Indonesia PDP Law
Amended Indonesia · In force Oct 17, 2022 · next deadline Jan 16, 2027 (in 4 months)
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Indonesia's GDPR-style data protection law: lawful bases, data subject rights, DPIAs for high-risk processing, DPOs, breach notification within 3x24 hours, and cross-border transfer rules. Full compliance was required after a 2-year transition ending 17 October 2024. Government Regulation 33/2026 (enacted 16 July 2026, effective 16 January 2027) adds implementing detail, including parental consent for children and cross-border transfer mechanisms.
- Who it applies to
- Any person, public body or international organization processing personal data in Indonesia, or abroad where the processing has legal effect in Indonesia or on Indonesian citizens abroad.
- Penalties
- Administrative fines up to 2% of annual revenue or receipts (per violating variable). Criminal penalties up to 4-6 years imprisonment and fines up to IDR 4-6 billion for individuals; corporate criminal fines up to 10x the maximum.
- Enforced by
- PDP Agency (not yet established); interim supervision by the Ministry of Communication and Digital Affairs (Komdigi)
- Official name
- Law No. 27 of 2022 on Personal Data Protection (Undang-Undang Pelindungan Data Pribadi)
- Citation
- Law No. 27 of 2022; implementing Government Regulation No. 33 of 2026
- Topics
- privacy, breach-notification, data-residency, children
Research notes
GR 33/2026 dates come from law-firm reports; an official JDIH link was not found. One source says the PDP Law was amended by Law No. 1 of 2026 (probably criminal-provision alignment with the new Criminal Code, in force 2 Jan 2026), which is why status is 'amended'; this is unverified. The PDP Agency has still not been formed. The BPK JDIH source_url could not be fetched automatically (403), so the page ID should be confirmed.
Related
Australia Cyber Security Act (ransomware reporting)Questions about Indonesia PDP Law
- What are the Indonesia PDP Law compliance deadlines?
- Oct 17, 2022: PDP Law enacted and in force. Oct 17, 2024: PDP Law transition ends. Jan 16, 2027: Implementing regulation GR 33/2026 takes effect.
- When does Indonesia PDP Law take effect?
- Indonesia PDP Law took effect on Oct 17, 2022. The next milestone is Jan 16, 2027: Implementing regulation GR 33/2026 takes effect.
- Who does Indonesia PDP Law apply to?
- Any person, public body or international organization processing personal data in Indonesia, or abroad where the processing has legal effect in Indonesia or on Indonesian citizens abroad.
- What are the penalties under Indonesia PDP Law?
- Administrative fines up to 2% of annual revenue or receipts (per violating variable). Criminal penalties up to 4-6 years imprisonment and fines up to IDR 4-6 billion for individuals; corporate criminal fines up to 10x the maximum.