Lawful access isnow disproportionate?

Will Indonesia's warrantless data access mechanism survive the adequacy test?

Indonesia, lawful access swipe

Practitioner(notes) No. 02 · August 2026

The demand lost its paperwork.

The 2023 draftWhat an official had to bringThe paperwork that authorised the request, attached to the demand.A signature from a national or provincial chief, the Attorney General, or a presiding judge.Named regulators, and named officials, for each exception.

PP 33/2026What an official has to bring nowNothing attached. The letter states its own authority.A signature from a district commander, or from any designated official.No named regulators, and no statement of who may invoke an exception.

Read against the draft of 31 August 2023.

Indonesia, lawful access 2 / 6

Practitioner(notes) No. 02 · August 2026

Concerns and observations

The request lost its evidenceAn official used to attach the paperwork that authorised the demand. Now the letter simply asserts its own authority, and the company holding the data has nothing independent to check it against.
It can be signed much further downAuthority to sign now reaches district commanders and, in every case, any official who has been designated. The draft stopped at national chiefs, the Attorney General and a presiding judge.
The exceptions stopped saying who may use themThe draft named the officials and the regulators entitled to invoke each exception. The final text names nobody, so the question of who is asking has no answer on the face of the rule.

Indonesia, lawful access 3 / 6

Practitioner(notes) No. 02 · August 2026

The test Europe would apply

diverges

Europe makes the access law itself say who may demand data and on what basis, and the European Essential Guarantees are part of what an adequacy assessment then tests.

EDPB Recommendations 02/2020 set four guarantees for state access: rules that are clear, precise and public; necessity and proportionality shown; independent oversight; and an effective remedy.
Guarantee C asks for oversight by a judge or another independent body, and in La Quadrature du Net the Court required prior review by a court or an independent authority whose decision is binding.
Schrems II held that a surveillance power which states no limit on itself and no safeguard for the people it may target fails the clear and precise rules Guarantee A asks for.

EDPB Recommendations 02/2020C-311/18 Schrems IIC-623/17 Privacy InternationalC-511/18 La Quadrature du NetEDPB and CJEU, cited from the stored corpus

Indonesia, lawful access 4 / 6

Practitioner(notes) No. 02 · August 2026

What to do with a demand

Verify the letterPP Pasal 155 ayat (2) still fixes what the letter must state, including the dasar kewenangan. That list is now the only test you have.

Record every requestThe independent artefact is gone, so your own file is the record of what was asked, by whom, and on what stated authority.

Know the two limits that survivePP Pasal 155 ayat (1) drops penyelidik, so a demand at the penyelidikan stage can be refused, and PP Pasal 166 sends outbound law enforcement exchange through the transfer cascade.

Indonesia, lawful access 5 / 6

Practitioner(notes) No. 02 · August 2026

The full tracker carries every article of both instruments, side by side.

Follow for the next issue

Muhammad Deckri Algamar, LL.B, LL.M*, AIGP

Indonesia, lawful access 6 / 6