Practitioner(notes) No. 03 · August 2026
No. 03

Your processor stepped backYou carry the duty alone

Indonesia's implementing regulation moved the transfer risk assessment onto the controller alone and softened the verb that made it mandatory.

Indonesia PP 33/2026 duties swipe
Practitioner(notes) No. 03 · August 2026

The duty lost a shoulder

2023 draftTwo roles owed the dutyDraft Pasal 194 put the transfer risk assessment on the controller and the processor alike.Draft Pasal 195 placed the pre-transfer notice on the controller and the processor.Both duties used wajib which is the hard mandatory verb in Indonesian drafting.
PP 33/2026One role owes it nowPasal 163 leaves the risk assessment with the controller and drops the promised rule on method.Pasal 164 leaves the notice with the controller and keeps all four items it must contain.Both duties now read harus which sits a step below wajib.

Read against the draft implementing regulation it replaced.

Indonesia PP 33/2026 duties 2 / 6
Practitioner(notes) No. 03 · August 2026

Concerns and observations

  • Your processor owes no transfer noticeA processor moving data under your instruction has no independent duty to warn the subject any more. The only route to that information now runs through you.
  • Processor vetting lost its checklistThe draft spelled out pre-engagement vetting, periodic and exit audits, and publication of the results. Pasal 127 keeps the bare supervision headings and Pasal 128 sends every detail to a rule that does not exist yet.
  • Age checks lost their triggerThe draft caught any service children could reach, the same hook the UK Age Appropriate Design Code uses. Pasal 38(1) now turns on the purpose of processing, so a general audience platform can argue its purpose does not concern children and skip the identification step.
Indonesia PP 33/2026 duties 3 / 6
Practitioner(notes) No. 03 · August 2026

How Europe splits the same duty

diverges

Europe puts the transfer conditions on the controller and the processor together under Article 44, and fixes in the contract what the processor has to do.

  • GDPR Article 28(3) fixes the terms a processor contract must carry, from documented instructions to an audit right for the controller, and EDPB Guidelines 07/2020 say it should set the terms for transfers out of the EU.
  • Article 28(4) keeps the first processor fully liable to the controller for the performance of any sub processor it engages, and C-683/21 held that a controller can still be fined for what its processor did on its behalf.
  • EDPB Guidelines 07/2020 read the Article 28(1) duty on the controller to check a processor as a continuing one, to be run again at appropriate intervals rather than once at selection.
EDPB Guidelines 07/2020C-683/21 Nacionalinis visuomenes sveikatos centrasEDPB and CJEU, cited from the stored corpus
Indonesia PP 33/2026 duties 4 / 6
Practitioner(notes) No. 03 · August 2026

What controllers should do now

Put the assessment input in the contractPasal 163 leaves the transfer risk assessment with you and no rule says how to run it. Your processor cannot carry it, so the contract has to compel the inputs and treat processor notice as a pass-through.
Keep the deleted audit programmeRun the draft vetting and audit programme as internal policy anyway. Pasal 128 leaves the detail to a rule the authority has not written yet and the draft text is the closest standard you have.
Keep age assurance where children reach youPasal 38(1) no longer forces identification on services children can access, but Pasal 38(2) still demands parental consent with the hard verb. If you cannot tell who is a child, you cannot meet the consent duty.
Indonesia PP 33/2026 duties 5 / 6
Practitioner(notes) No. 03 · August 2026

The full tracker carries every article of both instruments, side by side.

Follow for the next issue
Muhammad Deckri Algamar, LL.B, LL.M*, AIGP
Indonesia PP 33/2026 duties 6 / 6