By Muhammad Deckri Algamar, AIGP With Prof. Abu Bakar Munir
Powered by
Executive summary Salinan v5.8 · 28 Sep 2026
Indonesia · personal data protection · executive brief
What the enacted regulation changed
PP 33/2026 keeps the 2023 draft's architecture and removes its compulsion: wajib falls from 167 uses to 49, dilarang from three to none, and 34 articles hand their mechanism to a Peraturan Lembaga that has not been issued, so from 16 January 2027 the content the draft would have compelled sits in contracts and in rules still unwritten.
By Muhammad Deckri Algamar, AIGP With Prof. Abu Bakar Munir
83 of 112findings that weaken a protection, against 26 that strengthen one
118mandatory wajib duties dropped, from 167 uses to 49
0prohibitions left in the text, dilarang fell from 3
34articles waiting on a Peraturan Lembaga, up from 24 in the draft
12changes that ease state and law enforcement access to data
16 January 2027the date the first duty binds, six months after promulgation
PP 33/2026 against the draft of 31 August 2023.
Every number on these pages is counted from the two texts or from the 112 differences found between
them. None is estimated.
01 / 10
02The shape of the redraft
The architecture survived. The compulsion did not.
The draft ran to 245 articles and the enacted text has 225. Almost nothing was
restructured. What changed sits inside the articles that stayed.
The 112 differences by what happened to the provision.
Deletion, narrowing and a softened duty verb account for 77 of them.
How much of it matters
72 of the 112 shift an obligation materially. The rest are
wording, renaming or relocation.
Only 7 changes add something that was not in the draft.
Read the redraft as subtraction. Twenty seven provisions were deleted outright and twenty five narrowed, against seven additions.
PP 33/2026 against the 2023 draft
03The mandatory voice
Wajib fell by 118 uses. Dilarang disappeared.
Counted across the full text of both instruments. Wajib is the mandatory form that
Indonesian administrative practice treats as creating a duty, and it is the form the sanction list
in Pasal 184 ayat (1) hangs on. Harus is directive but weaker. Dapat is permissive.
Instances of each verb form across all articles of each
instrument.
Why this is the whole story
A duty that keeps its content but loses wajib still describes what good practice looks
like. It stops being the thing a regulator can point at.
Twenty five of the 112 differences are exactly this move and nothing else. The obligation
reads the same and is no longer written as compulsory.
The three prohibitions in the draft, written dilarang, are gone. The enacted text
prohibits nothing in those terms.
Test every control you built against the draft. If it relied on the text being mandatory, check whether the enacted wording still is.
PP 33/2026 against the 2023 draft
04Where the changes land
Controller duties took a third of it
Every difference sits in one of eight domains. The verdict beside each is the
direction that domain moved once each change was read for what it does, not for how it was made.
Differences per domain, with the part that shifts an
obligation shown solid.
Direction by domain
Controller dutiesmixed
Lawful bases and consentmixed
Subject rightsmuch weaker
Cross-border transferweaker
Sanctions and enforcementweaker
Breachmixed
Scope and definitionsmixed
Final provisionsmixed
Four domains moved in both directions and are marked mixed. Reporting
those as weakening would be wrong.
Subject rights is the only domain that moved one way and moved a long way. It is where the enacted text is furthest from the draft.
PP 33/2026 against the 2023 draft
05The direction of travel
83 changes weaken a protection. 26 strengthen one.
Each of the 112 differences was read for its effect on the data subject, then
checked by a second reader instructed to refute the reading. A deleted exemption strengthens
protection; a widened permission weakens it, so the type of change does not decide its direction.
Findings that weaken protection, left, against those
that strengthen it, right.
The countercurrent is real
Consent became harder to rely on, breach notification lost its exemption so more incidents
are reportable, and the public task basis lost a limb.
Those gains are concentrated. They do not offset the losses in subject rights, where the
enacted text takes away the notice content schedule, the grounds for refusing a correction and
the relief from proving loss.
The ratio is roughly three to one against the subject, and the strengthening is concentrated in consent and breach rather than spread across the instrument.
PP 33/2026 against the 2023 draft
06Who gains
Seven in ten changes hand ground to the controller
Read as a question of who is better off under the enacted text than under the
draft. This counts every difference, not only the material ones.
Beneficiary of each change
Controllers and processors71
Government and law enforcement12
Data subjects20
The supervisory institution6
No one, structural3
The twenty that favour the subject are not trivial, but they cluster in
consent validity and breach notification rather than in the rights a subject exercises directly.
The twelve that favour the state are the subject of the next page.
No domain shifted toward the supervisory institution. Its six gains are reporting duties owed to it, not powers it acquired.
PP 33/2026 against the 2023 draft
07State access to data
Easier for the state and moving both ways
12 of the 112 differences ease government or law enforcement access to
personal data, and 11 of those shift an obligation materially. They run to the substance
of a demand: who may make it, what must accompany it, how far down a chain of command it may be
signed, and what the recipient owes once it holds the data. Five clause level changes cut the other
way, so this domain must not be reported as moving in one direction.
The 12 findings that ease state access, against the other
100 differences.
What moved toward the state
RPP Pasal 177 ayat (4) required a demand to be accompanied by a police report and investigation order, a prosecutor's appointment letter or a panel determination.
PP Pasal 155 ayat (4) extends signing authority to a kepala kepolisian resor, to district and branch prosecution heads and, in every limb, to a pejabat yang ditunjuk, where RPP Pasal 177 ayat (5) stopped at national and provincial police heads, the Attorney General, high prosecution office heads.
PP Pasal 157 ayat (1) states that the controller or processor memberikan the data on a request under Pasal 155, dropping both the wajib and the permintaan yang sah qualifier of RPP Pasal 178 ayat (1), and Pasal 157 is absent from the sanction list at PP Pasal 184 ayat (1).
PP Pasal 151, Pasal 152 and Pasal 153 delete the requester identity limb carried by RPP Pasal 173 huruf d, Pasal 174 huruf d and Pasal 175 huruf d, so the law enforcement, public interest and financial supervision exceptions no longer say who may invoke them.
What moved against it
Five changes cut the other way and two of them reach that substance. PP Pasal 155 ayat (1) drops penyelidik, which goes to who may make a demand, so a demand at the penyelidikan stage can be refused. PP Pasal 155 ayat (2) huruf g makes the letter state its own basis of authority. PP Pasal 166 sends law enforcement exchange leaving Indonesian jurisdiction through the transfer cascade at PP Pasal 165.
The enacted text says nothing about a demand arriving from a foreign authority.
RPP Pasal 191 recognised a foreign court, tribunal or administrative order only where an
international agreement supported it. Nothing replaces it.
The single largest exposure is the one that is not written down. Compelled disclosure to a foreign authority is now unaddressed by the transfer chapter.
PP 33/2026 against the 2023 draft
08What was removed
Twenty seven provisions were deleted outright
These are the deletions that shift an obligation. Each was checked against the
whole enacted text before being called a deletion, because a clause that moved to an article the
comparison did not name would otherwise read as removed.
Breaches without disclosure lost their notification exemptionBreaches that disclosed nothing must now be notified, because the old exemption is gone.
Internal and external audit programme deleted and delegatedThe detailed audit and processor vetting programme is deleted and left to a rule not yet made.
Penalty for late compliance with a decision is goneIgnoring a regulator decision no longer triggers an automatic late payment penalty.
Ban on cameras in areas of private expectation is deletedThe ban on cameras in areas of privacy expectation has been deleted entirely.
Bank Indonesia OJK and LPS no longer named as sole requestersFinancial supervision demands are no longer limited to Bank Indonesia, OJK and LPS.
Duty to explain a refusal after legal dissolution is deletedA dissolved controller owes no explanation when a subject right cannot be honoured.
Investigator duty to delete data after use is replaced by a labelLaw enforcement recipients lose an express duty to delete case data and are simply labelled controllers instead.
Police report and court order no longer attach to a data demandData demands no longer need a police report or court order attached, only a stated basis of authority.
Requester need no longer be a competent law enforcement officerAnyone can invoke the law enforcement exception because the competent officer requirement was deleted.
20 of the 27 deletions shift an obligation materially. The rest removed wording that was duplicated elsewhere.
PP 33/2026 against the 2023 draft
09What is deferred, and the clock
34 articles hand their mechanism to rules not yet issued
The draft deferred 24 mechanisms to a Peraturan Lembaga. The enacted text defers 34.
Pasal 223 requires processing to conform to this regulation until the Peraturan Lembaga on
processing is issued, so the duty to comply does not wait for it.
Articles deferring a mechanism to a Peraturan
Lembaga.
What this means in practice
The audit regime, the impact assessment method, the adequacy list and the transfer approval
procedure are all deferred. Each is a control an organisation is expected to operate from
16 January 2027 without the rule that describes it.
Build to the regulation and to the draft's own detail where the enacted text is silent. The
draft is the best available statement of what the regulator had in mind.
Nothing is suspended while the rules are outstanding. Pasal 223 holds processing to the regulation until the rule on processing is issued.
PP 33/2026 against the 2023 draft
10What to do about it
Where the text stopped compelling the contract has to
One action per domain, taken from the finding with the largest effect in that
domain. Each is written against a provision of the enacted text, so it can be checked.
Cross-border transferMake acceptance of access terms a contractual condition of data-room entry.
Sanctions and enforcementAdvise on breach exposure on the basis that the authority cannot sue for subject compensation, and model civil claims separately.
Controller dutiesRun the RPP Pasal 135 due diligence and audit programme as internal policy and watch for the Peraturan Lembaga.
Lawful bases and consentKeep age assurance on any service children can reach; Pasal 38(1) no longer compels it but Pasal 38(2) still applies.
Subject rightsKeep the accuracy and mitigation evidence in the impact assessment file, since that is where a supervisor will look for it.
BreachState impact in the notice anyway; the enacted minimum does not equal a defensible notice.
Scope and definitionsTrack sectoral regulators as well as the Lembaga for additions to the specific personal data category.
The draft remains useful. Where PP 33/2026 is silent it is the closest evidence of the standard the regulator drafted toward, and it is what the deferred rules will build on.
