Indonesia data protection: Regulation 33 introduces new operational requirements

23 October 2026

Law No. 27 of 2022 on Personal Data Protection (“PDP Law”) established Indonesia’s principal data protection framework. Government Regulation No. 33 of 2026, issued on 16 July 2026, now fills many of the practical gaps left by that framework (“Regulation 33”). Its significance lies less in changing the principles under the PDP Law than in requiring businesses to translate those principles into contracts, records, assessments, and operational procedures.

Regulation 33 forms part of a broader strengthening of data protection frameworks across South-east Asia. In recent years, several ASEAN jurisdictions have introduced or updated privacy legislation, while ASEAN has continued to develop regional tools intended to facilitate trusted cross-border data flows. Although national approaches remain distinct, the overall direction is towards more developed regulatory frameworks and greater emphasis on organisational accountability and cross-border data governance.

Indonesia’s direction is consistent with this wider trend, but Regulation 33 is notable for the level of operational detail it brings to the PDP Law. Requirements concerning Controller-Processor arrangements, record-keeping, data protection impact assessments, cross-border transfers, corporate restructurings, and breach response increasingly require businesses to demonstrate how data protection principles are implemented in practice.

This article highlights the key operational requirements introduced by Regulation 33 and the practical steps businesses should consider before it takes effect on 16 January 2027.