IMPLEMENTING REGULATION OF

THE PERSONAL DATA PROTECTION LAW

The Indonesian Government has issued the Government Regulation No. 33 of 2026 regarding the Implementing Regulation of the Law No. 27 of 2022 regarding Personal Data Protection ("PDP Law") (“GR 33/2026“).

GR 33/2026 provides detailed technical guidance on various obligations and rights that were previously regulated only in general terms under the PDP Law. In addition to elaborating on the implementation of data subject rights and the obligations of personal data controllers, GR 33/2026 introduces several new operational requirements that may require a company to update its compliance frameworks.

Set out below are several key provisions under GR 33/2026:

1. Documentation and Data Processing Governance Requirements

GR 33/2026 requires personal data controllers to prepare and maintain records of personal data processing activities. Such records must, at a minimum, identify the parties involved in the processing activities, specify the legal basis and purposes of processing, and document key governance measures, including retention periods, and security measures implemented.

GR 33/2026 also requires personal data controllers to establish a personal data retention policy covering retention periods, methods for deletion or destruction of personal data, responsible personnel, and documentation and notification mechanisms for data subjects.

2. Data Protection Impact Assessment

GR 33/2026 requires a Data Protection Impact Assessment (“DPIA“) to be carried out before the relevant processing activities commence. GR 33/2026 must prescribe a minimum required contents that must be included in a DPIA, including an assessment of potential risks to data subjects and the mitigation measures to address those risks.

This requirement will be particularly relevant to organizations engaged in large-scale processing, profiling activities, the use of emerging technologies such as artificial intelligence (AI), or the processing of specific categories of personal data.

3. Technical Personal Data Security Requirements

GR 33/2026 requires personal data controllers to implement security measures that are appropriate to the risks arising from their personal data processing activities. These measures include using safeguards such as encryption, maintaining the confidentiality, integrity, and availability of personal data, ensuring the ability to restore access to data following a security incident, conducting regular security testing and assessments, and incorporating privacy by design and privacy by default principles when developing systems and processes.

4. Procedures for Handling Data Subject Rights Requests

GR 33/2026 requires personal data controllers to provide accessible channels through which data subjects may submit requests and must verify each request received.

GR 33/2026 also prescribes minimum information that must be included in a request, identifies parties entitled to submit requests on behalf of data subjects, and requires controllers to maintain records of actions taken in response to each request.

5. Appointment of a Personal Data Protection Officer

In relation to the appointment and function of a Personal Data Protection Officer (“PDPO“), GR 33/2026 requires the organizations to ensure that the PDPO is actively involved in personal data processing activities, has direct access to senior management, and is able to perform their duties independently by providing adequate resources and ensuring that no conflict of interest arises.

6. Cross-Border Transfers of Personal Data

GR 33/2026 introduces a more comprehensive framework governing cross-border transfers of personal data. Before transferring personal data outside Indonesia, personal data controllers must assess the legal basis for the transfer, taking into account factors such as the adequacy of protection afforded to the personal data, transfer-related risks, the categories of data being transferred, the purposes of the transfer, and the level of personal data protection available in the recipient jurisdiction.


GR 33/2026 also provides several transfer mechanisms that may be relied upon, including transfers to jurisdictions with an equivalent level of personal data protection, standard contractual clauses, and binding corporate rules applicable within a corporate group.

Conclusion

GR 33/2026 does not only implement the framework established under the PDP Law but also introduces a range of more detailed operational, governance, and documentation requirements. Key areas that may have the most significant impact on businesses include maintaining records of processing activities, establishing data retention policies, conducting DPIAs, implementing more prescriptive security measures, facilitating the exercise of data subject rights, appointing and empowering PDPOs, and strengthening governance over cross-border personal data transfers.


This Client Alert is provided for general informational purposes only and does not constitute legal advice. Please contact us should you require further information regarding the implications of GR 33/2026 on your business activities.


LINK PDF: Client-Alert-regarding-Implementating-Regulation-on-the-Personal-Data-Protection-Law-2026-09-041.pdf