Indonesia’s personal data protection duties did not begin in 2027. Law No. 27 of 2022 on Personal Data Protection (“PDP Law”) took effect on 17 October 2022, and the adjustment period ended two years later on 17 October 2024. Government Regulation No. 33 of 2026 (“GR 33/2026”), promulgated on 16 July 2026, takes effect on 16 January 2027. It gives the framework procedures, records and deadlines. An Indonesia PDP compliance checklist should test what a company can prove now, not treat 2027 as the start of its duties.
Where Compliance Gaps Appear
Gaps sit between departments. HR collects employee data, marketing gathers customer details and procurement engages providers. As a result, separate templates can obscure how personal data moves through the business.
For example, consider a Jakarta manufacturer. HR collects employee identity and bank details through a payroll vendor’s onboarding portal, and the vendor stores them with an overseas cloud provider. Consent is bundled into the employment contract. No retention period is set, and the vendor agreement says little about incident reporting.
Taken together, these gaps create connected compliance risks. Article 74 of GR 33/2026 requires processing records, including the vendor, overseas recipient and transfer mechanism. Articles 161 and 162 require advance assessment of the transfer and relevant safeguards. Article 165 establishes a tiered approach, starting with equivalent or higher protection in the recipient country, followed by adequate and binding safeguards if needed. Consent is a last resort, limited to qualifying nonrecurring transfers and subject to limits on the number of data subjects, risk assessment and required disclosures under Article 173. General consent should not be assumed to cover routine payroll transfers.
Under Articles 14 and 15, the processor agreement must meet prescribed requirements, and written controller approval is needed before a subprocessor is appointed. If a breach occurs, Article 114 requires written notice to affected individuals and the authority within 3 × 24 hours after the controller becomes reasonably aware of the failure. Article 118 requires prompt processor notice. One portal affects records, contracts, transfers and incident response.
Article 2 also covers foreign controllers and processors whose processing activities have legal effect in Indonesia. Article 223 permits processing to continue while relevant agency regulations are pending only if it does not conflict with GR 33/2026. This is not a blanket exemption from requirements already implementable.
Seven Review Areas for Management
Duties vary according to a company’s role and activities.
- Data mapping and processing records. Maintain a register of data types, purposes, recipients, retention periods and transfers. Article 74 requires controllers to record processing activities.
- Lawful grounds and consent. Identify a lawful basis for each purpose under Article 30. A contract or legal obligation may apply where its conditions are met. Where consent is relied on, retain evidence under Article 36 and avoid bundling it ambiguously with general terms, as addressed in the Elucidation to Article 32.
- Privacy notices and joint controllers. Check notices for legal basis, purposes, data types, retention period and individual rights under Article 62. Joint controllers should document their roles, responsibilities and shared contact point under Articles 11 and 12.
- Contracts, vendors and international transfers. Review processor agreements under Article 14 and written approval for subprocessors under Article 15. Controllers remain responsible for processing by their processors under Article 13. Record each overseas recipient, transfer basis, assessment and safeguards under Articles 161 to 173.
- Retention and deletion. Adopt the retention policy required by Article 75 and test whether deletion occurs when the retention period expires, as required by Article 80. Keep logs.
- Governance and the data protection officer (“DPO”). Appoint a DPO when Article 142 criteria apply, including public service processing, large scale systematic monitoring as a core activity, or large scale processing of specific or criminal data as a core activity. Article 144 permits an internal or external officer. Document the decision.
- Requests, incidents and audits. Provide an accessible channel for recorded requests under Article 20 and meet applicable deadlines, including the 3 × 24 hour access period under Article 77. Maintain incident procedures under Article 117 and audit reports under Article 138.
Turning the Review Into Evidence
Treat these seven areas as one remediation plan. Assign named owners in legal, HR, IT and procurement, set deadlines before 16 January 2027, and keep evidence centrally. Useful records include the processing register, consent logs, notices, vendor agreements, transfer assessments, deletion logs, incident exercises and audit reports.
The PDP Law requires controllers to demonstrate compliance. It caps administrative fines at 2% of annual revenue under Article 57(3), while Articles 184 and 185 of GR 33/2026 address administrative sanctions and calculation. Keep evidence as part of ordinary operations rather than assembling it only after a request.
Start with the vendor list. Identify every provider that can access personal data, including cloud and support providers. Check processing terms, subprocessors, international transfers and incident reporting. This reveals other policies to update before January 2027.
