Indonesia kept every rightIt moved the burden of proof

Indonesia's new implementing regulation leaves the subject rights intact and moves almost every decision about them to the controller.

Indonesia PDP subject rights swipe

Practitioner(notes) No. 05 · August 2026

The same rights on a thinner text

The 2023 draftThe text bound the controllerPasal 107(1) let a controller refuse an automated decision objection only if it could prove accuracy and no significant impact.Pasal 90(2) ran the 3 x 24 hour copy clock from the moment a request was received.Pasal 83(5) made refusal of a correction mandatory on three closed grounds and nothing else.

PP 33/2026The text leaves it to the controllerPasal 95(1) drops the proof language so the two conditions are stated as facts.Pasal 78(2) starts the same clock only once the request is received and verified.Pasal 71(5) lets the controller refuse a correction on no stated grounds while Pasal 71(7) still requires reasons.

Read against the draft implementing regulation it replaced.

Indonesia PDP subject rights 2 / 6

Practitioner(notes) No. 05 · August 2026

Concerns and observations

Proof of accuracy became assertionA subject who objects to an automated decision cannot see inside the model. The controller can now refuse by stating that its system is accurate rather than showing that it is.
Verification has no time limitThe 3 x 24 hour window for a copy request opens only once the controller is satisfied of identity. Nothing in the text bounds how long that check may take.
One capital letter stretched the clockThe enacted text defines the word for day as a working day. A 30 day notice for data obtained from someone else now lands about six calendar weeks out.

Indonesia PDP subject rights 3 / 6

Practitioner(notes) No. 05 · August 2026

Europe keeps the decision in the text

diverges

The EU writes the content and the grounds into the Regulation instead of leaving the shape of the answer to the controller.

GDPR Article 15(1) lists eight items the controller must supply alongside the copy, so the content of an access answer is not the controller's to design.
In C-634/21 the Court held that Article 22(1) states a prohibition the subject does not have to invoke, so an automated decision is unlawful unless a contract needs it, a law allows it or the subject gave explicit consent.
EDPB Guidelines 01/2022 treat access as the default and a refusal as the exception the controller has to justify.

EDPB Guidelines 01/2022C-634/21 Land HessenC-487/21 CRIFC-154/21 Osterreichische PostEDPB and CJEU, cited from the stored corpus

Indonesia PDP subject rights 4 / 6

Practitioner(notes) No. 05 · August 2026

What to change now

Keep the accuracy evidenceRefusing an objection no longer requires proof but a supervisor will still ask for it. Hold the accuracy and mitigation evidence in the impact assessment file where it can be found.

Set your own verification deadlineThe regulation stops bounding identity verification so the clock can sit unstarted. Put an internal service level on it and log when each request is verified.

Recount every deadline in working daysPasal 1 defines Hari as a working day and Pasal 64 uses it for the indirect collection notice. Rebuild those schedules and check any other deadline written with a capital Hari.

Indonesia PDP subject rights 5 / 6

Practitioner(notes) No. 05 · August 2026

The full tracker carries every article of both instruments, side by side.

Follow for the next issue

Muhammad Deckri Algamar, LL.B, LL.M*, AIGP

Indonesia PDP subject rights 6 / 6