28th September 2026
OVERVIEW
This year marks a pivotal moment for personal data protection in Indonesia, as the government has officially unveiled Government Regulation No. 33 of 2026 (“GR No. 33/2026”), which serves as the implementing regulation of Law No. 27 of 2022 on Personal Data Protection, as last amended by Law No. 1 of 2026 on Criminal Adjustment (“PDP Law”). With the release of GR No. 33/2026, the Indonesian government is taking significant strides to clarify the application of the PDP Law and provide additional guidelines.
GR No. 33/2026 will take effect on 16 January 2027. Upon the regulation’s effectiveness, data controllers, data processors, and other relevant stakeholders will be required to ensure that their personal data processing activities and related compliance frameworks align with the requirements set out in the regulation.
This article, prepared by Michael Cecio Bangun (Partner) and Rania Nasir (Associate) from IMCOLaw, provides an overview of several key provisions under GR No. 33/2026, including the basis for personal data processing and other compliance obligations that may have practical implications for businesses in preparing for the implementation of Indonesia’s personal data protection framework.