Indonesia kept the dutyand deleted the audit

The controller duties survive. The audit and vetting detail that gave them substance went to a rule nobody has written yet.

Indonesia controller accountability swipe

Practitioner(notes) No. 06 · August 2026

The duty without the method

The 2023 draftDuties came with a methodPasal 135 set out an audit policy with pre engagement vetting and exit audits.A controller late in carrying out a decision could be fined for the delay.A transfer safeguard had to be recorded with no one named to receive it.

PP 33/2026Duties come without onePasal 128 sends that whole programme to a Peraturan Lembaga that does not exist yet.Pasal 195(5) gives 30 days to comply and no penalty accrues after the deadline.Pasal 169(2) says the same record must now be produced to the regulator.

Read against the draft implementing regulation it replaced.

Indonesia controller accountability 2 / 6

Practitioner(notes) No. 06 · August 2026

Concerns and observations

Processor vetting is now your own policyThe enacted text asks only that an appointed processor can support your confidentiality duty. Nothing obliges you to examine its breach record or compliance history before you hand over data.
An ignored order costs nothing extraA controller that ignores an order to delete data or suspend processing faces no automatic escalation. The regulator has to open something new rather than watch a penalty run.
A dissolving controller may appoint nobodyThe duty to leave a contact point after winding up is now discretionary and the fixed period is gone. The dissolution notice still names a contact as the route for subject queries so a subject can be pointed at someone who was never appointed.

Indonesia controller accountability 3 / 6

Practitioner(notes) No. 06 · August 2026

Europe puts the method in the contract

diverges

The EU wrote no general duty of supervision. It fixed what the processor contract must say and put the checking inside it.

GDPR Article 28(1) lets a controller use only processors that can demonstrate appropriate technical and organisational measures, and Article 28(3) names eight terms every processor contract must carry as a minimum.
Article 28(3)(h) makes every processor contract give the controller a right to audit and inspect the processor, which is where the EU puts the checking in place of a general duty.
EDPB Guidelines 07/2020 call the Article 28(1) duty a continuous obligation and say the controller should verify the processor's guarantees again at appropriate intervals.

EDPB Guidelines 07/2020C-683/21 Nacionalinis visuomenes sveikatos centrasEDPB and CJEU, cited from the stored corpus

Indonesia controller accountability 4 / 6

Practitioner(notes) No. 06 · August 2026

What to do before the regulator asks

Keep the deleted programme aliveRun the draft audit policy and processor due diligence as internal policy behind the surviving Pasal 127 headings. Watch for the rule promised by Pasal 128 and be ready to map your file onto it.

Keep the transfer safeguard file readyKeep the accountability record for a cross-border transfer safeguard in a form you can hand the regulator on demand. Pasal 169(2) sets no trigger and no deadline, so treat it as always due.

Name the contact in the winding upDo not assume a dissolved controller leaves anyone to answer subject queries. Write the contact point into the winding up resolution and fix its duration yourself, because Pasal 136(2) only says you may.

Indonesia controller accountability 5 / 6

Practitioner(notes) No. 06 · August 2026

The full tracker carries every article of both instruments, side by side.

Follow for the next issue

Muhammad Deckri Algamar, LL.B, LL.M*, AIGP

Indonesia controller accountability 6 / 6