Who sues for a mass breachwhen the regulator cannot?

Indonesia's implementing regulation rewrites who can sue after a breach and how long every deadline actually runs.

Indonesia enforcement and redress swipe

Practitioner(notes) No. 11 · August 2026

The regulator stepped out of the claim

2023 draftThe regulator could sue for youPasal 211(1) gave the authority standing to claim compensation in the name of the public interest.Pasal 212 let it hand that claim to the prosecution service.Cross-border exchange between agencies ran under Pasal 180 with no transfer condition.

PP 33/2026You sue for yourselfNeither standing provision survives. Redress is an individual claim under Pasal 108(3) or mediation.Prosecution help remains only for enforcing a sanction under Pasal 198 and for disputes under Pasal 221.Pasal 166 routes outbound agency exchange through the Pasal 165 transfer cascade.

Read against the draft implementing regulation it replaced.

Indonesia enforcement and redress 2 / 6

Practitioner(notes) No. 11 · August 2026

Concerns and observations

Mass breaches have no public claimantThe regulator can still sanction you but it cannot sue for data subject compensation. Collective redress now depends on individuals bringing their own claims or settling in mediation.
Foreign police requests now trigger transfer rulesPersonal data leaving Indonesia for a foreign agency has to clear the same cascade as a commercial export. The channel survives for criminal cases inside Indonesia but at the border it is no longer a shortcut past the transfer tests.
Every deadline runs in working daysOne definition converts every period in the regulation to working days at the same numeral. A fourteen day window is now about three calendar weeks and every service level built on the draft understates the time.

Indonesia enforcement and redress 3 / 6

Practitioner(notes) No. 11 · August 2026

Three routes open and the company pays

diverges

The EU keeps a complaint to the regulator, a challenge to its decision and a claim against the controller open together, lets a mandated body act for the subject, and fines the company itself.

In C-132/21 the Court held that the complaint route to the authority, including any challenge to its decision, runs concurrently with and independently of a court action against the controller.
GDPR Article 80(1) lets a data subject mandate a not for profit body to complain and litigate for them. Article 80(2) adds a route with no mandate where a member state has legislated for it, which is what C-319/20 allowed.
In C-807/21 the Court held that a company can be fined without the infringement first being attributed to a named individual, though the company must have acted intentionally or negligently.

EDPB Guidelines 04/2022C-132/21 Nemzeti AdatvedelmiC-319/20 Meta Platforms IrelandC-807/21 Deutsche WohnenEDPB and CJEU, cited from the stored corpus

Indonesia enforcement and redress 4 / 6

Practitioner(notes) No. 11 · August 2026

What to change now

Re-model breach exposureAdvise on the basis that the authority cannot sue for subject compensation. Model individual civil claims under Pasal 108(3) and mediation settlements as separate lines of exposure.

Gate every foreign agency requestRun the Pasal 165 cascade before releasing personal data to a law enforcement body outside Indonesia. Equivalence, an adequate and binding protection, or the data subject's consent has to be in place before the data moves.

Recount the enforcement calendarRecompute each period in the regulation on working days and check Indonesian public holidays before relying on a date. Reset the internal service levels that were built against the draft calendar.

Indonesia enforcement and redress 5 / 6

Practitioner(notes) No. 11 · August 2026

The full tracker carries every article of both instruments, side by side.

Follow for the next issue

Muhammad Deckri Algamar, LL.B, LL.M*, AIGP

Indonesia enforcement and redress 6 / 6