A legitimate interestyou cannot object to

Indonesia's implementing regulation keeps legitimate interest as a lawful basis and removes the objection right that balanced it.

Indonesia, legitimate interest swipe

Practitioner(notes) No. 09 · August 2026

The basis without the objection

The 2023 draftAn objection stopped the processingAn objection forced legitimate interest processing to stop.Public bodies were shut out of legitimate interest entirely.A contract missing a required term was void by operation of law.

PP 33/2026The objection went with itObjection survives only against decisions made solely by automated processing under Pasal 93.Public bodies may rely on legitimate interest for purposes outside the public task under Pasal 55.A defective contract stands but stops working as a lawful basis under Pasal 43(2).

Read against the draft implementing regulation it replaced.

Indonesia, legitimate interest 2 / 6

Practitioner(notes) No. 09 · August 2026

Concerns and observations

Legitimate interest with no way outThe draft let a person object and force the processing to stop. The enacted text keeps the basis and removes that stop so withdrawal of consent is the only lever left and it does not reach this ground.
Public bodies can now claim legitimate interestThe draft closed this basis to public bodies outright and the enacted text opens it. The permission is bounded to purposes sitting outside the public task and that is roughly the space the GDPR leaves open.
One contract gap kills the basisThe draft treated a non compliant contract as void by law. Now the commercial bargain survives and only the processing loses its ground so a drafting slip turns into unlawful processing under the administrative sanction regime.

Indonesia, legitimate interest 3 / 6

Practitioner(notes) No. 09 · August 2026

Europe pairs the basis with the objection

diverges

In the EU the objection right is what makes legitimate interest survivable, because the subject can object on grounds particular to their situation and the controller must then stop unless its own grounds override.

GDPR Article 21(1) lets the subject object at any time on grounds particular to their own situation, and the controller must stop unless it shows compelling grounds that override the subject, or needs the data for legal claims.
The second subparagraph of Article 6(1) shuts a public authority out of the legitimate interest basis when it acts in its own tasks, leaving it the public task basis instead.
In C-621/22 the Court held that a purely commercial interest can qualify if it is lawful, but only where the processing is strictly necessary and the subject's rights do not override it.

EDPB Guidelines 3/2019C-621/22 Koninklijke Nederlandse Lawn TennisbondC-252/21 Meta Platforms and BundeskartellamtEDPB and CJEU, cited from the stored corpus

Indonesia, legitimate interest 4 / 6

Practitioner(notes) No. 09 · August 2026

What to change before relying on it

Audit the contract basisTest every contract you rely on as a lawful basis against all nine items in Pasal 43(1). A gap in any one of them disqualifies the basis even though the agreement itself stands.

Correct the objection promiseRemove any pledge that an objection will halt legitimate interest processing in Indonesia. Keep the consent withdrawal route accurate and do not stretch it to cover a ground it cannot reach.

Retest the public body purposeFor a public sector client the live question is whether the purpose sits outside the public task under Pasal 55(2). Document that answer, because the enacted text asks a controller on the public task basis for far less than the draft did.

Indonesia, legitimate interest 5 / 6

Practitioner(notes) No. 09 · August 2026

The full tracker carries every article of both instruments, side by side.

Follow for the next issue

Muhammad Deckri Algamar, LL.B, LL.M*, AIGP

Indonesia, legitimate interest 6 / 6