Practitioner(notes) No. 10 · August 2026
No. 10

Nothing leaked.Notify in 72 hours anyway.

Indonesia's enacted breach rule widens what you must report and narrows what you must say.

Indonesia PDP breach notification swipe
Practitioner(notes) No. 10 · August 2026

Wider trigger and thinner notice

The 2023 draftWider exemption and fuller noticePasal 124(5) exempted any protection failure that disclosed nothing.The notice had to state the impact of the breach on the person.Public notice was required when the controller could not reach subjects.
PP 33/2026No exemption and thinner noticePasal 114 sets a 72 hour duty with no exception clause.Pasal 114(3) keeps the facts and the fix and drops the impact.Pasal 115 keeps public notice for public service and serious public interest only.

Read against the draft implementing regulation it replaced.

Indonesia PDP breach notification 2 / 6
Practitioner(notes) No. 10 · August 2026

Concerns and observations

  • Ransomware without exfiltration is now notifiableAn incident that locks or destroys data with nothing taken now sits inside the same 72 hour clock as exposure. Triage rules built around exfiltration will miss it.
  • The notice no longer states consequenceImpact was cut from the mandatory content and survives only in the record you keep for the authority. The person reading the notice learns what you did and not what it means for them.
  • Unreachable subjects have no route leftThe draft allowed public notice when individual contact was impossible and the enacted text dropped that trigger. The duty to tell each person stands even when the contact details do not exist.
Indonesia PDP breach notification 3 / 6
Practitioner(notes) No. 10 · August 2026

Europe filters by risk before it notifies

diverges

The EU clock starts when the controller becomes aware, the authority hears nothing where the breach is unlikely to be risky, and the subject hears only where the risk is high.

  • Article 33(1) gives the controller 72 hours from awareness where that is feasible, and late notice needs reasons. Guidelines 9/2022 puts awareness at a reasonable degree of certainty that data were compromised.
  • Article 33(3) fixes the content of the notice, including the likely consequences of the breach and the measures taken or proposed to address it.
  • Article 34(1) reaches the data subject only where the breach is likely to be high risk, and Article 34(2) requires plain language. Article 34(3) drops the duty where the data were encrypted, the risk has been contained, or contact would take disproportionate effort.
EDPB Guidelines 9/2022C-340/21 Natsionalna agentsia za prihoditeEDPB and CJEU, cited from the stored corpus
Indonesia PDP breach notification 4 / 6
Practitioner(notes) No. 10 · August 2026

What to fix before the next incident

Retire the disclosure testRewrite breach triage so availability and integrity incidents start the same clock as exposure. Pasal 114 attaches the duty to any protection failure and the definition reaches destruction as well as loss and alteration.
Keep impact in the noticeThe enacted minimum is not a defensible notice. Tell the person what the breach means for them even though Pasal 114(3) no longer asks for it.
Document why contact failedWhere subjects cannot be reached individually notify publicly anyway. Record why notice under Pasal 114 could not be delivered to each person.
Indonesia PDP breach notification 5 / 6
Practitioner(notes) No. 10 · August 2026

The full tracker carries every article of both instruments, side by side.

Follow for the next issue
Muhammad Deckri Algamar, LL.B, LL.M*, AIGP
Indonesia PDP breach notification 6 / 6