Viewing Personal Data Protection as a Corporate Investment

The Government has issued Government Regulation (PP) No. 33 of 2026 on the Implementing Regulations for Law No. 27 of 2022 on Personal Data Protection (the PDP Regulation). It was stipulated and promulgated on 16 July 2026 and will come into force six months after its promulgation.

The regulation is an important basis for clarifying the implementation of various provisions of the PDP Law, including personal-data processing, the fulfilment of data subjects’ rights, the obligations of personal-data controllers and processors, and provisions concerning Personal Data Protection Officers or employees.

With the implementing regulation in place, relevant parties, including corporations, need to ensure that personnel responsible for personal data protection not only understand the PDP Law’s basic principles but can also translate regulatory requirements into organisational compliance practices.

Competence in PDP governance, risk management, fulfilling data subjects’ rights, documenting processing, and drawing up and implementing PDP programmes is also becoming increasingly important.

Raditya Kosasih, co-founder of the Indonesian Association of Personal Data Protection Practitioners (APPDI), said at a focus group discussion entitled “Privacy Thought Leadership” that around 51 per cent of personal-data processing carries potentially high risks.

“If we look at the PDP Law, where personal-data processing has potentially high risks, there is an obligation to carry out a Data Protection Impact Assessment, or an analysis of the impact of personal-data processing. In practice, however, approaches vary considerably,” Kosasih said at the discussion, held at Hukumonline on Thursday (8 October).