The Government has issued Government Regulation No. 33 of 2026 on the Implementation of Law No. 27 of 2022 on Personal Data Protection (“GR 33/2026”). GR 33/2026 was enacted and promulgated on 16 July 2026 and will come into force six (6) months from its promulgation date, i.e., on 16 January 2027.
GR 33/2026 further regulates various provisions under Law No. 27 of 2022 on Personal Data Protection (“PDP Law”), including the processing of Personal Data, Personal Data Protection Impact Assessments, objections to automated processing, transfers of Personal Data outside the jurisdiction of Indonesia, officers or personnel performing Personal Data Protection functions (“PPDP”), and the imposition of administrative sanctions.
For companies, these provisions do not merely introduce additional administrative obligations. GR 33/2026 also carries implications for contractual arrangements, internal governance, technology, corporate transactions, and sanctions exposure. Among the key issues that companies should anticipate are the following.
- DPIAs Must Be Conducted at the Planning Stage of Processing Activities
GR 33/2026 requires Personal Data Controllers to conduct a Personal Data Protection Impact Assessment (“DPIA”) where the processing of Personal Data is likely to result in a high risk to Data Subjects.
Accordingly, a DPIA should not be treated as a document prepared only after a system or product has been implemented. A DPIA should form part of the planning and decision-making process, particularly in the development of digital products, implementation of new technologies, system integration, large-scale processing, or activities that may have a significant impact on Data Subjects.
Companies should incorporate DPIAs into their approval processes for new products, technologies, and projects so that risks can be identified before processing begins and the basis for the relevant decision is properly documented.
- A Contract Does Not Automatically Constitute a Legal Basis for Processing Personal Data
GR 33/2026 provides that the performance of contractual obligations may constitute a legal basis for processing Personal Data, subject to certain requirements. Article 41 requires, among other things, a valid agreement, the necessity of the processing for the performance of the agreement, the implementation of protective measures, consideration of risks, and the Controller’s ability to fulfil the rights of Data Subjects. Article 43 also sets out the minimum matters that must be reflected in the agreement.
Accordingly, the validity of a contract does not automatically make it a legal basis for processing Personal Data. This risk is particularly relevant to companies with a large number of contracts entered into before GR 33/2026 comes into force.
Companies should conduct a contract review of agreements involving the processing of Personal Data, particularly to ensure that the purpose and necessity of the processing, the rights of Data Subjects, and the consequences of not carrying out the processing can be properly traced through the contractual documentation.
- Legitimate Interests Require Demonstration, Not Merely a Clause
GR 33/2026 recognizes the fulfilment of other legitimate interests as one of the legal bases for processing Personal Data. Its application must take into account the purpose and necessity of the processing, as well as the balance between the interests of the Personal Data Controller and the rights of Data Subjects.
However, companies cannot simply state this legal basis in their privacy policy or internal documents. Article 53 requires the Personal Data Controller to conduct an analysis and assessment, while Article 54 requires the results thereof to be documented.
The legal risk lies in the company’s ability to demonstrate why the processing is necessary and how the relevant interests have been balanced against the rights of Data Subjects. Accordingly, companies should maintain documented analyses and assessments for each processing activity relying on this legal basis and update them where there are changes to the purpose, method, or circumstances of the processing.
- The Prohibition on Transferring Legal Responsibility Requires Contract Review
Article 44 of GR 33/2026 prohibits a Personal Data Controller from including contractual provisions that transfer to a Data Subject any responsibility that, under applicable laws and regulations, should remain the responsibility of the Controller.
The issue is to distinguish provisions that unlawfully transfer legal responsibility from contractual provisions that validly allocate risk, such as limitations of liability or indemnities. GR 33/2026 does not yet provide further parameters on this distinction.
Accordingly, companies should conduct a contract review of Personal Data protection provisions, particularly those containing formulations concerning releases of liability, waivers, indemnities, or limitations of liability. The objective is not to eliminate such provisions altogether, but to ensure that contracts are not used to shift the Controller’s legal obligations to Data Subjects.
- Cross-Border Transfers of Personal Data Cannot Rely Solely on Contractual Clauses
GR 33/2026 introduces a layered mechanism for transferring Personal Data outside the territory of Indonesia. Under Article 165, the Controller must ensure that the recipient country provides a level of protection equivalent to or higher than that required under Indonesian law. If this requirement is not satisfied, the Controller must ensure that adequate and binding safeguards are in place. If neither mechanism is available, the Controller must obtain the Data Subject’s consent.
Adequate and binding safeguards may take the form of legally binding instruments, standard contractual clauses, binding corporate rules within a corporate group, or other instruments recognized by the relevant authority. The Controller must also be able to demonstrate accountability through written and/or recorded documentation.
Accordingly, the use of cloud services, global HR systems, customer relationship management systems, or foreign vendors cannot rely solely on contractual data transfer clauses. Companies need to understand where the data is being transferred, who the recipient is, the purpose of the transfer, where the data is stored, who has access to it, and which transfer mechanism is being relied upon.
A key mitigation measure is to conduct data transfer mapping for all cross-border flows of Personal Data and ensure that the applicable legal basis and transfer mechanism can be properly demonstrated.
- Personal Data Protection Failures Must Be Notified Within 3×24 Hours
Article 114 of GR 33/2026 requires a Personal Data Controller to provide written notification of a Personal Data Protection Failure to the Data Subject and the relevant authority no later than 3×24 hours after the failure has been known with certainty, reasonably, and properly. The notification must at least contain information regarding the Personal Data exposed, the time and manner in which the data was exposed, the measures taken to address and recover from the incident, and information concerning the PPDP or designated contact person.
The challenge is not merely the ability to issue a notification within 72 hours, but the company’s ability to determine when an incident has been sufficiently identified to trigger the notification obligation. Article 117 also requires Controllers to establish internal policies, procedures, and/or guidelines concerning the prevention and handling of Personal Data Protection Failures.
Accordingly, companies should maintain a clear incident response procedure, including mechanisms for incident reporting, verification, classification, decision-making regarding notification, and documentation. Contracts with Processors should also address their obligations to report incidents to the Controller.
- Data Deletion Raises Retention and Backup Issues
GR 33/2026 regulates the termination of processing, deletion, and destruction of Personal Data, including where the retention period has expired, where a Data Subject makes a request under certain circumstances, where the Personal Data is no longer relevant to the resolution of legal proceedings, or where the Personal Data was unlawfully obtained and/or processed. These provisions are set out in Articles 79 to 88 of GR 33/2026.
These obligations may become challenging where companies are also subject to data retention requirements under other laws, or where data must be retained for audit purposes, transaction records, or dispute resolution. Similar issues may arise where Personal Data remains stored in backup systems.
Accordingly, companies should establish a data retention schedule that links each category of Personal Data to its processing purpose, retention period, legal basis for retention, and applicable deletion or destruction mechanism. Such arrangements should take into account both primary systems and other storage environments used by the company.
- M&A Transactions Must Treat Personal Data as a Transactional Legal Issue
GR 33/2026 specifically regulates the transfer of Personal Data in mergers, demergers, acquisitions, consolidations, and dissolutions of legal entities. Prior to the transfer, the Personal Data Controller must assess the rights of Data Subjects and the Personal Data protection obligations that remain applicable during and following the transaction.
This demonstrates that customer, employee, vendor, or user databases are not merely assets or business information that can automatically be transferred to the entity resulting from a transaction. The new Controller must process Personal Data consistently with the original processing purposes and may only use the data for a new purpose after the period for Data Subjects to submit objections has expired.
Accordingly, Personal Data protection should be incorporated into the legal due diligence process. The review should cover the legal basis and purposes of processing, outstanding rights of Data Subjects, vendor agreements, the obligations of the existing Controller, and the intended use of the data following completion of the transaction.
- A Maximum Fine of 2% Does Not Mean That Companies Will Automatically Be Fined 2%
GR 33/2026 provides for an administrative fine of up to 2% of the annual revenue or annual receipts of the Personal Data Controller and/or Processor in respect of the relevant violation variables. The 2% figure represents the maximum amount, not an automatic fine applicable to every violation.
Article 185 sets out various factors relevant to the calculation of the fine, including the negative impact of the violation, its duration, the type and amount of Personal Data affected, the number of Data Subjects, how the violation was identified, the level of transparency and cooperation during the examination, the scale of the business, the ability to pay, the level of compliance, and other variables determined by the relevant authority.
In addition, Article 184 allows more than one administrative sanction to be imposed concurrently, and sanctions may be imposed with or without a prior written warning. This demonstrates that sanctions exposure depends not only on the company’s revenue, but also on the nature and severity of the violation and the company’s ability to demonstrate its compliance and preventive and mitigating measures.
Accordingly, companies should maintain adequate compliance documentation, including policies, risk assessments, audit findings, mitigation measures, and incident response records. Such documentation may become an important part of the company’s position in regulatory supervision and administrative enforcement proceedings.
Conclusion
GR 33/2026 brings Personal Data protection to a more operational level. The challenge for companies is not merely the addition of new obligations, but the ability to demonstrate that each obligation has been properly implemented. The legal basis for processing must be defensible, high-risk processing must be assessed, incidents must be addressed within the prescribed timeframe, and Personal Data management must be supported by adequate documentation.
At the same time, certain provisions remain subject to further implementing regulations issued by the relevant authority, including provisions concerning other legitimate interests, notification of Personal Data Protection Failures, cross-border transfers, deletion and destruction, and administrative sanctions.
Accordingly, the period leading up to 16 January 2027 should not be used merely to update the company’s privacy policy. Companies should reassess their processing bases, contracts, data transfer flows, incident response procedures, retention and deletion mechanisms, and compliance documentation. The objective is straightforward: when GR 33/2026 comes into force, the company’s compliance should not merely exist on paper, but should be capable of being demonstrated.
Developments in Personal Data protection regulations have direct implications for how companies manage data, structure agreements, respond to incidents, and conduct corporate transactions. Accordingly, a proper understanding of GR 33/2026 is essential to ensure that corporate policies, processing activities, and business practices are aligned with applicable laws and supported by adequate compliance documentation.
MNL Law Firm provides legal advice and assistance to businesses in anticipating legal risks relating to Personal Data protection, including contractual reviews, mapping of processing bases and activities, handling of Personal Data Protection Failures, cross-border transfers of Personal Data, and strengthening corporate compliance governance.
Legal Basis
- Law No. 27 of 2022 on Personal Data Protection (“PDP Law”).
- Government Regulation No. 33 of 2026 on the Implementation of Law No. 27 of 2022 on Personal Data Protection (“GR 33/2026”).
Author : Hotmaita Arta Purba, S.H.
Editor: Robby Simamora, S.H., M.H.