Indonesia kept the DPIAand dropped the duty to act

Indonesia's new implementing regulation keeps the duty to run the assessment but no longer makes acting on it mandatory.

Indonesia audit and DPIA swipe

Practitioner(notes) No. 07 · August 2026

The assessment without the consequence

2023 draftProve it by doing itRPP Pasal 135 required an internal and external audit policy with routine and exit audits.A processor had to be checked for compliance history and breach record before it was engaged.The mandatory marker attached to implementing DPIA mitigations and to documenting the assessment.

PP 33/2026Prove it on paperPasal 128 hands the whole audit and vetting programme to a regulator rule not yet written.Pasal 125(2) asks only that the appointed processor can support the controller.Pasal 121(3) no longer marks implementing the identified measures as mandatory.

Read against the draft implementing regulation it replaced.

Indonesia audit and DPIA 2 / 6

Practitioner(notes) No. 07 · August 2026

Concerns and observations

The audit rule does not exist yetThe enacted text names the supervision instruments and sends the audit programme itself to a future regulator rule. Until that rule lands there is no stated standard for how often you audit or what you do with the findings.
A DPIA nobody has to act onRunning the assessment is still a hard duty but implementing the measures it identifies is not. A controller can meet the surviving obligation with a report that changes nothing.
The camera siting ban is goneThe draft banned cameras where a person expects privacy and required minimising capture beyond the monitoring purpose. What survives limits where the camera looks rather than where it sits so siting in a workplace or fitting room rests on the general processing bases.

Indonesia audit and DPIA 3 / 6

Practitioner(notes) No. 07 · August 2026

Europe makes the assessment bite

diverges

The EU makes the consultation compulsory once the risk survives the measures the controller plans, while Indonesia leaves that step to the controller to choose.

GDPR Article 36(1) requires the controller to consult the supervisory authority before processing where the assessment shows a high risk it cannot mitigate.
EDPB Guidelines 3/2019 say a person does not expect monitoring at work, in a treatment room or in a sanitary facility, so a camera sited there rarely survives the legitimate interest balancing.
In C-340/21 the Court put the burden on the controller to prove that its security measures were appropriate, so an unexamined measure is an unproven one.

EDPB Guidelines 3/2019C-340/21 Natsionalna agentsia za prihoditeEDPB and CJEU, cited from the stored corpus

Indonesia audit and DPIA 4 / 6

Practitioner(notes) No. 07 · August 2026

What to do until the rule lands

Write back what was cutKeep the RPP Pasal 135 audit and processor due diligence programme as internal policy and keep your own ban on cameras in areas where people expect privacy. The Regulation no longer supplies either.

Close every DPIA findingTrack mitigations to closure on your own register because Pasal 121(3) no longer compels implementation. Treat an assessment as unfinished until the measures are live.

Keep the safeguard file readyPasal 169(2) makes your adequate and binding safeguard documentation producible to the regulator and names no trigger and no deadline. Hold it in a state you could hand over this week and ask whether filing is meant to be proactive.

Indonesia audit and DPIA 5 / 6

Practitioner(notes) No. 07 · August 2026

The full tracker carries every article of both instruments, side by side.

Follow for the next issue

Muhammad Deckri Algamar, LL.B, LL.M*, AIGP

Indonesia audit and DPIA 6 / 6