Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

Indonesia PDP Law

Amended Indonesia · In force Oct 17, 2022 · next deadline Jan 16, 2027 (in 3 months)

Official text
Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics

Deadlines

Coming up
ComplianceJan 16, 2027 · in 3 months · Source
Implementing regulation GR 33/2026 takes effectDetailed PDP implementing rules (DPIA, cross-border, children's consent) apply, 6 months after the 16 Jul 2026 enactment.
Already passed
ComplianceOct 17, 2024 · 2 years ago · Source
PDP Law transition endsControllers and processors must fully comply (Art. 74 two-year transition).
Takes effectOct 17, 2022 · 4 years ago · Source
PDP Law enacted and in forceLaw takes effect on enactment, starting a 2-year transition.

Summaries for reference, not legal advice. Check the official text.

What it does

Indonesia's GDPR-style data protection law: lawful bases, data subject rights, DPIAs for high-risk processing, DPOs, breach notification within 3x24 hours, and cross-border transfer rules. Full compliance was required after a 2-year transition ending 17 October 2024. Government Regulation 33/2026 (enacted 16 July 2026, effective 16 January 2027) adds implementing detail, including parental consent for children and cross-border transfer mechanisms.

Who it applies to
Any person, public body or international organization processing personal data in Indonesia, or abroad where the processing has legal effect in Indonesia or on Indonesian citizens abroad.
Penalties
Administrative fines up to 2% of annual revenue or receipts (per violating variable). Criminal penalties up to 4-6 years imprisonment and fines up to IDR 4-6 billion for individuals; corporate criminal fines up to 10x the maximum.
Enforced by
PDP Agency (not yet established); interim supervision by the Ministry of Communication and Digital Affairs (Komdigi)
Official name
Law No. 27 of 2022 on Personal Data Protection (Undang-Undang Pelindungan Data Pribadi)
Citation
Law No. 27 of 2022; implementing Government Regulation No. 33 of 2026
Topics
Privacy, Breach notification, Data residency, Children
Verified 2026-09-22 kk-advocates.com conventuslaw.com
Research notes

GR 33/2026 dates come from law-firm reports; an official JDIH link was not found. One source says the PDP Law was amended by Law No. 1 of 2026 (probably criminal-provision alignment with the new Criminal Code, in force 2 Jan 2026), which is why status is 'amended'; this is unverified. The PDP Agency has still not been formed. The BPK JDIH source_url could not be fetched automatically (403), so the page ID should be confirmed.

Related

In forceAustralia
Australia Cyber Security Act (ransomware reporting)Australia's first standalone cyber law: mandatory reporting of ransomware or cyber-extortion payments within 72 hours, security standards for consumer smart devices, 'limited use' protections for information shared with ASD and the National Cyber Security Coordinator, and a Cyber Incident Review Board. Ransomware payment reporting has applied since 30 May 2025.In effect since Nov 30, 2024
AmendedAustralia
Australia Online Safety ActSets up the eSafety Commissioner and removal schemes for cyber-bullying of children, adult cyber-abuse, non-consensual intimate images and abhorrent violent material. It also sets Basic Online Safety Expectations with reporting duties, and binding industry codes and standards. The Unlawful Material codes and standards cover class 1A and 1B material such as child sexual exploitation and pro-terror content. The Age-Restricted Material codes cover class 1C and class 2 material such as online pornography, and require age assurance and other measures to protect children.In effect since Jan 23, 2022
AmendedAustralia
Australia Privacy ActAustralia's federal privacy law (13 Australian Privacy Principles, Notifiable Data Breaches scheme). The 2024 amendment adds a statutory tort for serious invasions of privacy, tiered civil penalties and infringement notices, a mandate for a Children's Online Privacy Code, clearer security duties, and privacy-policy transparency for substantially automated decisions from 10 December 2026. It also adds criminal doxxing offences.Next: Dec 10 Children's Online Privacy Code must be registered · in 44 days
AmendedAustralia
Australia SOCI ActAustralia's critical infrastructure security law. Owners and operators of critical infrastructure assets must register ownership and operational information, and many must report cyber security incidents to the Australian Signals Directorate. Responsible entities for many asset classes must also keep a critical infrastructure risk management program. Systems of national significance face enhanced cyber security obligations, and the government has step-in and assistance powers.In effect since Jul 11, 2018
In forceAustralia
Australia Social Media Minimum AgeRequires providers of age-restricted social media platforms to take reasonable steps to stop Australians under 16 from having accounts. Platforms may not rely only on government ID for age assurance, and must protect data collected for age checks and destroy it after use. eSafety has named platforms including Facebook, Instagram, Snapchat, TikTok, X, YouTube, Reddit, Threads, Twitch and Kick.In effect since Dec 10, 2025
In forceChina
China Algorithmic Recommendation ProvisionsRegulates recommendation, ranking, personalization, generation and dispatch algorithms used in internet services in China. Users must be able to switch off personalized recommendations and manage tags, and providers may not use algorithms for price discrimination or to induce addiction. Providers with public opinion attributes or social mobilization capacity must file their algorithms with the CAC within 10 working days of launching a service.In effect since Mar 1, 2022
In forceChina
China Anthropomorphic AI MeasuresRegulates AI companion and emotional interaction services that simulate human personality. Providers must tell users they are talking to AI, remind users after every 2 hours of use, intervene in crises such as self-harm, offer easy exit, and may not offer virtual partner or relative services to minors. Users' interaction data may not be shared or used for training on sensitive data without consent, and services with 1 million registered or 100,000 monthly active users need a security assessment filed with the provincial CAC.In effect since Jul 15, 2026
In forceChina
China Cross-Border Data Flow ProvisionsRelaxes China's data export regime by exempting common transfers (contracts with the individual, cross-border HR, emergencies, and non-CII transfers of PI of fewer than 100,000 people a year) and setting volume thresholds for when a CAC security assessment, standard contract or certification is needed. Data is not 'important data' unless regulators have notified or published it as such.In effect since Mar 22, 2024
Questions about Indonesia PDP Law
What are the Indonesia PDP Law compliance deadlines?
Oct 17, 2022: PDP Law enacted and in force. Oct 17, 2024: PDP Law transition ends. Jan 16, 2027: Implementing regulation GR 33/2026 takes effect.
When does Indonesia PDP Law take effect?
Indonesia PDP Law took effect on Oct 17, 2022. The next milestone is Jan 16, 2027: Implementing regulation GR 33/2026 takes effect.
Who does Indonesia PDP Law apply to?
Any person, public body or international organization processing personal data in Indonesia, or abroad where the processing has legal effect in Indonesia or on Indonesian citizens abroad.
What are the penalties under Indonesia PDP Law?
Administrative fines up to 2% of annual revenue or receipts (per violating variable). Criminal penalties up to 4-6 years imprisonment and fines up to IDR 4-6 billion for individuals; corporate criminal fines up to 10x the maximum.