Pasal 47 information must reach the subject.
Notify guardians and set your own deadline for the Pasal 47 notice, because the regulation fixes none.
Where Europe stands ported from the GDPR GDPR Articles 5, 6
The provision. GDPR Article 6(1) makes processing lawful only where one of six bases applies: consent, necessity for a contract or for pre-contractual steps, a legal obligation, vital interests, a task in the public interest or official authority, and legitimate interests.
Against Indonesia. UU Pasal 20 ayat (2) huruf a to f is the six limb list of GDPR Article 6(1)(a) to (f) in the same order, and the transposition shows in the detail.
Compared at UU Pasal 20, where the full comparison sits.
Vital interests loses its third condition and widens to any party
Pengendali Data Pribadi dapat menggunakan dasar pemrosesan Data Pribadi berupa pemenuhan pelindungan kepentingan vital Subjek Data Pribadi sebagaimana dimaksud dalam Pasal 44 ayat (2) huruf d.
Pemrosesan Data Pribadi berdasarkan pemenuhan pelindungan kepentingan vital sebagaimana dimaksud dalam Pasal 60 dilakukan dalam hal:
- a.terdapat
ancaman terhadap hidup, fisik, dan/atau properti/asetSubjek Data Pribadiatau pihak ketiga lainnya; - b.
terdapat kesulitan untuk mendapatkan persetujuan dari Subjek Data Pribadi yang datanya akan diproses berdasarkan dasar pemrosesan pemenuhan pelindungan kepentingan vital; dan - c.
potensi penolakan pemrosesan yang rendah oleh Subjek Data Pribadi yang datanya akan diproses menggunakan dasar pemrosesan pemenuha n pelindungan kepentingan vital.
Pengendali Data Pribadi dapat menggunakan dasar pemrosesan Data Pribadi berupa pemenuhan pelindungan kepentingan vital Subjek Data Pribadi dalam hal:
- a.terdapat ancaman terhadap hidup, fisik, dan/atau properti/aset Subjek Data Pribadi atau pihak lainnya; dan
- b.terdapat kesulitan untuk mendapatkan persetujuan dari Subjek Data Pribadi sebagaimana dimaksud dalam huruf a.
The draft imposed three cumulative conditions on the vital interests basis, including a low likelihood that the subject would refuse. PP 33/2026 Pasal 46 keeps two and widens the protected class from pihak ketiga lainnya to pihak lainnya.
Dropping the third condition removes the only element that asked the controller to predict the subject's own position, which was the draft's proxy for the counterfactual consent test. Replacing third parties with any other party removes the requirement that the endangered person be external to the processing relationship, so a threat to the controller's own interests can now support the basis. Both moves make the basis easier to invoke at precisely the point where the subject cannot be consulted.
Record the threat and the reason consent could not be obtained; likelihood of refusal is no longer a condition to assess.
Where Europe stands ported from the GDPR GDPR Articles 5, 6
The provision. GDPR Article 6(1) makes processing lawful only where one of six bases applies: consent, necessity for a contract or for pre-contractual steps, a legal obligation, vital interests, a task in the public interest or official authority, and legitimate interests.
Against Indonesia. UU Pasal 20 ayat (2) huruf a to f is the six limb list of GDPR Article 6(1)(a) to (f) in the same order, and the transposition shows in the detail.
Compared at UU Pasal 20, where the full comparison sits.
Consent mechanics downgraded from wajib to harus
Pengendali Data Pribadi wajib memastikan pemenuhan hak Subjek Data Pribadi untuk menarik persetujuan sewaktu - waktu melalui mekanisme yang sudah disediakan.
Pengendali Data Pribadi harus memastikan pemrosesan Data Pribadi tidak bersifat diskriminatif kepada Subjek Data Pribadi.
Pengendali Data Pribadi harus memastikan pemenuhan hak Subjek Data Pribadi untuk menarik persetujuan sewaktu-waktu melalui mekanisme yang disediakan oleh Pengendali Data Pribadi.
The draft cast the consent mechanism duty in Pasal 46(1), the withdrawal duty in Pasal 47 and the non discrimination duty in Pasal 48(2) as wajib. PP 33/2026 restates all three as harus in Pasal 34(1), Pasal 37 and Pasal 31 respectively.
In Indonesian legislative drafting practice wajib marks an obligation whose breach attracts sanction while harus marks a norm of conduct, so the change is one of register. The administrative exposure does not move with it, because RPP Pasal 213(1) never listed Pasal 46 to Pasal 48 among the provisions carrying a sanction and PP 33/2026 Pasal 184(1) does not list Pasal 31, Pasal 34 or Pasal 37 either.
The consent duties that keep wajib are the ones the sanction list does reach, namely the information duty in Pasal 33(1), the proof duty in Pasal 36(1), the parental consent duty in Pasal 38(2) and the disability consent duty in Pasal 39(4), which shows the drafters chose deliberately rather than drifting. Withdrawal remains backed indirectly because Pasal 92(1) makes stopping processing after withdrawal a wajib duty inside that list, with a 3 x 24 hour deadline set by Pasal 92(2).
Rank remediation by the Pasal 184(1) sanction list rather than by the wajib label, because these three duties sit outside the list in both instruments.
Where Europe stands diverges GDPR Article 7
The provision. GDPR Article 7(3) gives the data subject the right to withdraw consent at any time.
Against Indonesia. Under GDPR Article 7(3) withdrawal is a unilateral act: the moment it is made the GDPR Article 6(1)(a) basis falls away, and further processing has no lawful ground unless the controller can stand on another GDPR Article 6(1) basis, which is why GDPR Article 17(1)(b) conditions erasure on there being no other legal ground. Also compared at UU Pasal 20, UU Pasal 22.
Compared at UU Pasal 9, where the full comparison sits.
Contract content drops the security guarantee and other bases
Perjanjian yang digunakan sebagai dasar pemrosesan perjanjian harus mengatur paling sedikit memuat:
- a.rincian tujuan dan penjelasan tujuan pemrosesan Data Pribadi;
- b.keterangan keterkaitan antara tujuan pemrosesan Data Pribadi dan tujuan perjanjian yang akan dipenuhi;
- c.jenis dan karakteristik kebutuhan atau layanan yang akan diberikan kepada Subjek Data Pribadi;
- d.konsekuensi dalam hal pemrosesan Data Pribadi tidak dilakukan oleh Pengendali Data Pribadi;
- e.dampak pemrosesan Data Pribadi terhadap pelindungan hak Subjek Data Pribadi;
- f.jaminan Pengendali Data Pribadi untuk
menjaga keamanan, ketahanan, integritas, ke rahasiaan danPelindungan Data Pribadi; - g.
pihak yang terlibat dalam pemrosesanData Pribadi; dan - h.
dasarpemrosesan Data Pribadilain yang akan digunakan oleh Pengendali Data Pribadi, dalam hal terdapat kegiatan pemrosesan Data Pribadi di luar pemrosesan untuk pemenuhan tujuan perjanjian.
- a.rincian tujuan dan penjelasan tujuan pemrosesan Data Pribadi;
- b.keterangan keterkaitan antara tujuan pemrosesan Data Pribadi dan tujuan perjanjian yang akan dipenuhi;
- c.hak Subjek Data Pribadi dan kewajiban Pengendali Data Pribadi;
- d.jenis dan karakteristik kebutuhan atau layanan yang akan diberikan kepada Subjek Data Pribadi;
- e.konsekuensi dalam hal pemrosesan Data Pribadi tidak dilakukan oleh Pengendali Data Pribadi;
- f.dampak pemrosesan Data Pribadi terhadap pelindungan hak Subjek Data Pribadi;
- g.jaminan Pengendali Data Pribadi untuk melakukan pemrosesan Data Pribadi sesuai dengan ketentuan peraturan perundang-undangan di bidang Pelindungan Data Pribadi;
- h.jaminan Pengendali Data Pribadi untuk memenuhi hak Subjek Data Pribadi; dan
- i.pihak yang terlibat dalam pemrosesan Data Pribadi.
The draft required the contract to guarantee security, resilience, integrity and confidentiality and to disclose any other lawful basis used for processing outside the contract purpose. PP 33/2026 Pasal 43(1) replaces the security guarantee with a general compliance guarantee, adds a guarantee to fulfil subject rights and a statement of rights and controller duties, and drops the other bases disclosure entirely.
Losing item h removes the only contractual transparency device for basis stacking, which is the standard route by which service data becomes training or marketing data. The security guarantee survives only in the generalised form of Pasal 43(1)(g), so the specific commitments a counterparty could enforce are gone and the subject is left with the systemic obligations in the security chapter.
The additions at Pasal 43(1)(c) and (h) improve the rights side of the bargain but do nothing for purpose creep. The list is also load bearing in a way the draft's was not, because Pasal 43(2) provides that a contract failing to meet it cannot be used as the basis for processing at all, where draft Pasal 55(3) voided the contract only for want of explicit consent.
Keep an express other bases clause and specific security commitments in contracts even though Pasal 43 no longer requires them.
Where Europe stands ported from the GDPR GDPR Articles 5, 6
The provision. GDPR Article 6(1) makes processing lawful only where one of six bases applies: consent, necessity for a contract or for pre-contractual steps, a legal obligation, vital interests, a task in the public interest or official authority, and legitimate interests.
Against Indonesia. UU Pasal 20 ayat (2) huruf a to f is the six limb list of GDPR Article 6(1)(a) to (f) in the same order, and the transposition shows in the detail.
Compared at UU Pasal 20, where the full comparison sits.
Controller now judges a child's capacity to exercise rights
The draft required parental or guardian verification of a child's request to change data. PP 33/2026 Pasal 38(6) allows the child to make the request and makes fulfilment depend on the controller's assessment of the child's capacity to understand it, with Pasal 38(7) requiring parental consent except for rights relating to processing.
The draft placed the gatekeeping decision with the parent; the enacted text places it with the controller, which is a transfer of a protective judgement to the party with the commercial interest in the outcome. The carve out in Pasal 38(7) for rights terkait pemrosesan Data Pribadi is undefined and potentially large, since every subject right in the regulation relates to processing.
Controllers now need a documented capacity test rather than a verification workflow, and no regulation level criteria exist to structure it.
Write a capacity assessment rubric for child requests and record the reasoning on each decision.
Where Europe stands ported from the GDPR GDPR Articles 5, 6
The provision. GDPR Article 6(1) makes processing lawful only where one of six bases applies: consent, necessity for a contract or for pre-contractual steps, a legal obligation, vital interests, a task in the public interest or official authority, and legitimate interests.
Against Indonesia. UU Pasal 20 ayat (2) huruf a to f is the six limb list of GDPR Article 6(1)(a) to (f) in the same order, and the transposition shows in the detail. Also compared at UU Pasal 25.
Compared at UU Pasal 20, where the full comparison sits.
Honest and good faith processing demoted to a transparency rider
- a.memastikan Subjek Data Pribadi mengetahui Data Pribadi yang diproses;
- b.memastikan Subjek Data Pribadi mengetahui cara pemrosesan Data Pribadi; dan
- c.menyampaikan Informasi dan komunikasi terkait pemrosesan Data Pribadi yang mudah diakses, dipahami, dan menggunakan bahasa yang jelas.
RPP Pasal 79(2) stated honest and good faith processing as a free-standing wajib on the controller. PP 33/2026 Pasal 60(2) restates it as a harus qualifying transparent processing under ayat (1) rather than processing generally.
Good faith stopped being an independent standard and became an adverb attached to transparency. RPP Pasal 79(2) reached all processing, so a controller processing deceptively breached it whether or not the notice was accurate; PP 33/2026 Pasal 60(2) attaches jujur dan iktikad baik to the manner of transparency under Pasal 58, which narrows what the words can be used to test.
The transparency duty itself is unaffected and strengthened, since Pasal 60(1) defines it through three concrete requirements the draft did not have. What is lost is the general fairness hook that a supervisory authority reaches for when conduct is technically disclosed and substantively misleading.
Fairness arguments must now be framed through Pasal 60(1) transparency rather than a general good faith duty.
Where Europe stands diverges GDPR Articles 4, 5
The provision. GDPR Article 4(2) defines processing as any operation performed on personal data and gives an open list, running from collection and storage through disclosure to erasure, so nothing turns on whether a given activity is named.
Against Indonesia. The eight principles in UU Pasal 16 ayat (2) reach much of GDPR Article 5 by a different arrangement. Also compared at UU Pasal 27.
Compared at UU Pasal 16, where the full comparison sits.
Marketing disclosure confined to the consent basis
- a.informasi pihak ketiga yang akan menerima Data Pribadi;
- b.informasi bentuk penawaran yang akan diberikan; dan
- c.mekanisme pencabutan persetujuan dan pelaporan jika kegiatan penawaran terus berlangsung pasca pencabutan persetujuan.
- a.Informasi pihak ketiga yang akan menerima Data Pribadi;
- b.Informasi bentuk penawaran yang akan diberikan; dan
- c.mekanisme pencabutan persetujuan dan pelaporan jika kegiatan penawaran terus berlangsung pasca pencabutan persetujuan.
The draft applied the marketing disclosure duty to any processing one of whose purposes was the offering of goods or services. PP 33/2026 Pasal 35(2) applies it only where that processing rests on explicit valid consent.
The disclosure package covers the recipients, the form of the offer and the withdrawal and complaint route, which is the practical control on data sharing for marketing. Confining it to consent based processing leaves direct marketing conducted on the legitimate interests basis under Pasal 53 with no equivalent duty, and Pasal 55 now opens that basis to public bodies as well.
The general information duty in Pasal 62 applies across all bases but does not require third party recipients or an offer specific withdrawal route.
Marketing run on legitimate interests escapes Pasal 35(2); disclose recipients anyway to stay defensible under Pasal 62.
Where Europe stands ported from the GDPR GDPR Articles 5, 6
The provision. GDPR Article 6(1) makes processing lawful only where one of six bases applies: consent, necessity for a contract or for pre-contractual steps, a legal obligation, vital interests, a task in the public interest or official authority, and legitimate interests.
Against Indonesia. UU Pasal 20 ayat (2) huruf a to f is the six limb list of GDPR Article 6(1)(a) to (f) in the same order, and the transposition shows in the detail. Also compared at UU Pasal 22.
Compared at UU Pasal 20, where the full comparison sits.
Pre contract requests must now be written or recorded
- a.Pengendali Data Pribadi
dan Subjek Data Pribadi akan menandatangani suatu perjanjian yang membutuhkan pemrosesan Data Pribadi oleh Pengendali Data Pribadi; - b.
terdapat permintaan dariSubjek Data Pribadikepada Pengendali Data Pribadiyangmenyepakati bahwa SubjekData Pribadi danPengendali Data Pribadi akan menandatangani suatu perjanjian; dan - c.perjanjian yang akan
ditandatanganioleh Subjek Data Pribadi dan Pengendali Data Pribadidibutuhkanuntukpenyedia layanan dan/atau pemenuhan kebutuhanSubjek Data Pribadi.
- a.terdapat permintaan tertulis atau terekam dari Subjek Data Pribadi kepada Pengendali Data Pribadi;
- b.Pengendali Data Pribadi dan Subjek Data Pribadi akan mengikatkan diri dalam suatu perjanjian yang membutuhkan pemrosesan Data Pribadi; dan
- c.perjanjian yang akan disepakati oleh Subjek Data Pribadi dan Pengendali Data Pribadi digunakan sebagai dasar untuk melaksanakan hak dan kewajiban Subjek Data Pribadi dan Pengendali Data Pribadi.
Pengendali Data Pribadi tidak dapat memuat atau mencantumkan klausul perjanjian yang mengalihkan tanggung jawab kepada Subjek Data Pribadi sesuai dengan ketentuan peraturan perundang-undangan.
The draft required only that a request exist and that the parties agree they would sign a contract. PP 33/2026 Pasal 42(1)(a) requires the request to be written or recorded.
The pre contract limb of Pasal 30(3)(b) is the basis that covers quotations, applications and onboarding, where the subject has asked for something but nothing is yet signed. Pasal 42(1)(a) imposes an evidential form on that request, which converts an oral enquiry into an insufficient trigger unless the controller captures it. The corresponding relaxation is that the draft's requirement of agreement to sign is replaced in Pasal 42(1)(b) by an intention to be bound, which is easier to satisfy.
Log or record inbound enquiries at the point of contact if pre contract processing will follow.
Where Europe stands ported from the GDPR GDPR Articles 5, 6
The provision. GDPR Article 6(1) makes processing lawful only where one of six bases applies: consent, necessity for a contract or for pre-contractual steps, a legal obligation, vital interests, a task in the public interest or official authority, and legitimate interests.
Against Indonesia. UU Pasal 20 ayat (2) huruf a to f is the six limb list of GDPR Article 6(1)(a) to (f) in the same order, and the transposition shows in the detail. Also compared at UU Pasal 23.
Compared at UU Pasal 20, where the full comparison sits.
Public task notice moves to the start of processing
The draft required notice immediately after processing had begun and carried its exception inside the same clause. PP 33/2026 Pasal 51(2) requires notice when processing starts and moves the exception to Pasal 51(3).
The timing moves earlier, from a point after processing to the moment it commences, which brings the public task basis closer to the general rule in Pasal 62(4) that information is given before processing begins without matching it.
The exception in Pasal 51(3) is now expressed by reference to disruption of kepentingan umum or pelayanan publik rather than the draft's broader pelindungan kepentingan publik, and the deferred notice still falls due when the purpose is met. The duty itself is stated in the bare indicative in Pasal 51(1) rather than as wajib, so the enforceable hook remains Pasal 62.
Build public task notices into the start of processing and record any Pasal 51(3) deferral with its reason.
Where Europe stands ported from the GDPR GDPR Articles 5, 6
The provision. GDPR Article 6(1) makes processing lawful only where one of six bases applies: consent, necessity for a contract or for pre-contractual steps, a legal obligation, vital interests, a task in the public interest or official authority, and legitimate interests.
Against Indonesia. UU Pasal 20 ayat (2) huruf a to f is the six limb list of GDPR Article 6(1)(a) to (f) in the same order, and the transposition shows in the detail.
Compared at UU Pasal 20, where the full comparison sits.
What is inside this theme
20 changes, 12 of which shift an obligation. Pick one, or step through them in order.
Controller no longer has to prove its grounds for refusal
- a.
dapat membuktikantidakterjadinya dampakhukum dan/atau dampak signifikan; dan - b.
dapat membuktikanakurasi sistem yang sangat baik danmemilikimitigasisistemuntuk menghindari dampak bagi Subjek Data Pribadi.
- a.tidak terdapat akibat hukum dan/atau dampak signifikan pada Subjek Data Pribadi; dan
- b.Pengendali Data Pribadi memiliki akurasi sistem yang sangat baik dan sistem mitigasi untuk menghindari dampak bagi Subjek Data Pribadi.
Draft Pasal 107(1) let a controller refuse an objection only where it dapat membuktikan the absence of impact and the accuracy of its system. Enacted Pasal 95(1) removes the proof language and states the same two limbs as facts.
The draft placed the evidential burden on the controller, which matters because the subject cannot see inside the model. Enacted Pasal 95(1) recasts limb (a) as tidak terdapat akibat hukum dan/atau dampak signifikan and limb (b) as the controller memiliki akurasi sistem yang sangat baik dan sistem mitigasi, so the conditions are asserted rather than demonstrated.
Pasal 26 then lets the controller determine the conditions of fulfilment and refusal where RPP Pasal 27(b) had required it only to understand them, and neither provision requires the accuracy evidence to be disclosed. Pasal 95(3) requires only that the refusal be communicated. The subject is left contesting a system they cannot inspect, with the impact assessment under Pasal 120 the only document likely to record the accuracy claim.
Keep the accuracy and mitigation evidence in the impact assessment file, since that is where a supervisor will look for it.
Where Europe stands diverges GDPR Articles 21, 22
The provision. GDPR Article 22(1) says the data subject shall not be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects them.
Against Indonesia. The trigger wording in UU Pasal 10 ayat (1) tracks Article 22(1) closely, down to profiling and the legal-effect-or-significant-impact threshold, so the qualifying clause reads as a lift.
Compared at UU Pasal 10, where the full comparison sits.
Copy clock now runs from a verified request not from receipt
Draft Pasal 90(2) ran the 3 x 24 hour confirmation clock for a copy request from permohonan diterima. Enacted Pasal 78(2) runs it from permohonan diterima dan terverifikasi.
The draft started the clock on receipt, which made verification under RPP Pasal 42 a task the controller had to complete inside the window. Enacted Pasal 78(2) inserts dan terverifikasi, so the window opens only once the controller is satisfied of identity, and Pasal 100(2) uses the same construction for a refusal of restriction.
The other rights articles reach the same result by a second route, keeping the 3 x 24 hour clock running from receipt at Pasal 71(1), Pasal 77(1), Pasal 92(2) and Pasal 99(1) while making performance conditional on verification at Pasal 71(3), Pasal 77(2), Pasal 92(3) and Pasal 99(3). Because Pasal 25 asks only for a proportionate verification mechanism and no article caps how long it may take, the front end of every one of these deadlines is unbounded.
Put an internal service level on identity verification, because the regulation no longer bounds it.
Where Europe stands aligned GDPR Article 15
The provision. GDPR Article 15(1) gives the data subject confirmation of whether processing is happening, access to the data itself, and eight named items of information: purposes, categories of data, recipients or categories of recipients, retention period, the rights to rectify, erase, restrict and object, the right to lodge a complaint, the source where the data was not collected from the subject, and the existence and logic of automated decision-making.
Against Indonesia. UU Pasal 7 pairs akses with salinan, the same two-part structure as GDPR Article 15(1) and GDPR Article 15(3), but it transposes none of the content into the right itself. Also compared at UU Pasal 32.
Compared at UU Pasal 7, where the full comparison sits.
Indirect collection notice moves to 30 working days
Dalam hal Data Pribadi didapatkan secara tidak langsung dari Subjek Data Pribadi, Pengendali Data Pribadi melaksanakan kewajiban penyampaian Informasi sebagaimana dimaksud dalam Pasal 62 ayat (1) paling lambat 30 (tiga puluh) Hari setelah Data Pribadi dikumpulkan atau diperoleh.
Draft Pasal 77(2) required notice within 30 calendar days, written hari. Enacted Pasal 64 requires it within 30 Hari, and Pasal 1 of the enacted text defines Hari adalah hari kerja.
The capital letter is the whole change. The draft used lower case hari and carried no definition of the term, so the ordinary calendar day reading applied. Enacted Pasal 1 introduces the defined term and Pasal 64 uses it, converting a 30 day deadline into roughly six calendar weeks once weekends and Indonesian public holidays are counted.
Pasal 64 also widens the trigger to data dikumpulkan atau diperoleh, so data received from a broker rather than collected starts the same longer clock, and the subject waits materially longer to learn that a controller holds their data at all.
Recalculate every indirect collection notice schedule on working days, and check any other deadline written with a capital Hari.
Where Europe stands diverges GDPR Articles 12, 13, 14
The provision. GDPR Article 13 requires the controller to hand over a fixed list of information at the moment data is collected from the data subject: identity and contact details, the data protection officer, purposes and legal basis, any legitimate interests relied on, recipients and transfers under GDPR Article 13(1), and then under GDPR Article 13(2) the retention period, the data subject rights, the right to complain, whether provision is statutory or contractual, and any automated decision-making.
Against Indonesia. UU Pasal 5 names four heads, identity, dasar kepentingan hukum, tujuan, and akuntabilitas of the party seeking the data.
Compared at UU Pasal 5, where the full comparison sits.
Mandatory refusal of correction becomes a discretion without grounds
- a.
membahayakan keamanan, kesehatan fisik, atau kesehatan mentalSubjek Data Pribadidan/ atau orang lain; - b.berdampak pada pengungkapan Data Pribadi milik orang lain; dan/atau
- c.bertentangan dengan kepentingan pertahanan dan keamanan nasional.
Pengendali Data Pribadi wajib memperbarui dan/atau memperbaiki kesalahan dan/atau ketidakakuratan Data Pribadi paling lambat 3 x 24 (tiga kali dua puluh empat) jam terhitung sejak Pengendali Data Pribadi menerima permintaan pembaruan dan/atau perbaikan Data Pribadi.
- a.
akses terhadap Data Pribadi yang diproses beserta rekam jejak pemrosesan Data Pribadi sesuai dengan jangka waktu penyimpanan Data Pribadi; dan - b.
informasi yang diberikan oleh Pengendali Data Pribadi terkait konfirmasi permintaan akses.
- a.akses terhadap Data Pribadi yang diproses beserta rekam jejak pemrosesan Data Pribadi sesuai dengan jangka waktu penyimpanan Data Pribadi;
- b.Informasi yang diberikan oleh Pengendali Data Pribadi terkait konfirmasi permintaan akses; dan
- c.akses perubahan Data Pribadi.
- a.membahayakan keamanan, kesehatan fisik, atau kesehatan mental Subjek Data Pribadi dan/atau orang lain;
- b.berdampak pada pengungkapan Data Pribadi milik orang lain; dan/atau
- c.bertentangan dengan kepentingan pertahanan dan keamanan nasional.
RPP Pasal 83(5) obliged the controller to refuse a correction request on three closed grounds: danger to safety or physical or mental health, disclosure of another person's data, and conflict with national defence and security. PP 33/2026 Pasal 71(5) states only that the controller may refuse, with no grounds attached; the three grounds survive at Pasal 77(4) but bear on requests for access to change data rather than on correction itself.
A closed list of compulsory refusals became an open discretion. RPP Pasal 83(5) made refusal both mandatory and exhaustively defined, so a controller refusing outside those grounds was in breach; PP 33/2026 Pasal 71(5) supplies dapat menolak with no criteria, and the only discipline left is Pasal 71(7), which requires reasons to be given in accordance with legislation.
The three grounds now sit in Pasal 77(4) attached to akses perubahan, which is a different request under a different bagian. The result is that correction, the remedy UU PDP Pasal 6 grants outright, is the one right in this chapter whose refusal is governed by no stated test.
Bind the refusal discretion internally to the Pasal 77(4) grounds and record reasons on every refusal.
Where Europe stands aligned GDPR Articles 16, 19
The provision. GDPR Article 16 gives the data subject the right to obtain rectification of inaccurate personal data without undue delay, and to have incomplete data completed, including by a supplementary statement, having regard to the purposes of the processing.
Against Indonesia. UU Pasal 6 reaches the same two acts as GDPR Article 16, correction of inaccuracy and completion of what is incomplete, but it does not track the article's shape: the limbs run in the reverse order, memperbarui is added as a third act, and the purpose qualifier closes the whole right where GDPR Article 16 attaches it only to the completion limb. Also compared at UU Pasal 7, UU Pasal 30, UU Pasal 32.
Compared at UU Pasal 6, where the full comparison sits.
No proof of loss rule becomes a duty to evidence the claim
Subjek Data Pribadi mengajukan permintaan ganti rugi atas pelanggaran pemrosesan Data Pribadi kepada Pengendali Data Pribadi dan/atau Prosesor Data Pribadi dengan menyampaikan:
- a.
bukti terjadinya pelanggaran pemrosesan Data Pribadi yang berdampak terhadapSubjek Data Pribadi,tanpa harus membuktikan kerugian yang diderita oleh Subjek Data Pribadi; - b.
informasi dan bukti pendukung nominal kerugian materiel maupun non-materiel yang diderita; - c.informasi
danbuktibahwa Data PribadiSubjek Data Pribadidiproses oleh Pengendali Data Pribadi;dan - d.
informasi dan bukti terkaitData Pribadiyang menjadi target kegagalan PelindunganData Pribadi.
- a.identitas Subjek Data Pribadi;
- b.data, Informasi, dan/atau dokumen yang dijadikan bukti oleh Subjek Data Pribadi untuk mengajukan permintaan ganti rugi; dan
- c.hubungan hukum antara Subjek Data Pribadi dan Pengendali Data Pribadi terkait pemrosesan Data Pribadi.
Draft Pasal 117(a) required proof of a breach that had an impact on the subject tanpa harus membuktikan kerugian yang diderita, while Pasal 117(b) to (d) asked for supporting evidence of the amount and of the processing. Enacted Pasal 106(2) keeps only a general duty to supply the evidence relied on and the legal relationship with the controller, and says nothing about relief from proving loss.
The draft relieved the subject of proving loss as a condition of bringing the claim at Pasal 117(a), while Pasal 117(b) still asked for evidence of the amount claimed and Pasal 119 left the valuation to the chosen forum or the judge.
Enacted Pasal 106(2) drops that relief and requires the submission to contain the subject's identity, the data, information or documents relied on as evidence, and the legal relationship with the controller, so the ordinary burden returns in full. Read with Pasal 108(1), which makes the controller the first assessor of its own liability, the whole evidential load sits with the subject before any independent eye reaches the file.
Subjects rarely hold the processing records that would prove loss, and Pasal 74 keeps those records with the controller.
Anchor a claim in the controller's own processing records and obtain them through an access request before claiming.
Where Europe stands diverges GDPR Articles 79, 82
The provision. GDPR Article 82(1) gives any person who has suffered material or non-material damage from an infringement a right to compensation from the controller or processor.
Against Indonesia. GDPR Article 82 is a self-standing cause of action and the Court has filled in its contours.
Compared at UU Pasal 12, where the full comparison sits.
Notice before collection becomes notice before processing
- a.legalitas dari pemrosesan Data Pribadi;
- b.tujuan pemrosesan Data Pribadi;
- c.jenis dan relevansi Data Pribadi yang akan diproses;
- d.
jangka wakturetensidokumen yang memuatData Pribadi; - e.rincian mengenai Informasi yang dikumpulkan;
- f.jangka waktu pemrosesan Data Pribadi; dan
- g.hak Subjek Data Pribadi.
- a.
Identitas Pengendal i Data Pribadi dan/atau ProsesorData Pribadi yangmeliputi: 1. nama; 2. deskripsi singkat; 3. kontak; 4. representatif sesuai dengan ketentuan peraturan perundang-undangan; dan 5. kontak Pejabat Petugas PelindungData Pribadisesuai dengan ketentuan peraturan perundang-undangan. b. sumber pengumpulandantujuan pengirimanData Pribadi; - c.
dasarpemrosesan Data Pribadi; - d.
tujuan pemrosesanData Pribadi; - e.
jenisData Pribadi; - f.
dasar hukum penggunaan Data Pribadi; - g.
jangka waktu Data Pribadi akan digunakan; - h.
jangka waktu Data Pribadi akan disimpan; - i.
jangka waktu Data Pribadi akan dimusnahkan; - j.
bagaimana penyimpanan dan pengelolaan Data Pribadi dilakukan; - k.
informasi Pihak yang akan menggunakan Data dalam hal Pengendali Data Pribadi melibatkan Prosesor Data Pribadi; - l.
mekanisme perset ujuan dan penarikan persetujuan dalam hal pemrosesan Data Pribadi dpilaksanakan berdasarkan persetujuan yang sah secara eksplisit dari Subjek Data Pribadi sebagaimana dimaksud dalam Pasal 44 ayat (2) huruf a dan pemenuhan kewajiban perjanjian sebagaimana dimaksud dalam Pasal 44 ayat (2) huruf b; - m.
mekanisme memperoleh akses dan/atau salinan; - n.
mekanisme menyampaikan keberatan. o. mekanisme akses, salinan, verifikasi, dan perbaikan Data Pribadi; dan - p.
langkah keamanan untuk melindungi Data Pribadi.
- a.legalitas dari pemrosesan Data Pribadi;
- b.tujuan pemrosesan Data Pribadi;
- c.jenis dan relevansi Data Pribadi yang akan diproses;
- d.Masa Retensi Data Pribadi;
- e.rincian mengenai Informasi yang dikumpulkan;
- f.jangka waktu pemrosesan Data Pribadi; dan
- g.hak Subjek Data Pribadi.
Dalam hal Data Pribadi didapatkan secara tidak langsung dari Subjek Data Pribadi, Pengendali Data Pribadi melaksanakan kewajiban penyampaian Informasi sebagaimana dimaksud dalam Pasal 62 ayat (1) paling lambat 30 (tiga puluh) Hari setelah Data Pribadi dikumpulkan atau diperoleh.
Draft Pasal 77(1) required the information to be given before personal data was collected or obtained directly from the subject. Enacted Pasal 62(4) requires it before processing, and the enacted text has no direct collection article at all.
Collection is itself an act of processing, so the enacted wording does not in law license later notice; what it removes is the express rule for the direct case. Enacted Pasal 62(4) sets the duty to begin sebelum pemrosesan Data Pribadi, while Pasal 64 keeps the draft's thirty day deadline for data obtained indirectly, so the chapter still names the indirect case and leaves the direct one to the general rule alone.
The drafting also drops RPP Pasal 76(4), which required information both before and during processing, and replaces it with the standing availability requirement in Pasal 62(3). A controller that treats collection as a step preceding processing has room to argue for notice after the fact, and nothing in the chapter closes that reading.
Serve the notice at the point of collection regardless, because the enacted wording invites an argument you do not want to have with a supervisor.
Where Europe stands diverges GDPR Articles 12, 13, 14
The provision. GDPR Article 13 requires the controller to hand over a fixed list of information at the moment data is collected from the data subject: identity and contact details, the data protection officer, purposes and legal basis, any legitimate interests relied on, recipients and transfers under GDPR Article 13(1), and then under GDPR Article 13(2) the retention period, the data subject rights, the right to complain, whether provision is statutory or contractual, and any automated decision-making.
Against Indonesia. UU Pasal 5 names four heads, identity, dasar kepentingan hukum, tujuan, and akuntabilitas of the party seeking the data.
Compared at UU Pasal 5, where the full comparison sits.
Portability eligibility criteria are left to the authority
- a.dasar pemrosesan Data Pribadi dilakukan berdasarkan persetujuan yang sah secara eksplisit dari Subjek Data Pribadi atau pemenuhan kewajiban perjanjian dalam hal Subjek Data Pribadi merupakan salah satu pihak atau untuk memenuhi permintaan Subjek Data Pribadi pada saat akan melakukan perjanjian; dan
- b.pemrosesan
Data Pribadidilakukan secara otomatis.
Data Pribadi yang dapat diajukan permohonan hak mendapatkan dan/atau menggunakan Data Pribadi sebagaimana dimaksud dalam Pasal 121 ayat (1) dan hak menggunakan dan mengirimkan Data Pribadi sebagaimana dimaksud dalam Pasal 121 ayat (2), harus memenuhi kriteria:
- a.
Data Pribadi terkait dengan Subjek Data Pribadi; - b.
Data Pribadi disimpan dan diproses secara elektronik; - c.
Data Pribadi yang disediakan atau diberikan oleh Subjek Data Pribadi kepada Pengendali Data Pribadi; - d.
Data Pribadi yang diproses oleh Pengendali Data Pribadi hingga Pengendali Data Pribadi menerima permohonan mendapatkan dan/atau menggunakan Data Pribadi tentang dirinya sebagaimana dimaksud dalam Pasal 121 ayat (1); dan - e.
kriteria lain yang ditetapkan oleh Lembaga PDP.
- a.dasar pemrosesan Data Pribadi dilakukan berdasarkan: 1. persetujuan yang sah secara eksplisit dari Subjek Data Pribadi; atau 2. pemenuhan kewajiban perjanjian dalam hal Subjek Data Pribadi merupakan salah satu pihak atau untuk memenuhi permintaan Subjek Data Pribadi pada saat akan melakukan perjanjian; dan
- b.pemrosesan dilakukan secara otomatis.
Ketentuan lebih lanjut mengenai mekanisme pelaksanaan hak mendapatkan dan menggunakan portabilitas dan interoperabilitas diatur dalam Peraturan Lembaga.
Draft Pasal 122 set five criteria defining which data a portability request could reach. Enacted Pasal 113 drops them and defers the mechanism to a Peraturan Lembaga.
The draft criteria did real work: the data had to relate to the subject, be stored and processed electronically, have been supplied by the subject, and be data processed up to the moment the request was received, with a residual power for the Lembaga to add more.
Enacted Pasal 111(3) retains only the two gating conditions of lawful basis and automated processing, so nothing defines the perimeter of the exported data set. The most consequential loss is draft Pasal 122(c), the limit to data the subject supplied, which excluded observed and inferred data and is the boundary most likely to be litigated.
Pasal 112 keeps the competition law qualifier, so the enacted text still limits how far a controller must go without saying what it must hand over.
Scope portability exports to subject-supplied data and document the reasoning until the Peraturan Lembaga issues.
Where Europe stands diverges GDPR Article 20
The provision. GDPR Article 20(1) lets the subject receive the personal data he or she provided to a controller, in a structured, commonly used and machine-readable format, and transmit it to another controller without hindrance.
Against Indonesia. The format wording in UU Pasal 13 ayat (1) is the part that tracks GDPR Article 20(1); the gates are not in the statute.
Compared at UU Pasal 13, where the full comparison sits.
Rectification refusal moves from three grounds to discretion
- a.
membahayakan keamanan, kesehatan fisik, atau kesehatan mentalSubjek Data Pribadidan/ atau orang lain; - b.berdampak pada pengungkapan Data Pribadi milik orang lain; dan/atau
- c.bertentangan dengan kepentingan pertahanan dan keamanan nasional.
Pengendali Data Pribadi wajib memperbarui dan/atau memperbaiki kesalahan dan/atau ketidakakuratan Data Pribadi paling lambat 3 x 24 (tiga kali dua puluh empat) jam terhitung sejak Pengendali Data Pribadi menerima permintaan pembaruan dan/atau perbaikan Data Pribadi.
- a.
akses terhadap Data Pribadi yang diproses beserta rekam jejak pemrosesan Data Pribadi sesuai dengan jangka waktu penyimpanan Data Pribadi; dan - b.
informasi yang diberikan oleh Pengendali Data Pribadi terkait konfirmasi permintaan akses.
- a.akses terhadap Data Pribadi yang diproses beserta rekam jejak pemrosesan Data Pribadi sesuai dengan jangka waktu penyimpanan Data Pribadi;
- b.Informasi yang diberikan oleh Pengendali Data Pribadi terkait konfirmasi permintaan akses; dan
- c.akses perubahan Data Pribadi.
- a.membahayakan keamanan, kesehatan fisik, atau kesehatan mental Subjek Data Pribadi dan/atau orang lain;
- b.berdampak pada pengungkapan Data Pribadi milik orang lain; dan/atau
- c.bertentangan dengan kepentingan pertahanan dan keamanan nasional.
Draft Pasal 83(5) required the controller to refuse a rectification request on three stated grounds. Enacted Pasal 71(5) provides that the controller dapat menolak, with no grounds stated at all.
The draft's three grounds, danger to health or safety, disclosure of another person's data, and national defence and security, worked as both shield and ceiling: outside them refusal was not available. Enacted Pasal 71(5) replaces the closed list with a bare discretion and keeps only the duty in Pasal 71(7) to give reasons.
The same three grounds survive in the enacted text but only for access to change data at Pasal 77(4), so identical facts yield a mandatory refusal on the access route and an unbounded discretionary one on the rectification route.
Pasal 26 now lets the controller determine the conditions for granting or refusing a rights request, where the draft's Pasal 27 huruf b required it only to understand those conditions as fixed by legislation, so the boundary of a lawful rectification refusal sits in the controller's own policy.
Adopt the Pasal 77(4) grounds as your internal rectification refusal test so refusals stay defensible.
Where Europe stands aligned GDPR Articles 16, 19
The provision. GDPR Article 16 gives the data subject the right to obtain rectification of inaccurate personal data without undue delay, and to have incomplete data completed, including by a supplementary statement, having regard to the purposes of the processing.
Against Indonesia. UU Pasal 6 reaches the same two acts as GDPR Article 16, correction of inaccuracy and completion of what is incomplete, but it does not track the article's shape: the limbs run in the reverse order, memperbarui is added as a third act, and the purpose qualifier closes the whole right where GDPR Article 16 attaches it only to the completion limb. Also compared at UU Pasal 7, UU Pasal 30, UU Pasal 32.
Compared at UU Pasal 6, where the full comparison sits.
Refused compensation goes to court not to the authority
- a.
pihak yang ditunjuk olehPengendali Data PribadidanSubjek Data Pribadi,dalam hal Pengendali Data Pribadi dan Subjek Data Pribadi sepakat untuk memilih upaya penyelesaian sengketa di luar pengadilan; atau - b.
hakim pada pengadilan yang berwenang.
- a.
tingkat niat jahat atau perkiraan kerugian; - b.
jumlah kerugian; - c.
keuntungan ekonomi Pengendali Data Pribadi akibat pelanggaran; - d.
jumlah denda kepada pelanggaran; - e.
durasi, dan frekuensi pelanggaran; - f.
aset Pengendali Data Pribadi; - g.
upaya Pengendali Data Pribadi mendapatkan informasi personal setelah insiden; dan - h.
upaya Pengendali Data Pribadi mengatasi kerugian Subjek Data Pribadi.
Dalam hal Pengendali Data Pribadi dan/atau Prosesor Data Pribadi menolak memberikan ganti rugi atau tidak sesuai dengan permintaan Subjek Data Pribadi, Subjek Data Pribadi dapat mengajukan permohonan penyelesaian Sengketa ke Lembaga PDP untuk mencapai kesepakatan mengenai:
- a.
bentuk dan besarnya ganti rugi; dan/atau - b.
tindakan tertentu untuk menjamin tidak akan terjadi kembali atau tidak akan terulang kembali kerugian yang diderita oleh Subjek Data Pribadi.
- a.jawaban Pengendali Data Pribadi sebagaimana dimaksud pada ayat (2) menolak permintaan ganti rugi; atau
- b.tidak tercapai kesepakatan terkait ganti rugi, Subjek Data Pribadi dapat mengajukan gugatan sesuai dengan ketentuan peraturan perundang-undangan.
Draft Pasal 120 sent a refused or unagreed compensation claim to the Lembaga PDP to reach agreement on the form and amount. Enacted Pasal 108(3) sends it to a gugatan under the general law, and the draft's eight valuation factors in Pasal 119(2) are dropped.
The draft supplied both a forum and a valuation apparatus: Pasal 119(2) listed the controller's economic gain from the breach, the duration and frequency, its assets and its remedial efforts among the factors fixing quantum, and Pasal 119(1) named who could apply them. None of that survives. Enacted Pasal 108 leaves the controller to assess the claim and answer it, and on refusal or deadlock the subject sues.
The Lembaga has not vanished from the system, since Pasal 201 lets a party report a dispute and Chapter X provides facilitation and mediation, but the compensation article no longer routes claims there or gives the authority any role in fixing the sum.
Treat the Pasal 201 reporting route as optional facilitation and budget for litigation on quantum.
Where Europe stands diverges GDPR Articles 79, 82
The provision. GDPR Article 82(1) gives any person who has suffered material or non-material damage from an infringement a right to compensation from the controller or processor.
Against Indonesia. GDPR Article 82 is a self-standing cause of action and the Court has filled in its contours.
Compared at UU Pasal 12, where the full comparison sits.
Sixteen item privacy notice content list disappears
- a.legalitas dari pemrosesan Data Pribadi;
- b.tujuan pemrosesan Data Pribadi;
- c.jenis dan relevansi Data Pribadi yang akan diproses;
- d.
jangka wakturetensidokumen yang memuatData Pribadi; - e.rincian mengenai Informasi yang dikumpulkan;
- f.jangka waktu pemrosesan Data Pribadi; dan
- g.hak Subjek Data Pribadi.
- a.
Identitas Pengendal i Data Pribadi dan/atau ProsesorData Pribadi yangmeliputi: 1. nama; 2. deskripsi singkat; 3. kontak; 4. representatif sesuai dengan ketentuan peraturan perundang-undangan; dan 5. kontak Pejabat Petugas PelindungData Pribadisesuai dengan ketentuan peraturan perundang-undangan. b. sumber pengumpulandantujuan pengirimanData Pribadi; - c.
dasarpemrosesan Data Pribadi; - d.
tujuan pemrosesanData Pribadi; - e.
jenis Data Pribadi; - f.
dasar hukum penggunaan Data Pribadi; - g.
jangka waktu Data Pribadi akan digunakan; - h.
jangka waktu Data Pribadi akan disimpan; - i.
jangka waktu Data Pribadi akan dimusnahkan; - j.
bagaimana penyimpanan dan pengelolaan Data Pribadi dilakukan; - k.
informasi Pihak yang akan menggunakan Data dalam hal Pengendali Data Pribadi melibatkan Prosesor Data Pribadi; - l.
mekanisme perset ujuan dan penarikan persetujuan dalam hal pemrosesan Data Pribadi dpilaksanakan berdasarkan persetujuan yang sah secara eksplisit dari Subjek Data Pribadi sebagaimana dimaksud dalam Pasal 44 ayat (2) huruf a dan pemenuhan kewajiban perjanjian sebagaimana dimaksud dalam Pasal 44 ayat (2) huruf b; - m.
mekanisme memperoleh akses dan/atau salinan; - n.
mekanisme menyampaikan keberatan. o. mekanisme akses, salinan, verifikasi, dan perbaikan Data Pribadi; dan - p.
langkah keamanan untuk melindungi Data Pribadi.
- a.legalitas dari pemrosesan Data Pribadi;
- b.tujuan pemrosesan Data Pribadi;
- c.jenis dan relevansi Data Pribadi yang akan diproses;
- d.Masa Retensi Data Pribadi;
- e.rincian mengenai Informasi yang dikumpulkan;
- f.jangka waktu pemrosesan Data Pribadi; dan
- g.hak Subjek Data Pribadi.
Ketentuan lebih lanjut mengenai permintaan dan penyampain Informasi diatur dalam Peraturan Lembaga.
Draft Pasal 76(2) set a 16 item minimum content list for the information given to subjects. Enacted Pasal 62 keeps only the seven subject headings of draft Pasal 76(1) and drops the list, with Pasal 66 deferring the detail to a Peraturan Lembaga.
The draft list was the operative specification of a privacy notice: controller and processor identity, the data protection officer contact, the legal basis, the periods for use, storage and destruction, the consent and withdrawal mechanism, the access and copy mechanism, the objection mechanism and the security measures.
Enacted Pasal 62(1) retains the seven headings and Pasal 62(3) requires delivery through a sarana pemberitahuan Pelindungan Data Pribadi that stays available throughout processing, but nothing now states what the notice must say. Pasal 66 sends the content to a Peraturan Lembaga that has not issued. Until it does, compliance with Pasal 62 is testable only against seven abstract headings, which leaves a supervisor no benchmark for an inadequate notice.
Keep drafting notices to the draft's 16 item list until the Peraturan Lembaga promised by Pasal 66 issues.
Where Europe stands diverges GDPR Articles 12, 13, 14
The provision. GDPR Article 13 requires the controller to hand over a fixed list of information at the moment data is collected from the data subject: identity and contact details, the data protection officer, purposes and legal basis, any legitimate interests relied on, recipients and transfers under GDPR Article 13(1), and then under GDPR Article 13(2) the retention period, the data subject rights, the right to complain, whether provision is statutory or contractual, and any automated decision-making.
Against Indonesia. UU Pasal 5 names four heads, identity, dasar kepentingan hukum, tujuan, and akuntabilitas of the party seeking the data.
Compared at UU Pasal 5, where the full comparison sits.
Sixteen-item privacy notice schedule deleted from the notice duty
- a.legalitas dari pemrosesan Data Pribadi;
- b.tujuan pemrosesan Data Pribadi;
- c.jenis dan relevansi Data Pribadi yang akan diproses;
- d.
jangka wakturetensidokumen yang memuatData Pribadi; - e.rincian mengenai Informasi yang dikumpulkan;
- f.jangka waktu pemrosesan Data Pribadi; dan
- g.hak Subjek Data Pribadi.
- a.
Identitas Pengendal i Data Pribadi dan/atau ProsesorData Pribadi yangmeliputi: 1. nama; 2. deskripsi singkat; 3. kontak; 4. representatif sesuai dengan ketentuan peraturan perundang-undangan; dan 5. kontak Pejabat Petugas PelindungData Pribadisesuai dengan ketentuan peraturan perundang-undangan. b. sumber pengumpulandantujuan pengirimanData Pribadi; - c.
dasarpemrosesan Data Pribadi; - d.
tujuan pemrosesanData Pribadi; - e.
jenis Data Pribadi; - f.
dasar hukum penggunaan Data Pribadi; - g.
jangka waktu Data Pribadi akan digunakan; - h.
jangka waktu Data Pribadi akan disimpan; - i.
jangka waktu Data Pribadi akan dimusnahkan; - j.
bagaimana penyimpanan dan pengelolaan Data Pribadi dilakukan; - k.
informasi Pihak yang akan menggunakan Data dalam hal Pengendali Data Pribadi melibatkan Prosesor Data Pribadi; - l.
mekanisme perset ujuan dan penarikan persetujuan dalam hal pemrosesan Data Pribadi dpilaksanakan berdasarkan persetujuan yang sah secara eksplisit dari Subjek Data Pribadi sebagaimana dimaksud dalam Pasal 44 ayat (2) huruf a dan pemenuhan kewajiban perjanjian sebagaimana dimaksud dalam Pasal 44 ayat (2) huruf b; - m.
mekanisme memperoleh akses dan/atau salinan; - n.
mekanisme menyampaikan keberatan. o. mekanisme akses, salinan, verifikasi, dan perbaikan Data Pribadi; dan - p.
langkah keamanan untuk melindungi Data Pribadi.
- a.legalitas dari pemrosesan Data Pribadi;
- b.tujuan pemrosesan Data Pribadi;
- c.jenis dan relevansi Data Pribadi yang akan diproses;
- d.Masa Retensi Data Pribadi;
- e.rincian mengenai Informasi yang dikumpulkan;
- f.jangka waktu pemrosesan Data Pribadi; dan
- g.hak Subjek Data Pribadi.
RPP Pasal 76(2) prescribed a sixteen-item minimum content schedule for the information given to data subjects, running from controller identity and data protection officer contact through source, basis, types, use, storage and destruction periods, consent withdrawal mechanism, access and objection mechanisms and security measures. PP 33/2026 Pasal 62 retains only the seven headline categories in ayat (1) and carries no minimum content schedule at all.
The draft fixed the contents of the privacy notice; the enacted text fixes only its headings. RPP Pasal 76(2) functioned as a drafting template a controller could audit itself against, whereas PP 33/2026 Pasal 62(3) substitutes a delivery standard, requiring the seven categories to sit in an accessible pemberitahuan Pelindungan Data Pribadi that remains available throughout processing.
Retention survives as a headline category at Pasal 62(1)(d), but the item level detail does not, so nothing in the enacted text now requires the notice to state when data will be destroyed, how consent is withdrawn, or how access and objection are exercised. Pasal 66 leaves that detail to a Peraturan Lembaga, so notice adequacy is judged against seven abstractions until one is issued.
Retain the RPP Pasal 76(2) schedule as the internal notice template; the enacted text no longer supplies one.
Where Europe stands diverges GDPR Articles 12, 13, 14
The provision. GDPR Article 13 requires the controller to hand over a fixed list of information at the moment data is collected from the data subject: identity and contact details, the data protection officer, purposes and legal basis, any legitimate interests relied on, recipients and transfers under GDPR Article 13(1), and then under GDPR Article 13(2) the retention period, the data subject rights, the right to complain, whether provision is statutory or contractual, and any automated decision-making.
Against Indonesia. UU Pasal 5 names four heads, identity, dasar kepentingan hukum, tujuan, and akuntabilitas of the party seeking the data.
Compared at UU Pasal 5, where the full comparison sits.
The 3 x 24 hour answer to a compensation claim disappears
- a.
diumumkan kepada Subjek Data Pribadi melalui pemberitahuan Pelindungan Data Pribadi; dan - b.
menggunakan bahasa indonesia, secara singkat dan jelas.
- a.
tata cara permintaan ganti rugi; - b.
jenis ganti rugi yang dapat diberikan Pengendali Data Pribadi kepada Subjek Data Pribadi; - c.
pernyataan bahwa jika Subjek Data Pribadi meminta ganti rugi di luar yang dapat dimintakan kepada Pengendali Data Pribadi, maka Pengendali Data Pribadi berhak menolak permintaan ganti rugi; - d.
pernyataaan bahwa pemberitahuan pemrosesan atau penolakan permintaan ganti rugi akan diberitahukan selambat-lambatnya 3 x 24 (tiga kali dua puluh empat) jam setelah permohonan ganti rugi diterima; dan - e.
informasi Pejabat Pelindung Data Pribadi Prosesor Data Pribadi kepada Subjek Data Pribadi pemohon ganti rugi, dalam hal pelanggaran pemrosesan melibatkan Prosesor Data Pribadi.
Pengendali Data Pribadi harus memiliki mekanisme dan kebijakan penanganan permintaan ganti rugi.
Draft Pasal 118(5)(d) required the compensation policy to state that a claim would be answered or refused within 3 x 24 hours. Enacted Pasal 107 requires only that the controller have a mechanism and policy, and sets no deadline.
The draft prescribed the policy in detail: a document published in Indonesian through the privacy notice under Pasal 118(4), covering the claim procedure, the types of compensation available, a statement that claims beyond what may be requested of the controller may be refused, the 3 x 24 hour answer, and the processor's data protection officer contact where a processor was involved.
Enacted Pasal 107 reduces all of it to a single sentence. Pasal 108(2) requires an answer but fixes no time for it, so the only limit on delay is whatever the controller writes for itself. A subject facing an unanswered claim has no point at which delay itself becomes a breach, and must move to the litigation route in Pasal 108(3) to get anywhere.
Set and publish your own answer window for compensation claims, because the regulation now sets none.
Where Europe stands diverges GDPR Articles 79, 82
The provision. GDPR Article 82(1) gives any person who has suffered material or non-material damage from an infringement a right to compensation from the controller or processor.
Against Indonesia. GDPR Article 82 is a self-standing cause of action and the Court has filled in its contours.
Compared at UU Pasal 12, where the full comparison sits.
Erasure of unlawfully obtained data no longer needs a court ruling
- a.Data Pribadi tidak lagi diperlukan untuk pencapaian tujuan pemrosesan Data Pribadi;
- b.Subjek Data Pribadi telah melakukan penarikan kembali persetujuan pemrosesan Data Pribadi;
- c.terdapat permintaan dari Subjek Data Pribadi; atau
- d.Data Pribadi diperoleh dan/atau diproses dengan cara melawan hukum.
- a.Data Pribadi tidak lagi diperlukan untuk pencapaian tujuan pemrosesan Data Pribadi;
- b.Subjek Data Pribadi telah melakukan penarikan kembali persetujuan pemrosesan Data Pribadi;
- c.terdapat permintaan dari Subjek Data Pribadi; atau
- d.Data Pribadi diperoleh dan/atau diproses dengan cara melawan hukum.
- a.perolehan dan/atau pemrosesan Data Pribadi yang dilakukan oleh Pengendali Data Pribadi merupakan perbuatan melawan hukum sesuai dengan ketentuan peraturan perundang-undangan;
- b.pelaksanaan sanksi administratif berupa penghapusan oleh Lembaga; atau
- c.terdapat putusan pengadilan yang telah memperoleh kekuatan hukum tetap.
Draft Pasal 95(2) made the duty to erase unlawfully obtained or processed data exercisable only berdasarkan putusan pengadilan. Enacted Pasal 82(2) supplies three alternative triggers, including an administrative sanction of erasure imposed by the Lembaga.
Conditioning the duty on a court judgment made the draft's Pasal 95(1)(d) close to inoperable, since a subject would have to litigate to unlock an erasure the regulation already required. Enacted Pasal 82(2) breaks the condition into unlawfulness under the applicable legislation, an administrative sanction of erasure by the Lembaga, and a court judgment that has become final.
The first limb is the consequential one, because it requires no external determination: a controller that concludes its own acquisition was unlawful must erase. The third limb tightens the litigation route by requiring kekuatan hukum tetap rather than any judgment.
Add an unlawful acquisition test to data intake review, because a self-assessment now triggers a mandatory erasure.
Where Europe stands diverges GDPR Articles 17, 18, 21
The provision. GDPR Article 17(1) gives a right to erasure on six exhaustive grounds, among them that the data is no longer necessary, that consent is withdrawn with no other basis available, that the subject objects under Article 21 and no overriding legitimate grounds exist, and that processing was unlawful.
Against Indonesia. UU Pasal 8 states one right spanning three acts, mengakhiri pemrosesan, menghapus and memusnahkan, with no grounds and no exceptions on the face of the article. Also compared at UU Pasal 43.
Compared at UU Pasal 8, where the full comparison sits.
Bar on erasure after withdrawal narrows to completed erasure
Subjek Data Pribadi tidak dapat mengajukan permintaan penghapusan Data Pribadi jika penarikan persetujuan pemrosesan Data Pribadi yang diikuti dengan penghapusan Data Pribadi telah dilaksanakan oleh Pengendali Data Pribadi sebagaimana dimaksud dalam Pasal 82 ayat (1) huruf b.
Draft Pasal 94(3) barred a subject from seeking erasure if they had previously withdrawn consent. Enacted Pasal 83 bars it only where the withdrawal has already been followed by an erasure actually carried out under Pasal 82(1)(b).
The draft's bar attached to the act of withdrawing, so a subject who withdrew consent and then met inaction had spent the request route without receiving anything, even though RPP Pasal 95(1)(b) obliged the controller to erase on withdrawal in any event. Enacted Pasal 83 attaches the bar to performance, biting only once the controller has completed the erasure that withdrawal triggers under Pasal 82(1)(b).
The change restores the request in the common case where a controller stops processing but retains the data. It also makes the controller's own erasure record the evidence that the bar applies, which ties the point back to the recording duty in Pasal 74.
Log the erasure that follows a withdrawal, because that record is what defeats a later erasure request.
Where Europe stands diverges GDPR Articles 17, 18, 21
The provision. GDPR Article 17(1) gives a right to erasure on six exhaustive grounds, among them that the data is no longer necessary, that consent is withdrawn with no other basis available, that the subject objects under Article 21 and no overriding legitimate grounds exist, and that processing was unlawful.
Against Indonesia. UU Pasal 8 states one right spanning three acts, mengakhiri pemrosesan, menghapus and memusnahkan, with no grounds and no exceptions on the face of the article. Also compared at UU Pasal 43.
Compared at UU Pasal 8, where the full comparison sits.
Copy right narrowed and the processing trail falls out
Draft Pasal 88(3) allowed the copy given to a subject to include the processing trail. Enacted Pasal 76(2) deletes that paragraph and rewrites the third party exclusion as a limit on what may be given.
The draft framed the third party point descriptively at Pasal 88(2) and then extended the copy to the rekam jejak pemrosesan at Pasal 88(3). Enacted Pasal 76(2) recasts it as hanya diberikan untuk Data Pribadi yang tidak berdampak bagi pengungkapan Data Pribadi orang lain and drops the processing trail from the copy right entirely.
The trail survives on the access side at Pasal 77(3)(a), so a subject may inspect it but has no stated entitlement to receive it. That split matters, because the portable evidential form of a rights request is the copy and not the inspection, and Pasal 106(2) now makes the subject responsible for evidencing a compensation claim.
Expect subjects to ask for the trail under access and decide now whether you will supply it in copy form.
Where Europe stands aligned GDPR Article 15
The provision. GDPR Article 15(1) gives the data subject confirmation of whether processing is happening, access to the data itself, and eight named items of information: purposes, categories of data, recipients or categories of recipients, retention period, the rights to rectify, erase, restrict and object, the right to lodge a complaint, the source where the data was not collected from the subject, and the existence and logic of automated decision-making.
Against Indonesia. UU Pasal 7 pairs akses with salinan, the same two-part structure as GDPR Article 15(1) and GDPR Article 15(3), but it transposes none of the content into the right itself. Also compared at UU Pasal 32.
Compared at UU Pasal 7, where the full comparison sits.
Downstream correction notice narrowed to controllers and processors
RPP Pasal 86(1) required corrected data to be pushed to any pihak lain that had received it from the controller, processors included. PP 33/2026 Pasal 72(1) confines the push to Pengendali Data Pribadi lain and Prosesor Data Pribadi, and folds it into the wajib in Pasal 71(1).
The class of recipients contracted while the deadline tightened. RPP Pasal 86(1) reached every downstream recipient under a free standing harus, whereas PP 33/2026 Pasal 72(1) reaches only other controllers and processors and does so as part of the Pasal 71(1) obligation, which carries the 3 x 24 jam limit.
Recipients who are neither controllers nor processors of that data, such as one off disclosure targets under a statutory request, now fall outside the propagation duty. The excuse narrowed with it: Pasal 72(2) confines the impossibility and disproportionate effort exception to transmission to another controller, where RPP Pasal 86(2) covered every pihak lain. Propagation to a processor is therefore unqualified on the face of the enacted text.
Map recipients by role. Controllers and processors attract the 3 x 24 jam duty, and only the controller leg carries the disproportionate effort exception.
Where Europe stands aligned GDPR Articles 16, 19
The provision. GDPR Article 16 gives the data subject the right to obtain rectification of inaccurate personal data without undue delay, and to have incomplete data completed, including by a supplementary statement, having regard to the purposes of the processing.
Against Indonesia. UU Pasal 6 reaches the same two acts as GDPR Article 16, correction of inaccuracy and completion of what is incomplete, but it does not track the article's shape: the limbs run in the reverse order, memperbarui is added as a third act, and the purpose qualifier closes the whole right where GDPR Article 16 attaches it only to the completion limb. Also compared at UU Pasal 30.
Compared at UU Pasal 6, where the full comparison sits.
Correction right loses its facility and gains a purpose qualifier
- a.
membahayakan keamanan, kesehatan fisik, atau kesehatan mental SubjekData Pribadidan/ atau orang lain; - b.berdampak pada pengungkapan Data Pribadi milik orang lain; dan/atau
- c.bertentangan dengan kepentingan pertahanan dan keamanan nasional.
Pengendali Data Pribadi wajib memperbarui dan/atau memperbaiki kesalahan dan/atau ketidakakuratan Data Pribadi paling lambat 3 x 24 (tiga kali dua puluh empat) jam terhitung sejak Pengendali Data Pribadi menerima permintaan pembaruan dan/atau perbaikan Data Pribadi.
- a.
akses terhadap Data Pribadi yang diproses beserta rekam jejak pemrosesan Data Pribadi sesuai dengan jangka waktu penyimpanan Data Pribadi; dan - b.
informasi yang diberikan oleh Pengendali Data Pribadi terkait konfirmasi permintaan akses.
Subjek Data Pribadi berhak melengkapi, memperbarui, dan/atau memperbaiki kesalahan dan/atau ketidakakuratan Data Pribadi tentang dirinya sesuai dengan tujuan pemrosesan Data Pribadi.
- a.akses terhadap Data Pribadi yang diproses beserta rekam jejak pemrosesan Data Pribadi sesuai dengan jangka waktu penyimpanan Data Pribadi;
- b.Informasi yang diberikan oleh Pengendali Data Pribadi terkait konfirmasi permintaan akses; dan
- c.akses perubahan Data Pribadi.
- a.membahayakan keamanan, kesehatan fisik, atau kesehatan mental Subjek Data Pribadi dan/atau orang lain;
- b.berdampak pada pengungkapan Data Pribadi milik orang lain; dan/atau
- c.bertentangan dengan kepentingan pertahanan dan keamanan nasional.
RPP Pasal 83(1) framed the correction right as exercised through a facility provided by the controller, either self-service or by written request. PP 33/2026 Pasal 70 removes the facility and the two exercise routes, and qualifies the right by the purpose of processing.
The draft told a controller to build something; the enacted text tells it what the right is limited by. RPP Pasal 83(1) implied an operational obligation to provide a sarana and named self-service as an acceptable route, whereas PP 33/2026 Pasal 70 is silent on how a request is made and writes sesuai dengan tujuan pemrosesan Data Pribadi into the right itself.
The draft used those same words only at Pasal 83(2), as the measure against which the controller verified a request, so the purpose test has moved from the verification step to the definition of the right. It now sits alongside the unstructured discretion at Pasal 71(5), where draft Pasal 83(5) had listed three mandatory refusal grounds, which leaves correction the right with the weakest procedural scaffolding in the chapter.
Provide a documented correction channel voluntarily; the enacted text no longer requires one.
Where Europe stands aligned GDPR Articles 16, 19
The provision. GDPR Article 16 gives the data subject the right to obtain rectification of inaccurate personal data without undue delay, and to have incomplete data completed, including by a supplementary statement, having regard to the purposes of the processing.
Against Indonesia. UU Pasal 6 reaches the same two acts as GDPR Article 16, correction of inaccuracy and completion of what is incomplete, but it does not track the article's shape: the limbs run in the reverse order, memperbarui is added as a third act, and the purpose qualifier closes the whole right where GDPR Article 16 attaches it only to the completion limb. Also compared at UU Pasal 7, UU Pasal 30, UU Pasal 32.
Compared at UU Pasal 6, where the full comparison sits.
Duty to run an electronic channel becomes a rule on the subject
- a.media komunikasi yang sama dengan media komunikasi yang digunakan Subjek Data Pribadi pada saat pengajuan permohonan; atau
- b.media komunikasi lain yang dapat diakses Subjek Data Pribadi dengan mudah.
Draft Pasal 38(2) obliged a controller processing electronically to provide an electronic rights channel. Enacted Pasal 21(2) instead states that where the controller processes electronically, the request is submitted electronically.
The draft placed the burden on the controller: electronic processing triggered a duty to build an electronic channel. Enacted Pasal 21(2) recasts the same fact pattern as a rule about how the subject submits, leaving the duty language only in Pasal 21(1), which requires a channel yang mudah diakses without tying the medium to the processing medium.
The enacted text compensates at Pasal 21(3), which requires the outcome to be communicated through the medium the subject used or another easily accessible one, a rule the draft carried only for restriction at Pasal 114(3). Controllers gain latitude on the intake and lose it on the reply.
Keep the electronic intake channel, and reply through the same channel the subject used.
Where Europe stands diverges GDPR Articles 18, 19
The provision. GDPR Article 18(1) gives a right to restriction of processing on four closed grounds: the accuracy of the data is contested, for a period enabling the controller to verify it; the processing is unlawful but the subject asks for restriction instead of erasure; the controller no longer needs the data but the subject needs them for legal claims; or a GDPR Article 21(1) objection is pending verification.
Against Indonesia. GDPR Article 18 is an interim measure in two of its four grounds, not in all four. Also compared at UU Pasal 14, UU Pasal 41.
Compared at UU Pasal 11, where the full comparison sits.
Exoneration ban reworded and re-scoped to the privacy notice
Pengendali Data Pribadi dilarang memberlakukan klasula eksonerasi dalam hal persetujuan terhadap perubahan yang dilakukan oleh Pengendali Data Pribadi terkait legalitas, tujuan, jenis dan relevansi, jangka waktu dan rincian informasi yang dikumpulkan.
Pengendali Data Pribadi tidak dapat mencantumkan klausul eksonerasi dalam pemberitahuan Pelindungan Data Pribadi sesuai dengan ketentuan peraturan perundang-undangan.
RPP Pasal 78 used dilarang and targeted exoneration clauses in consent to changes of legality, purpose, type and relevance, period and details collected. PP 33/2026 Pasal 65 uses tidak dapat, drops the enumerated change categories, and re-scopes the ban to exoneration clauses in the pemberitahuan Pelindungan Data Pribadi, subject to other legislation.
A specific prohibition became a general one and lost its trigger.
RPP Pasal 78 was aimed at the practice of using a consent flow for a change of purpose or retention period to disclaim liability, which is why it enumerated the five change categories; PP 33/2026 Pasal 65 covers exoneration clauses anywhere in the privacy notice but says nothing about consent to changes, and its closing sesuai dengan ketentuan peraturan perundang-undangan subordinates the ban to whatever other legislation provides on such clauses.
Whether tidak dapat carries the same weight as dilarang is untested. A clause disclaiming liability that sits in terms of service rather than the notice is now outside Pasal 65 on its face.
Audit the privacy notice specifically for liability disclaimers and keep the RPP Pasal 78 change scenarios in view.
Where Europe stands diverges GDPR Articles 12, 13, 14
The provision. GDPR Article 13 requires the controller to hand over a fixed list of information at the moment data is collected from the data subject: identity and contact details, the data protection officer, purposes and legal basis, any legitimate interests relied on, recipients and transfers under GDPR Article 13(1), and then under GDPR Article 13(2) the retention period, the data subject rights, the right to complain, whether provision is statutory or contractual, and any automated decision-making.
Against Indonesia. UU Pasal 5 names four heads, identity, dasar kepentingan hukum, tujuan, and akuntabilitas of the party seeking the data. Also compared at UU Pasal 23.
Compared at UU Pasal 5, where the full comparison sits.
Recorded request stops being optional and becomes the route
Pelaksanaan hak Subjek Data Pribadi dapat diajukan melalui permohonan tercatat yang disampaikan secara elektronik atau nonelektronik kepada Pengendali Data Pribadi sesuai dengan ketentuan peraturan perundang - undangan.
Pelaksanaan hak Subjek Data Pribadi diajukan melalui permohonan tercatat yang disampaikan secara elektronik atau nonelektronik kepada Pengendali Data Pribadi sesuai dengan ketentuan peraturan perundang-undangan.
Draft Pasal 37 provided that rights dapat diajukan through a recorded request. Enacted Pasal 20 deletes dapat, so a recorded request is the form in which a rights request is made.
The draft treated the recorded request as one available route, which left room for an informal request over a counter or a helpline to count. Enacted Pasal 20 removes the permissive verb and states that the exercise of rights is made through a recorded request, electronic or non-electronic, to the controller.
Read with Pasal 22, which fixes the moment a recorded request is received, recordability becomes the practical trigger for the 3 x 24 hour clocks that run from receipt, such as the access clock in Pasal 77(1). A request that leaves no record now starts nothing.
Route every rights request into a logged intake channel and timestamp it, because an unrecorded request does not start the clock.
Where Europe stands diverges GDPR Article 12
The provision. GDPR Article 12 governs how rights are exercised and answered.
Against Indonesia. Two things separate these.
Compared at UU Pasal 14, where the full comparison sits.
What is inside this theme
5 changes, 3 of which shift an obligation. Pick one, or step through them in order.
Breaches without disclosure lost their notification exemption
- a.
Subjek Data Pribadi; dan - b.
Lembaga PDP.
- a.
Data Pribadi yang terungkap; - b.
kapan dan bagaimana Data Pribadi terungkap; - c.
dampak kegagalan Pelindungan Data Pribadi, dan upaya penanganan dan pemulihan atas terungkapnya Data Pribadi; dan - d.
kontak narahubung.
- a.
mengganggu pelayanan publik; - b.
berdampak serius terhadap kepentingan masyarakat; dan/atau - c.
Pengendali Data Pribadi tidak dapat memastikan bahwa Subjek Data Pribadi dapat menerima pemberitahuan secara lang sung kepada Subjek Data Pribadi.
The enacted text carries nothing in its place.
RPP Pasal 124(5) exempted the controller from notifying where the protection failure did not result in disclosure of personal data. PP 33/2026 carries no equivalent; Pasal 114 states the 3 x 24 jam duty with no exception clause.
The draft's only off-ramp from breach notification has gone. RPP Pasal 124(5) meant that an availability or integrity incident with no disclosure component never reached the subject or the authority, whereas PP 33/2026 Pasal 114(1) now attaches the 3 x 24 jam duty to any Kegagalan Pelindungan Data Pribadi as defined in Pasal 1, which covers unlawful destruction, loss and alteration alongside disclosure.
Ransomware that encrypts without exfiltration, a mis-set retention job that destroys records, and a botched migration now all notify. Controllers calibrated to the draft will under-report, and the volume implication for the Lembaga is substantial.
Rewrite the breach triage rule; no-disclosure incidents are now notifiable within 3 x 24 jam.
This finding cites no article of the enacted text, so there is no implementing provision to carry a comparison. The subject is treated in the reading pages.
Impact of the breach removed from the mandatory notification
- a.Subjek Data Pribadi; dan
- b.Lembaga
PDP.
- a.Data Pribadi yang terungkap;
- b.kapan dan bagaimana Data Pribadi terungkap;
- c.
dampak kegagalan Pelindungan Data Pribadi, danupaya penanganan dan pemulihan atas terungkapnya Data Pribadi;dan - d.
kontaknarahubung.
- a.mengganggu pelayanan publik;
- b.berdampak serius terhadap kepentingan masyarakat;
dan/atau - c.
Pengendali Data Pribadi tidak dapat memastikan bahwa Subjek Data Pribadi dapat menerimapemberitahuan secaralang sung kepada Subjek Data Pribadi.
- a.Subjek Data Pribadi; dan
- b.Lembaga.
- a.Data Pribadi yang terungkap;
- b.kapan dan bagaimana Data Pribadi terungkap; dan
- c.upaya penanganan dan pemulihan atas terungkapnya Data Pribadi oleh Pengendali Data Pribadi.
- a.Kegagalan Pelindungan Data Pribadi mengganggu pelayanan publik; dan/atau
- b.Kegagalan Pelindungan Data Pribadi berdampak serius terhadap kepentingan masyarakat.
RPP Pasal 124(3)(c) required the notification to state the impact of the protection failure alongside the handling and recovery steps. PP 33/2026 Pasal 114(3)(c) keeps the handling and recovery steps and deletes dampak, leaving impact out of the mandatory content.
The subject is told what the controller did and no longer what it means for them. RPP Pasal 124(3)(c) paired dampak with upaya penanganan, so the notice had to disclose consequence as well as response; PP 33/2026 Pasal 114(3) reduces the mandatory content to the data exposed, when and how it was exposed, and the remediation, with Pasal 114(4) adding the PPDP or contact point.
Impact survives only in the internal documentation at Pasal 116(1)(c), which goes to the Lembaga and not to the subject. A person receiving a Pasal 114 notice cannot judge from it whether to freeze credit, change credentials or do nothing.
State impact in the notice anyway; the enacted minimum does not equal a defensible notice.
Where Europe stands diverges GDPR Articles 32, 33, 34
The provision. GDPR Article 33(1) requires notification to the supervisory authority without undue delay and where feasible within 72 hours of the controller becoming aware of a breach, unless the breach is unlikely to result in a risk to rights and freedoms.
Against Indonesia. The clock is the difference that gets missed, and it is a difference about the start, not the length.
Compared at UU Pasal 46, where the full comparison sits.
Public breach notice loses the unreachable subjects trigger
- a.Subjek Data Pribadi; dan
- b.Lembaga
PDP.
- a.Data Pribadi yang terungkap;
- b.kapan dan bagaimana Data Pribadi terungkap;
- c.
dampak kegagalan Pelindungan Data Pribadi, danupaya penanganan dan pemulihan atas terungkapnya Data Pribadi;dan - d.
kontaknarahubung.
- a.mengganggu pelayanan publik;
- b.berdampak serius terhadap kepentingan masyarakat;
dan/atau - c.
Pengendali Data Pribadi tidak dapat memastikan bahwa Subjek Data Pribadi dapat menerimapemberitahuan secaralang sung kepada Subjek Data Pribadi.
- a.Subjek Data Pribadi; dan
- b.Lembaga.
- a.Data Pribadi yang terungkap;
- b.kapan dan bagaimana Data Pribadi terungkap; dan
- c.upaya penanganan dan pemulihan atas terungkapnya Data Pribadi oleh Pengendali Data Pribadi.
- a.Kegagalan Pelindungan Data Pribadi mengganggu pelayanan publik; dan/atau
- b.Kegagalan Pelindungan Data Pribadi berdampak serius terhadap kepentingan masyarakat.
RPP Pasal 124(4) required public notification on three triggers, the third being that the controller could not be sure subjects would receive direct notice. PP 33/2026 Pasal 115(1) retains only the public service and serious public interest triggers and deletes the third.
Public notification is now a public interest measure rather than a response to individual notice failing. RPP Pasal 124(4)(c) covered the case where contact details are stale or the subject population is unidentifiable, which is the ordinary situation in a scraped or legacy dataset breach; PP 33/2026 Pasal 115(1) leaves that case with no route at all, since the Pasal 114(1) duty to notify each subject remains but becomes impossible to discharge.
Pasal 115(2) adds that public notification runs through electronic and non-electronic media, so the mechanism exists and only the trigger is missing. Controllers who cannot reach their subjects are left with a duty they cannot perform and a public notice the enacted text does not require.
Where subjects are unreachable notify publicly and record why individual notice under Pasal 114 failed.
Where Europe stands diverges GDPR Articles 32, 33, 34
The provision. GDPR Article 33(1) requires notification to the supervisory authority without undue delay and where feasible within 72 hours of the controller becoming aware of a breach, unless the breach is unlikely to result in a risk to rights and freedoms.
Against Indonesia. The clock is the difference that gets missed, and it is a difference about the start, not the length.
Compared at UU Pasal 46, where the full comparison sits.
Breach prevention policy loses wajib and is scoped internally
Pengendali Data Pribadi wajib menetapkan dan melaksanakan kebijakan, prosedur, dan/atau pedoman mengenai pencegahan dan penanganan kegagalan Pelindungan Data Pribadi yang paling sedikit memuat:
- a.pembagian peran dan tanggung jawab penanganan kegagalan Pelindungan Data Pribadi;
- b.mekanisme untuk melakukan analisis, klasifikasi, prioritisasi, pemantauan, penanganan, dan penyelesaian kegagalan Pelindungan Data Pribadi, termasuk
pascakejadian; - c.dokumentasi penanganan kegagalan Pelindungan Data Pribadi dan mekanisme pelaporan kepada Subjek Data Pribadi dan Lembaga
PDP;dan - d.peninjauan dan pembaruan berkala proses penanganan kegagalan Pelindungan Data Pribadi.
- a.pembagian peran dan tanggung jawab penanganan Kegagalan Pelindungan Data Pribadi;
- b.mekanisme untuk melakukan analisis, klasifikasi, prioritisasi, pemantauan, penanganan, dan penyelesaian Kegagalan Pelindungan Data Pribadi, termasuk setelah kejadian;
- c.dokumentasi penanganan Kegagalan Pelindungan Data Pribadi dan mekanisme pelaporan kepada Subjek Data Pribadi dan Lembaga; dan
- d.peninjauan dan pembaruan berkala proses penanganan Kegagalan Pelindungan Data Pribadi.
RPP Pasal 126 obliged the controller by wajib to adopt and implement a breach prevention and handling policy. PP 33/2026 Pasal 117(1) states the same in the plain indicative and adds that the policy applies di internal Pengendali Data Pribadi.
The incident response policy lost its enforceable marker and gained a boundary. PP 33/2026 Pasal 117(1) drops wajib in the same way as Pasal 116, and the added words yang berlaku di internal confine the policy to the controller's own organisation, which sits awkwardly with Pasal 118 placing a reporting duty on the processor and with Pasal 126(1) retaining wajib for supervising every party under the controller's control.
The four minimum contents at Pasal 117(2) survive from RPP Pasal 126, including role allocation, the analysis and escalation mechanism, documentation and reporting, and periodic review. The policy remains the practical prerequisite for meeting the 3 x 24 jam clock at Pasal 114(1) whatever its deontic status.
Keep the incident response policy and extend it to processors by contract since Pasal 117 stops at the perimeter.
Where Europe stands diverges GDPR Articles 32, 33, 34
The provision. GDPR Article 33(1) requires notification to the supervisory authority without undue delay and where feasible within 72 hours of the controller becoming aware of a breach, unless the breach is unlikely to result in a risk to rights and freedoms.
Against Indonesia. The clock is the difference that gets missed, and it is a difference about the start, not the length.
Compared at UU Pasal 46, where the full comparison sits.
One word left the incident documentation duty
- a.
halyangmenyebabkan terjadinya kegagalan; - b.
waktu dan kronologikegagalan; - c.Data Pribadi
yang terdampak; - d.
akibat kegagalan; - e.
tindakan penanganandanperbaik an yang dilakukan; - f.
kesimpulan apakah terjadi pengungkapanData Pribadi; - g.
jangka waktu pemberitahuan kepada Subjek Data pribadi dan Lembaga PDP; dan - h.
risiko dampak pengungkapan Data Pribadi terhadap Subjek Data Pribadi.
- a.Data Pribadi yang dilindungi;
- b.deskripsi Kegagalan Pelindungan Data Pribadi;
- c.dampak atau akibat Kegagalan Pelindungan Data Pribadi terhadap Subjek Data Pribadi dan Pengendali Data Pribadi;
- d.upaya penanganan dan pemulihan yang telah, sedang, dan akan dilakukan; dan
- e.jangka waktu pemberitahuan kepada Subjek Data Pribadi dan Lembaga.
Draft Pasal 125 used wajib twice, to compose the documentation and to send it to the authority. Enacted Pasal 116 drops the word in both places and shortens the required contents from eight items to five. Pasal 116 does not appear in the sanction list at Pasal 184(1).
The notification duty itself did not soften: Pasal 114 keeps the 3x24 hour clock to both the subject and the Lembaga and remains sanction-backed under Pasal 184(1). What softened is the evidentiary layer beneath it. Dropping wajib and leaving Pasal 116 out of the Pasal 184(1) list means the documentation that would prove a notification was timely and complete is now the least enforceable part of the breach regime.
The contents shrank as well, losing the cause of the failure, its chronology and the conclusion on whether personal data was in fact disclosed, which are the three items an examiner would use to test the timing of the notification.
Keep producing incident documentation regardless. It is what you will be asked for at examination.
Where Europe stands diverges GDPR Articles 32, 33, 34
The provision. GDPR Article 33(1) requires notification to the supervisory authority without undue delay and where feasible within 72 hours of the controller becoming aware of a breach, unless the breach is unlikely to result in a risk to rights and freedoms.
Against Indonesia. The clock is the difference that gets missed, and it is a difference about the start, not the length.
Compared at UU Pasal 46, where the full comparison sits.
What is inside this theme
4 changes, 3 of which shift an obligation. Pick one, or step through them in order.
Ministry designation of further specific data loses its criteria
- a.data dan informasi kesehatan;
- b.data biometrik;
- c.data genetika;
- d.catatan kejahatan;
- e.data anak;
- f.data keuangan pribadi; dan/atau
- g.data lainnya sesuai dengan ketentuan peraturan perundang-undangan.
- a.
tindakan diskriminatif kepada SubjekDataPribadi; - b.
kerugian materiel dan/atau imaterielSubjek Data Pribadi;atau - c.
dampak lainnya yang bertentangan dengan peraturan perundang-undangan.
- a.data dan Informasi kesehatan;
- b.data biometrik;
- c.data genetika;
- d.catatan kejahatan;
- e.data Anak;
- f.data keuangan pribadi; dan/atau
- g.data lainnya sesuai dengan ketentuan peraturan perundang-undangan.
The draft said further specific data dapat ditentukan by a ministry or agency after coordinating with the authority. The enacted Pasal 6(2) states that it ditentukan by the ministry or agency and moves coordination to Pasal 6(3), where it accompanies the determination rather than preceding it. The enacted text also deletes the three designation criteria in RPP Pasal 7(2), keeping only the bare greater impact test at Pasal 6(4).
The draft expressed sectoral expansion of the specific data category as a permission exercisable after coordination; the enacted text expresses it as the ministry's own determination. PP Pasal 6(2) drops dapat, and PP Pasal 6(3) requires coordination with the Lembaga in the course of the determination rather than before it, which removes the sequencing RPP Pasal 7(3) imposed.
The criteria that disciplined such a designation, namely discriminatory treatment, material or immaterial loss, or other unlawful impact under RPP Pasal 7(2), are gone, and PP Pasal 6(4) retains only the untested dampak lebih besar formula. A controller in a regulated sector should expect the specific data category to expand by sectoral instrument, with no enumerated yardstick against which the designation can be tested.
Track sectoral regulators as well as the Lembaga for additions to the specific personal data category.
Where Europe stands diverges GDPR Articles 9, 10
The provision. GDPR Article 9(1) prohibits processing of a closed list of special categories: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data processed for the purpose of uniquely identifying a person, health data, and data concerning sex life or sexual orientation.
Against Indonesia. The largest difference is structural and it is easy to miss while the two lists are being compared.
Compared at UU Pasal 4, where the full comparison sits.
Lifecycle duties dropped and the correction duty recast as a right
Dalam rangka pemerolehan dan pengumpulan Data Pribadi sebagaimana dimaksud dalam Pasal 9 huruf a, Pengendali Data Pribadi harus:
- a.
menentukan dasar pemrosesan sebelum melakukanpemerolehan dan pengumpulanData Pribadi; - b.
menentukan secara jelas tujuan dari pemerolehandanpengumpulan Data Pribadi, dengan mempertimbangkan kepentingan Subjek Data Pribadi; - c.
membatasi besaran Data Pribadi yang dikumpulkan berdasarkan tujuan yang telah ditentukan; - d.
menentukan mekanisme yang aman dalam pemerolehandanpengumpulan Data Pribadi; - e.
memberikan informasi terkait tujuan pemrosesan sebelum dilakukan pemerolehan dan pengumpulan Data Pribadi; dan - f.
menerapkan prinsip -prinsip pemrosesan Data Pribadi dalam hal pemerolehan dan pengumpulan Data Pribadi sesuai ketentuan peraturan perundang-undangan.
Dalam rangka pengolahan dan penganalisisan Data Pribadi sebagaimana dimaksud dalam Pasal 9 huruf b, Pengendali Data Pribadi harus:
- a.
menentukan mekanisme dan/atau standar penerapan kualitas data untuk memastikan bahwa Data Pribadi yang diolah dan dianalisis telah akurat dan lengkap; - b.
memberikan informasi kepada Subjek Data Pribadi jika terdapat pengolahan dan penganalisisan Data Pribadi di luar atau sebagai tambahan tujuan dari tujuan awal pengolahan dan penganalisisan Data Pribadi; - c.
melakukan penilaian dampak Pelindungan Data Pribadi untuk pengolahan dan penganalisisan Data Pribadi yang memiliki potensi risiko tinggi terhadap Subjek Data Pribadi; - d.
memfasilitasi hak Subjek Data Pribadi untuk mengajukan keberatan atas tindakan pengambilan keputusan yang hanya didasarkan pada pemrosesan secara otomatis; dan - e.
menerapkan prinsip -prinsip pemrosesan Data Pribadi dalam hal pengolahan dan penganalisisan Data Pribadi sesuai dengan ketentuan peraturan perundang - undangan.
Dalam rangka penyimpanan Data Pribadi sebagaimana dimaksud dalam Pasal 9 huruf c, Pengendali Data Pribadi harus:
- a.
menentukan dan menerapkan pengendalian keamanan Data Pribadi yang disimpan baik secara fisik maupun elektronik; - b.
menetapkan dan menerapkan mekanisme retensi Data Pribadi; - c.
menentukan masa retensi Data Pribadi sesuai dengan ketentuan peraturan perundang-undangan; - d.
menerapkan pencegahan kegagalan Pelindungan Data Pribadi dalam hal penyimpanan Data Pribadi dengan: 1. menerapkan enkripsi dan/atau penyamaran data; 2. membuat salinan cadangan terhadap Data Pribadi; dan 3. melakukan enkripsi dan/atau penyamaran data terhadap salinan cadangan Data Pribadi. e. membatasi pihak -pihak yang dapat mengakses Data Pribadi; - f.
mengetahui, mencatat dan/atau mendokumentasikan lokasi penyimpanan, dan media penyimpanan Data Pribadi; dan - g.
menerapkan prinsip -prinsip pemrosesan Data Pribadi dalam hal penyimpanan Data Pribadi sesuai dengan ketentuan peraturan perundang-undangan.
Dalam rangka perbaikan dan pembaruan Data Pribadi sebagaimana dimaksud dalam Pasal 9 huruf d, Pengendali Data Pribadi harus:
- a.
memfasilitasi Subjek Data Pribadi untuk melengkapi, memperbarui, dan/atau memperbaiki kesalahan dan/atau ketidakakuratan Data Pribadi; - b.
melakukan verifikasi Data Pribadi dari Subjek Data Pribadi; dan - c.
menerapkan prinsip -prinsip pemrosesan Data Pribadi dalam hal perbaikan dan pembaruan Data Pribadi sesuai dengan ketentuan peraturan perundang - undangan.
Dalam rangka penampilan, pengumuman, transfer, penyebarluasan, atau pengungkapan Data Pribadi sebagaimana dimaksud dalam Pasal 9 huruf e, Pengendali Data Pribadi harus:
- a.
memiliki dasar pemrosesan Data Pribadi sebelum menampilkan, mengumumkan, mentransfer, menyebarluaskan atau mengungkap Data Pribadi, kecuali ditentukan lain oleh peraturan perundang - undangan; - b.
mematuhi kriteria transfer Data Pribadi ke luar wilayah hukum Negara Republik Indonesia sebagaimana diatur dalam ketentuan peraturan perundang-undangan; - c.
menerapkan pengendalian keamanan Data Pribadi sesuai dengan ketentuan peraturan perundang - undangan; - d.
membatasi pengungkapan Data Pribadi sesuai tujuan pemrosesan yang telah ditentukan dan disetujui oleh Subjek Data Pribadi, serta tidak bertentangan den gan peraturan perundang-undangan; dan - e.
menerapkan prinsip -prinsip pemrosesan Data Pribadi dalam hal penampilan, pengumuman, transfer, penyebarluasan, atau pengungkapan Data Pribadi sesuai dengan ketentuan peraturan perundang - undangan.
Dalam rangka penghapusan atau pemusnahan Data Pribadi sebagaimana dimaksud dalam Pasal 9 huruf f, Pengendali Data Pribadi harus:
- a.
menghapus a tau memusnahkan Data Pribadi kecuali dalam masa retensi sesuai dengan kebutuhan berdasarkan ketentuan peraturan perundang - undangan; - b.
menerapkan mekanisme penghapusan atau pemusnahan Data Pribadi yang aman; - c.
memfasilitasi pemenuhan hak Subjek Data Pribadi untuk melakukan penghapusan data, sepanjang tidak bertentangan dengan ketentuan peraturan perundang- undangan; - d.
melakukan tindakan dalam permintaan Subjek Data Pribadi untuk menghapus Data Pribadi valid/sah dan tidak bertentangan dengan ketentuan peraturan perundang-undangan, dengan: 1. melakukan penghapusan atau pemusnahan Data Pribadi sesuai dengan ketentuan peraturan perundang-undangan; 2. melakukan penghapusan atau pemusnahan Data Pribadi di semua lokasi penyimpanan Data Pribadi; 3. menyimpan bukti penghapusan atau pemusnahan Data Pribadi dalam bentuk berita acara penghapusan; dan 4. menyampaikan bukti penghapusan atau pemusnahan Data Pri badi kepada Subjek Data Pribadi; dan - e.
menerapkan prinsip -prinsip pemrosesan Data Pribadi dalam hal penghapusan atau pemusnahan Data Pribadi sesuai ketentuan peraturan perundang-undangan.
Pemrosesan Data Pribadi meliputi:
- a.pemerolehan dan pengumpulan;
- b.pengolahan dan penganalisisan;
- c.penyimpanan;
- d.perbaikan dan pembaruan;
- e.penampilan, pengumuman, transfer, penyebarluasan, atau pengungkapan; dan/atau
- f.penghapusan atau pemusnahan.
Subjek Data Pribadi berhak melengkapi, memperbarui, dan/atau memperbaiki kesalahan dan/atau ketidakakuratan Data Pribadi tentang dirinya sesuai dengan tujuan pemrosesan Data Pribadi.
RPP Pasal 10 to Pasal 15 attached a Pengendali Data Pribadi harus checklist to each of the six processing stages listed in RPP Pasal 9. PP 33/2026 keeps the enumeration at Pasal 8 and attaches no checklist to it. One item survives in changed form.
RPP Pasal 13 huruf a put memfasilitasi Subjek Data Pribadi untuk melengkapi, memperbarui, dan/atau memperbaiki kesalahan dan/atau ketidakakuratan Data Pribadi on the Pengendali Data Pribadi as a duty, and PP Pasal 70 states that same conduct as a right of the Subjek Data Pribadi over data tentang dirinya, qualified by sesuai dengan tujuan pemrosesan Data Pribadi.
The draft regulated the lifecycle stage by stage. The enacted text keeps the stages as a list at Pasal 8 and attaches no duty to any of them. That is a narrowing, not a clean deletion. Perbaikan dan pembaruan reappears at PP Pasal 70, addressed to the Subjek Data Pribadi as a right rather than to the Pengendali Data Pribadi as a duty.
Both texts run on the subject acting, so what changes is who the provision addresses and the two added limits, tentang dirinya and sesuai dengan tujuan pemrosesan Data Pribadi. Whether a controller must give effect to that right is not stated by Pasal 70 and is not settled by anything compared here.
The rest of RPP Pasal 13 has no counterpart at Pasal 70, neither verifikasi Data Pribadi dari Subjek Data Pribadi at huruf b nor the processing principles at huruf c. RPP Pasal 14 huruf b is a different case.
PP Pasal 174 shares the phrase transfer Data Pribadi ke luar wilayah hukum Negara Republik Indonesia but governs a different object, deferring pelaksanaan persetujuan to a Peraturan Lembaga, so it does not carry the compliance duty forward. Two storage items from the draft are gone. RPP Pasal 12 huruf d angka 2 and angka 3 named salinan cadangan terhadap Data Pribadi and enkripsi dan/atau penyamaran data of those copies.
Neither is in Pasal 8, and neither has an equivalent in the articles set against it here.
Do not read the missing checklist as relief. Rebuild it internally, and treat PP Pasal 70 as the enacted route for perbaikan dan pembaruan Data Pribadi.
Where Europe stands aligned GDPR Articles 16, 19
The provision. GDPR Article 16 gives the data subject the right to obtain rectification of inaccurate personal data without undue delay, and to have incomplete data completed, including by a supplementary statement, having regard to the purposes of the processing.
Against Indonesia. UU Pasal 6 reaches the same two acts as GDPR Article 16, correction of inaccuracy and completion of what is incomplete, but it does not track the article's shape: the limbs run in the reverse order, memperbarui is added as a third act, and the purpose qualifier closes the whole right where GDPR Article 16 attaches it only to the completion limb. Also compared at UU Pasal 16, UU Pasal 30.
Compared at UU Pasal 6, where the full comparison sits.
The rule making a data requester a controller is deleted
- a.Subjek Data Pribadi;
- b.Pengendali Data Pribadi; dan/atau
- c.Prosesor Data Pribadi.
Pihak dalam pemrosesan Data Pribadi yang diatur dalam Peraturan Pemerintah ini terdiri atas:
- a.Subjek Data Pribadi;
- b.Pengendali Data Pribadi; dan/atau
- c.Prosesor Data Pribadi.
RPP Pasal 16 ayat (3) deemed any party requesting personal data to be a controller. PP Pasal 10 lists the three parties to processing that the Regulation governs and carries no such deeming rule. The other limb survives: the rule in RPP Pasal 16 ayat (2) sits in the definitions at PP Pasal 1 angka 6, so it is not deleted.
The draft resolved the status of a party demanding personal data; the enacted text does not. RPP Pasal 16 ayat (3) fixed controller responsibility on recipients who never handled the data themselves, which mattered most for group companies, platforms and public bodies issuing data requests.
PP Pasal 10 lists the parties and stops there, so controller status on inbound and outbound data requests now follows from the functional definition at PP Pasal 1 angka 4 alone, which turns on who determines the purpose and exercises control over the processing. The other limb of RPP Pasal 16 is intact.
Its ayat (2) states the same rule as PP Pasal 1 angka 6, so the data subject is defined once in the definitions article instead of being restated in the article on parties. The deeming rule is the limb with no counterpart in the enacted article.
Assign controller status expressly in data sharing agreements because the Regulation no longer deems the requesting party a controller.
Where Europe stands diverges GDPR Articles 2, 4
The provision. GDPR Article 4(7) defines a controller functionally, as the natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of processing.
Against Indonesia. Both texts reach much the same set of addressees by different routes.
Compared at UU Pasal 19, where the full comparison sits.
Scope list drops authority powers and adds supervision
Ruang Lingkup Peraturan Pemerintah ini meliputi:
- a.Data Pribadi;
- b.pemrosesan Data Pribadi;
- c.hak dan kewajiban;
- d.transfer Data Pribadi;
- e.Kerja Sama Internasional;
- f.
kewenangan Lembaga Pelindungan Data Pribadi; - g.sanksi administratif; dan
- h.penyelesaian Sengketa
dan hukum acara.
Ruang lingkup Peraturan Pemerintah ini meliputi:
- a.Data Pribadi;
- b.pemrosesan Data Pribadi;
- c.hak dan kewajiban;
- d.transfer Data Pribadi ke luar wilayah hukum Negara Republik Indonesia;
- e.Kerja Sama Internasional;
- f.partisipasi masyarakat;
- g.pengawasan terhadap kepatuhan Pengendali Data Pribadi;
- h.sanksi administratif; dan
- i.penyelesaian Sengketa.
The draft scope list included the powers of the Lembaga PDP and dispute resolution together with procedural law. The enacted list replaces those with public participation and supervision of controller compliance, and narrows the transfer head to transfers out of Indonesian jurisdiction.
The scope list records the structural rearrangement between the two texts. The draft's Chapter VII on the powers of the Lembaga PDP has no counterpart chapter in the enacted text: its supervision section at RPP Articles 203 to 205 returns as Chapter VIII at PP 33/2026 Articles 180 to 183, while its policy making, law enforcement assistance and public interest litigation sections have no enacted home at all.
Procedural law drops out of the scope list and out of the chapter title, and PP 33/2026 Pasal 200(2) sends the hukum acara to the general law, even though the dispute chapter itself grows from RPP Articles 227 to 244 to PP 33/2026 Articles 200 to 222 and keeps the mediation procedure in detail. A reader looking for the authority's investigative and decision making powers must now assemble them from Chapters VIII and IX rather than from a dedicated chapter.
Do not cite draft Chapter VII; the authority's powers now sit across Chapters VIII and IX.
Where Europe stands diverges GDPR Articles 2, 3
The provision. GDPR Article 2 sets material scope: processing wholly or partly by automated means, plus non-automated processing of data in a filing system.
Against Indonesia. The extraterritorial trigger differs on both sides.
Compared at UU Pasal 2, where the full comparison sits.
What is inside this theme
2 changes, 2 of which shift an obligation. Pick one, or step through them in order.
The draft applied on promulgation and the enacted text waited
Peraturan Pemerintah ini mulai berlaku pada tanggal diundangkan.
Peraturan Pemerintah ini mulai berlaku setelah 6 (enam) bulan terhitung sejak tanggal diundangkan.
Immediate application became a six-month delay, which places the commencement date at 16 January 2027.
Had the draft been adopted as it stood, all 245 articles would have bound every controller on the day of promulgation. The enacted text grants six months from the 16 July 2026 promulgation recorded in Pasal 225, and Pasal 223 adds a second cushion by allowing processing to continue so long as it does not conflict with this regulation until the Peraturan Lembaga on processing are issued.
Pasal 224 holds existing personal data legislation in force on the same non-conflict test. Thirty four articles across the instrument defer a mechanism to a Peraturan Lembaga, and the twelve on cooperation, public participation, supervision, sanctions and disputes fall outside the Pasal 223 cushion.
16 January 2027 is the date. Pasal 223 is what you rely on for processing rules not yet issued.
Where Europe stands diverges GDPR Articles 94, 99
The provision. GDPR Article 99(1) sets entry into force at the twentieth day following publication in the Official Journal, which was 24 May 2016.
Against Indonesia. GDPR Article 99 separates two dates that UU Pasal 76 keeps together.
Compared at UU Pasal 76, where the full comparison sits.
Transitional article added for the gap before Lembaga rules
The draft had no such provision.
Sampai dengan ditetapkannya Peraturan Lembaga terkait pemrosesan Data Pribadi, Pengendali Data Pribadi dan/atau Prosesor Data Pribadi melakukan pemrosesan Data Pribadi sepanjang tidak bertentangan dengan ketentuan Peraturan Pemerintah ini.
The draft had no transitional provision for controllers. The enacted text adds Pasal 223, allowing processing to continue until the Peraturan Lembaga on processing are issued so long as it does not conflict with the regulation, and Pasal 224 saves existing personal data legislation on the same condition.
The draft left twenty four matters to a Peraturan Lembaga PDP without saying what governed in the interval, so a controller reading it had no answer for the period before those rules appeared. Pasal 223 closes that gap by making the regulation itself the interim standard, and Pasal 224 preserves existing personal data rules to the extent they are consistent.
The condition is conflict with this regulation, not conflict with a future Peraturan Lembaga, so the yardstick for the interim period is the enacted text alone. What remains unoperationalised is the test for conflict, which no provision defines.
Map current processing against the enacted articles rather than waiting for Peraturan Lembaga, because Pasal 223 makes the regulation the interim benchmark.
Where Europe stands diverges GDPR Article 99
The provision. GDPR Article 99 has two paragraphs.
Against Indonesia. Both instruments buy two years, in different places.
Compared at UU Pasal 74, where the full comparison sits.
The four relations, and what we have read to say so
Every GDPR panel in the tracker is written from two corpora held on disk, the EDPB guidance and the judgments of the Court of Justice. These slides turn that index around: start from a guideline or a judgment and see which articles of UU 27/2022 it bears on.
The Indonesian wording or structure tracks the GDPR closely enough to read as a transposition.
9 articlesThe same protective work is done, by a route of its own rather than by the GDPR mechanism.
5 articlesThe mechanism, the threshold or the actor differs, so the same words do not produce the same result.
61 articlesThe article has no counterpart in the GDPR at all.
1 articlesThe count is not a verdict on the statute. Most of it records a structural fact: the GDPR carries its detail in the Regulation, and UU 27/2022 carries much of its detail in PP 33/2026 and in the Peraturan Lembaga still to come, so the two texts rarely put the same rule in the same place.
State access, and the test an adequacy assessment runs
Recommendations 02/2020 on the European Essential Guarantees for surveillance measures, adopted 10 November 2020, sets out four European Essential Guarantees. A third country regime has to meet all four before an interference with privacy can be treated as justified.
Processing on clear, precise and accessible rules. Necessity and proportionality actually demonstrated. An independent oversight mechanism. An effective remedy available to the individual. They are drawn from the case law rather than from the Regulation, which is why the judgments below are cited by no article of the statute.
The state access findings in this comparison, the lost attachment requirement, the widened signing authority and the deleted requester identity limbs, are exactly what Guarantee A and Guarantee C ask about. The exception regime sits at UU Pasal 15 and UU Pasal 50, the transfer cascade at UU Pasal 56.
Reading these They are held for the state access question and cited by no article, which is a statement about the corpus rather than about their weight.
The EDPB guidance behind the panels
22 instruments cited across the reading pages, each fetched and title matched against its own PDF before it could be cited.
The judgments of the Court behind the panels
55 judgments cited across the reading pages, each resolved through EUR-Lex by its CELEX number, so an invented case reference cannot enter the corpus.
No decision of a national supervisory authority is cited anywhere: the obvious source sits behind a proof of work wall, and getting around bot detection is not something this project does. Three EDPB adequacy opinions are served as damaged files and are recorded as unverified, with nothing cited from them.
Every clause on these slides was checked against both texts
Both instruments were parsed to article level and matched by subject matter rather than by number, because numbering did not survive: of 321 comparable pairs only around 36 carried across almost word for word. Each quotation was then verified mechanically against the source files, and any claimed difference that turned out to be a provision which had merely moved was discarded.
UU No. 27 of 2022 and PP No. 33 of 2026, official copies, both linked article by article in the full tracker. The 2023 draft is a working document and is cited by article without a link.
The full tracker carries both instruments in full, article by article, with a GDPR comparison on every statutory article.
Arrow keys move between slides. Jump by theme, by workstream, or narrow to the material changes.