Practitioner(notes) No. 01 · September 2026
No. 01

1,368 daysof waiting

Are Indonesia's data protection rules operable at all?

Indonesia, personal data protection swipe
Practitioner(notes) No. 01 · September 2026

Shifting the responsibility lower down the chain

  1. The law17 Oct 2022UU 27/2022Ten go to a government regulation, one to a presidential regulation on the agency.
    11matters handed down
  2. Two years on17 Oct 2024The adjustment period endsProcessing must now conform to the law, with no regulation and no agency in place.
  3. The regulation16 Jul 2026PP 33/2026, 1,368 days laterNine of the ten come back with a further deferral. The 2023 draft deferred 24 articles.
    34articles left to agency rules
  4. In force16 Jan 2027The regulation bindsIt sets no deadline for any of the agency rules it relies on.
  5. The agencyNo datePresidential regulation and agency rulesThe agency has not been created, so none of the agency rules has an author.
    0agency rules issued

Counted from UU 27/2022, the 2023 draft and PP 33/2026. Agency status as reported on 16 September 2026.

Indonesia, personal data protection 2 / 6
Practitioner(notes) No. 01 · September 2026

What was settled and what is still up in the air

UU 27/2022 HANDS DOWNPP 33/2026WHERE IT LANDSSettled in the PPPeraturan Lembaga34 articles in all wait onagency rulesNONE ISSUEDAgency decisionsGuideline, country list,standard clauses, approvalsNONE MADEPerpres: not issuedPasal 48Merger or dissolutionPasal 131-137Pasal 10Automated decisionsPasal 93-96Pasal 12CompensationPasal 105-110Pasal 13PortabilityPasal 111-113Pasal 34Impact assessmentPasal 120-122Pasal 54Data protection officerPasal 142-147Pasal 57Fine procedurePasal 184-199Pasal 61The agency's powersPasal 177-178, 180-183Pasal 16ProcessingRest of Bab III and IVPasal 56Transfers abroadPasal 160-174Pasal 58The agency itself
Answered in the regulation Detail sent to agency rules, not yet written

PP 33/2026 answers ten matters in substance and sends the detail of nine down again. Agency status as reported on 16 September 2026.

Indonesia, personal data protection 3 / 6
Practitioner(notes) No. 01 · September 2026

34 articles left to agency rules

None issued
Pasal 7Combined data
Pasal 48Vital interest
Pasal 50Public task policy
Pasal 52Public task basis
Pasal 57Legitimate interest
Pasal 66Information requests
Pasal 69Accuracy checks
Pasal 73Correction
Pasal 89Erasure
Pasal 96Automated decisions
Pasal 104Restriction
Pasal 110Compensation
Pasal 113Portability
Pasal 119Breach notice
Pasal 122Impact assessment
Pasal 128Processor oversight
Pasal 142Officer: when
Pasal 143Officer: competence
Pasal 144Officer: appointment
Pasal 168Adequacy method
Pasal 172Transfer safeguards
Pasal 174Transfer consent
Pasal 176International cooperation
Pasal 178Foreign regulators
Pasal 179Public participation
Pasal 180Supervision
Pasal 181Orders
Pasal 187Sanction procedure
Pasal 189Complaints
Pasal 194Examination
Pasal 199Sanction decisions
Pasal 202Dispute verification
Pasal 207Mediator registry
Pasal 222Mediation
22 shape what a controller must do12 set how the agency itself works

Each box is an article of PP 33/2026 that hands its detail to a Peraturan Lembaga.

Indonesia, personal data protection 4 / 6
Practitioner(notes) No. 01 · September 2026

My promise

Weekly Practitioner Notes
Selected cases
Free to read

An on-the-ground, honest read of the law. If it doesn't work, it doesn't work.

The topics ahead
  1. Lawful access by the state
  2. Transfer risk assessment
  3. Foreign court orders
  4. Data subject rights
  5. Controller accountability
  6. Impact assessment
  7. Consent and withdrawal
  8. Legitimate interest
  9. Breach notification
  10. Enforcement and redress
  11. Scope and commencement
  12. Emerging issues
Indonesia, personal data protection 5 / 6
Practitioner(notes) No. 01 · September 2026
What Practitioner Notes are

A series compiled from experience in drafting, expert contribution and training on Indonesia's PDP law, seen through a global lens.

Digestible. Less AI slop.

The full tracker sets every article of the law and the regulation side by side.

Follow for the next issue
Muhammad Deckri Algamar, LL.B, LL.M*, AIGP
Indonesia, personal data protection 6 / 6