PP 33/2026: Indonesia's personal data protection rules take effect on 16 January 2027

What is PP 33/2026?

UU PDP has applied in full since 17 October 2024, when its two-year transition ended. Many of its obligations still lacked the procedures that say how to meet them. PP 33/2026 supplies those procedures, and gives controllers and processors until 16 January 2027 to put them in place.

This summary draws on legal and press reporting of the regulation. Read the official text on the government's legal information network (JDIH) before relying on a specific article.

What does it ask of controllers?

• Records of all processing activities, kept as evidence of compliance.
• Internal procedures for data subject requests: an electronic request channel, identity verification, a responsible unit, response stages and documentation.
• A balancing assessment when processing relies on legitimate interests.
• An easy, accessible way to withdraw consent.
• Objection procedures for automated processing, with a human involved in the remedy.
• Security measures including pseudonymisation and encryption, resilience, timely restoration and periodic security testing.
• A data protection officer who reports to top management, is independent and has adequate resources.
• Notice to data subjects before and after a merger, split, acquisition or dissolution.

Press coverage also describes new rules for children's data, including identifying users who are children before their data is processed.

What changes for processors?

The appointment of a processor needs a written agreement with minimum clauses, among them oversight, documentation, audits and inspections, and engaging sub-processors only with agreement. Processors must report breaches to the controller.

Cross-border transfers

Before transferring personal data abroad, the controller maps the transfer, assesses its impact on data subject rights, informs data subjects of the purpose, safeguards and risks, and confirms the receiving country has adequate protection. Cloud services and support teams abroad count.

Who enforces it?

The regulation gives the personal data protection agency a role in investigation, mediation and administrative sanctions, with fines set by a list of variables. UU PDP itself caps administrative fines at 2% of annual revenue and requires written breach notice within 3 × 24 hours.

As of October 2026, news reports say the agency has not been formed yet, and commentators note that enforcement depends on it. That leaves time to prepare, not a reason to wait: data subjects can already claim compensation under the law.

How to prepare before 16 January 2027

• Build or refresh the records of processing. Every other duty reads from them.
• Write the data subject request procedure and test it end to end, including identity checks.
• Review processor contracts against the minimum clauses.
• Map cross-border transfers, including cloud services and support staff abroad.
• Appoint the data protection officer with a reporting line to top management.
• Rehearse the breach clock: who decides, who writes the notice, who sends it.

Where Whitesec One fits

The ISO 27701 workspace in Whitesec One keeps these as registers: records of processing, consent and notices, data subject requests, cross-border transfers, PII processors and DPAs, breach notification and a UU PDP compliance page. Whitesec ID in Jakarta works with organisations implementing UU PDP alongside ISO/IEC 27701.