CLIENT ALERT: INDONESIA’S NEW PERSONAL DATA PROTECTION IMPLEMENTING REGULATION: POINTS OF REFLECTION
Following the enactment of Law Number 27 of 2022 on Personal Data Protection (the PDP Law), its implementing regulation, Indonesian Government Regulation Number 33 of 2026 (the GR 33/2026), has finally been enacted. GR 33/2026 will enter into force on 16 January 2027, six months after its enactment on 16 July 2026.
Key features include more detailed provisions for (i) the bases of Personal Data processing, (ii) Personal Data governance documents, including processing policies, Records of Processing Activities, retention policies, compensation-request mechanisms, and deletion and destruction procedures, (iii) prohibition of exoneration clauses, (iv) indirect procurement of Personal Data from a Subject, (v) data protection impact assessment, (vi) timelines for data breach notification and cessation of Personal Data processing, (vii) cross-border Personal Data transfers, (viii) the Joint Controllers framework, (ix) Personal Data transfers arising from mergers, separations, acquisitions, consolidations, and dissolutions, (x) destruction of Personal Data, (xi) mediation of Personal Data disputes, and (xii) administrative fines and an objection mechanism against administrative sanctions.
For further details on the GR 33/2026, please refer to our Client Alert herein: Client Alert- GR 33/2026.
#WeSpeakYourLanguage
Loading Viewer...
FEATURED LAWYERS
Pramudya A. Oktavinanda
Managing Partner
Putu Raditya Nugraha
Senior Partner