Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

Jurisdiction

Indonesia: data, AI and cyber laws

Part of APAC.

Regulations

Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics
Amended
Indonesia PDP LawIndonesia's GDPR-style data protection law: lawful bases, data subject rights, DPIAs for high-risk processing, DPOs, breach notification within 3x24 hours, and cross-border transfer rules. Full compliance was required after a 2-year transition ending 17 October 2024. Government Regulation 33/2026 (enacted 16 July 2026, effective 16 January 2027) adds implementing detail, including parental consent for children and cross-border transfer mechanisms.Next: Jan 16, 2027 Implementing regulation GR 33/2026 takes effect · in 3 months
In force
Indonesia PP 17/2025 (Child Protection Online)Implements the child protection provisions added to Indonesia's Electronic Information and Transactions Law by Law No. 1 of 2024. It sets rules for how electronic system operators must protect children who use their products and services, how the government supervises them, and which administrative sanctions apply. Ministries and the public also have defined roles.In effect since Mar 27, 2025

Upcoming deadlines

ComplianceJan 16, 2027 · in 3 months
Indonesia PDP LawImplementing regulation GR 33/2026 takes effectDetailed PDP implementing rules (DPIA, cross-border, children's consent) apply, 6 months after the 16 Jul 2026 enactment.Indonesia

Past deadlines

Takes effectMar 27, 2025 · 19 months ago
Indonesia PP 17/2025 (Child Protection Online)PP 17/2025 in forceThe regulation was signed, promulgated and took effect on the same day.Indonesia
ComplianceOct 17, 2024 · 2 years ago
Indonesia PDP LawPDP Law transition endsControllers and processors must fully comply (Art. 74 two-year transition).Indonesia
Takes effectOct 17, 2022 · 4 years ago
Indonesia PDP LawPDP Law enacted and in forceLaw takes effect on enactment, starting a 2-year transition.Indonesia