Practitioner(notes) No. 04 · August 2026
No. 04

The draft had a GDPR Article 48the regulation does not

Indonesia's transfer rules are enacted, and the foreign court order now has to be handled in your contract instead of the regulation.

Indonesia data transfer rules swipe
Practitioner(notes) No. 04 · August 2026

Gates became statements

2023 draftHard gatesA foreign court order worked only where an international agreement stood behind it.RPP Pasal 146(3) made the old controller destroy data it had handed over in a deal.RPP Pasal 152 barred access to the data room until the other party accepted the terms.
PP 33/2026Statements on paperThe transfer chapter says nothing about a foreign court or administrative order.Pasal 133(3)(g) keeps destruction as a statement inside the deal notice to subjects.Pasal 133(6) asks the old controller to prepare access terms and stops there.

Read against the draft implementing regulation it replaced.

Indonesia data transfer rules 2 / 6
Practitioner(notes) No. 04 · August 2026

Concerns and observations

  • Foreign orders meet no answerThe clause that required a treaty behind a foreign court or agency order did not survive into the enacted text. A compelled disclosure demand now runs into a transfer chapter that says nothing about it.
  • Adequacy is measured against lessEquivalence is judged against the statute alone and not the regulation built on it. A destination can be adequate while matching none of the operational duties the regulation just created.
  • Duties turned into disclosuresThe promise to destroy data handed over in a deal now sits in a notice rather than in a standing obligation. Enforcement attaches to the notification and not to the retention.
Indonesia data transfer rules 3 / 6
Practitioner(notes) No. 04 · August 2026

Europe wrote this one down

diverges

A foreign order is not a lawful ground by itself, and the EU says so in the text rather than leaving the question unwritten.

  • GDPR Article 48 lets a third country judgment or administrative decision be recognised or enforced only where an international agreement, such as a mutual legal assistance treaty, is in force with the EU or a member state. Without one it does not bind an EU controller.
  • EDPB Guidelines 02/2024 confirm the article creates no transfer ground of its own, so a controller still needs a route elsewhere in Chapter V.
  • EDPB Guidelines 2/2018 read the Article 49 derogations restrictively so the exception does not become the rule. Schrems II adds that a transfer is judged on the contract and on the third country rules that let its authorities reach the data.
EDPB Guidelines 02/2024EDPB Guidelines 2/2018C-311/18 Schrems IIEDPB and CJEU, cited from the stored corpus
Indonesia data transfer rules 4 / 6
Practitioner(notes) No. 04 · August 2026

Where the work moves now

Write the foreign order clauseThe transfer chapter no longer speaks to an order from a foreign court or agency so put the response in the contract. Name who gets told and who challenges before any data moves.
Benchmark adequacy to the statuteRun equivalence against UU 27/2022 because Pasal 165(1) points there and nowhere else. Keep the wider benchmark of the whole data protection corpus for binding corporate rules under Pasal 171(1)(a).
Gate the room and diary the deletionMake acceptance of the access terms a condition of data-room entry because Pasal 133(6) only asks that the terms exist. Treat the destruction line in the notice as a binding representation and schedule the deletion against it.
Indonesia data transfer rules 5 / 6
Practitioner(notes) No. 04 · August 2026

The full tracker carries every article of both instruments, side by side.

Follow for the next issue
Muhammad Deckri Algamar, LL.B, LL.M*, AIGP
Indonesia data transfer rules 6 / 6