GR 33/2026 takes effect on 16 January 2027. Six operational priorities—ROPA, data-subject rights, DPIA/AI, processors & transfers, 3×24h breach notice, and PPDP—for organisation leaders.
Tim MarkasDevTechnology Partner, Jakarta
On 16 July 2026 Indonesia promulgated Government Regulation No. 33 of 2026 on the implementing rules for Law No. 27 of 2022 on Personal Data Protection (PP / GR 33/2026). Under Article 225 it takes effect six months later: 16 January 2027. That date is not the start of PDP compliance. The PDP Law is already in force, its two-year adjustment period has ended, and GR 33/2026 now spells out operational duties organisations must be able to demonstrate—not merely describe in a policy.
For executives, operations leads and legal teams in companies, local government, regional SOEs (BUMD), healthcare facilities or local finance institutions, the practical question is simple: what must be ready before that deadline, and in what order if capacity is limited? This article summarises six priorities drawn from law-firm and adviser analyses that examine the circulating text of GR 33/2026, then places them in MarkasDev’s Diagnose, Deliver and Operate model so technical work and governance stay connected.
GR 33/2026 strengthens the expectation that organisations can demonstrate—not merely state—their compliance. (RSM Indonesia, 18 September 2026)
GR 33/2026 runs to 225 articles across twelve chapters. It does not replace the PDP Law; it operationalises many duties that previously lacked detail: lawful bases and consent, data-subject rights, data protection impact assessments (DPIAs), breach notification, processor and cross-border transfer arrangements, the PPDP/DPO function, accountability, and administrative sanctions.
Some technical details still await the personal data protection supervisory institution (“the Lembaga”). An adequacy whitelist, official standard contractual clauses and a fuller DPIA methodology are not yet fully available. That is not a reason to postpone the basics. Analyses we opened stress that processing may continue if it does not conflict with the regulation, but delaying implementation still raises operational and reputational risk.
Without an accurate data map, everything else is hard to measure. Organisations need a record of processing activities (ROPA), a lawful basis for each activity, aligned privacy notices and—where consent is used—capture and withdrawal mechanisms that can be evidenced. Consent must be explicit, freely given, specific and not misleading. A group policy or a GDPR copy alone does not automatically satisfy Indonesian requirements.
GR 33/2026 restates rights that systems and procedures must support: access, correction, withdrawal of consent, restriction and—in defined cases—portability and objection to solely automated decisions with legal or significant effects. Many organisations have a form but have not tested identity verification and fulfilment within the relevant timelines. An end-to-end drill now is cheaper than failing the first real request after the deadline.
A DPIA is required before high-risk processing. Trigger categories include automated decision-making with legal or significant effects, specific (sensitive) personal data, large-scale processing, systematic evaluation or monitoring, matching or combining datasets, new technology, and processing that restricts data-subject rights. The elucidation expressly names artificial intelligence, machine learning, smart technology and the Internet of Things as examples of new technology. “Large-scale” is assessed contextually—volume, number of subjects, duration, data type, purpose and geographic reach—rather than by a single fixed number.
Engaging a processor requires a written agreement with minimum terms. Subprocessors need the controller’s prior written approval and an equivalent level of protection. For transfers outside Indonesia the order of bases is: equivalent or higher protection in the destination, then adequate and binding safeguards, and only as a narrow last resort—the data subject’s consent for non-recurring, limited transfers. Because the Lembaga is not yet fully operational, a whitelist and official SCCs cannot be treated as “done”; what you can do now is map data flows, review cloud/SaaS/group contracts and document the risks.
If a personal data protection failure occurs, the controller must notify affected data subjects and the Lembaga in writing no later than 3 × 24 hours after the failure is established with certainty and on reasonable grounds. Where the breach disrupts public services or seriously affects the public interest, public notification may also be required. Processors must report to the controller at the earliest opportunity. Incident procedures must therefore support rapid fact-finding, legal assessment and notification approval—not only a document in a shared folder.
A PPDP must be appointed in defined cases: public services; regular and systematic large-scale monitoring as a core activity; or large-scale processing of specific personal data or data relating to criminal offences. The PPDP needs access to top management, adequate resources and independence. Controllers must also demonstrate accountability through documentation, responses to Lembaga requests, and internal and external personal data protection audits.
For specified violations the Lembaga may issue a written warning, temporarily suspend processing, order deletion or destruction of personal data, and/or impose an administrative fine. Fines may reach up to 2% of the controller’s or processor’s annual revenue or receipts, considering factors such as impact, duration, data categories, number of subjects affected, cooperation, business scale, ability to pay and compliance history. Supervision results may also be published—a reputational exposure that rarely appears in early budget slides.
PDP compliance is not a “one document and done” project. It touches data inventories, vendor contracts, subject-rights workflows, DPIAs for AI or monitoring initiatives, incident procedures and ownership after go-live. MarkasDev’s Technology Partner model breaks that work so decisions and evidence move together.
If you are weighing when paid discovery makes sense before a large budget is locked, see also when an organisation needs a paid Diagnose. To compare a long-term partner model with a one-off build, read software house vs Technology Partner.
Six months to 16 January 2027 looks long on a calendar and short when legal, IT, security, HR, procurement and the business must move together. An honest baseline is safer than waiting for an “official template” that may not arrive on your schedule.
GR 33/2026 shifts the conversation from “do we have a privacy policy” to “can we prove the controls work”. Organisations with GDPR-style programmes have a starting point, but still need Indonesia-specific localisation—especially on notices and consent, minimum ROPA and retention content, the three-tier transfer framework, and DPIA triggers and content.
If you want to review system readiness, integration and operational governance around personal data in your organisation, contact the MarkasDev team. We help clarify the problem and the work sequence before a large budget is committed—without claiming to be legal counsel; for statutory interpretation and legal opinions, involve your advisers.
Trellix Wise for Private Cloud GA 15 Oct 2026: AI for the SOC inside your boundary. Survey of 600 CISOs: 95% saw an AI-linked insider incident, average cost USD 2.4M. Five steps for business.
FIDO's Passkey Index 2026: passkey sign-ins succeed more often, are faster, and cut phishing and SMS OTP costs. But while passwords remain a fallback, the gap stays open. Six steps for businesses.
