Indonesia dropped the checklistDo not call that relief.

PP 33/2026 keeps the processing stages but attaches no duties to them and it binds every controller from 16 January 2027.

Indonesia: scope and commencement swipe

Practitioner(notes) No. 12 · August 2026

Stages kept and duties dropped

The RPP draftDuties attached to every stageRPP Pasal 10 to 15 hung a controller checklist on each of the six processing stages.The controller had to facilitate correction and updating for the subject.Any party requesting personal data was deemed a controller.

PP 33/2026Stages listed and left barePasal 8 keeps the same six stages and attaches no duty to any of them.Pasal 70 recasts that conduct as a subject right over data about themselves and limits it to the processing purpose.Pasal 10 lists the parties to processing and carries no deeming rule.

Read against the draft implementing regulation it replaced.

Indonesia: scope and commencement 2 / 6

Practitioner(notes) No. 12 · August 2026

Concerns and observations

A thinner text is not less workCorrection survives at Pasal 70 as a subject right limited by the processing purpose and nothing else attaches to the stages. That is a narrowing rather than a clean deletion so rebuild the checklist as internal policy.
Ministries can widen the specific data categorySpecific personal data is Indonesia's sensitive category and a ministry now determines further entries itself, coordinating with the authority alongside that determination rather than before it. The criteria that disciplined such a designation are gone and only a bare greater impact test remains.
Six extra months is not a pauseThe regulation binds every controller from 16 January 2027 instead of on promulgation. More than thirty delegated rules are still unissued so the enacted text is the only benchmark you have.

Indonesia: scope and commencement 3 / 6

Practitioner(notes) No. 12 · August 2026

Europe stopped the clock instead

diverges

The EU brought the Regulation into force in 2016 but held its application back for two years, so nothing could be late. Indonesia put its statute in force and gave the duty a deadline.

GDPR Article 99(2) held the application of the Regulation back to 25 May 2018, so until that day its own duties bound no one and Directive 95/46 went on governing.
GDPR Article 4(2) names processing operations and attaches no duty to any of them either, because the duties sit in the Article 5(1) principles that bind every act of processing and in the accountability rule at Article 5(2).
Nothing followed 25 May 2018 by way of a grace period, though Articles 45(9) and 46(5) carried Directive era adequacy decisions and prior authorisations across, so transfers had a footing on day one.

EDPB Guidelines 4/2019C-77/21 DigiEDPB and CJEU, cited from the stored corpus

Indonesia: scope and commencement 4 / 6

Practitioner(notes) No. 12 · August 2026

What to do before January

Rebuild the stage checklistThe enacted text sets no duty for any processing stage. Take the draft duties at RPP Pasal 10 to 15 as your starting point and adopt them as internal controls.

Name the controller in writingThe Regulation no longer deems the requesting party a controller. Assign controller status expressly in data sharing agreements because status now follows the functional definition at Pasal 1 angka 4 alone.

Map against the enacted textPasal 223 makes the regulation itself the interim benchmark until the authority issues its rule on processing. Start the mapping against the enacted articles now rather than waiting for them.

Indonesia: scope and commencement 5 / 6

Practitioner(notes) No. 12 · August 2026

The full tracker carries every article of both instruments, side by side.

Follow for the next issue

Muhammad Deckri Algamar, LL.B, LL.M*, AIGP

Indonesia: scope and commencement 6 / 6