Indonesia is Southeast Asia’s largest digital economy. Its Personal Data Protection Law has applied since October 2024, and a detailed implementing regulation, GR 33/2026, takes effect on 16 January 2027. The independent data protection agency has still not been established, so the communications ministry (Komdigi) supervises in the meantime.
Most foreign platforms serving Indonesians also need to register as electronic system operators. Fintech and e-commerce face additional sector rules from OJK, Bank Indonesia and the trade ministry.
- Core data law
- Law 27/2022 on Personal Data Protection (UU PDP)
- Implementing rules
- GR 33/2026, effective 16 Jan 2027
- Regulator
- Komdigi for now; PDP Agency pending
- Platform registration
- Electronic System Operator (PSE) registration
- Breach notice
- Within 3 x 24 hours
- Penalties
- Administrative fines up to 2% of annual revenue; criminal sanctions
Who needs to comply
Any startup processing personal data of Indonesians
UU PDP applies inside Indonesia and to processing abroad with legal effects in Indonesia or on Indonesian citizens.
Apps, platforms and SaaS serving Indonesian users
Private electronic system operators must register with the ministry before operating.
Fintech and payments
OJK and Bank Indonesia rules add licensing, data and IT requirements.
The laws, in detail
01Personal Data Protection Law (UU PDP) & GR 33/2026
Lawful bases, consent, rights, controller and processor duties, DPIAs, DPOs, breach notification and transfers.
When it applies
Processing in Indonesia, or abroad where it has legal consequences in Indonesia or for Indonesian citizens abroad.
What you must do
- Lawful basis, with explicit consent for many uses
- Data subject rights, including access, correction, deletion and objection to automated decisions
- DPIA for high-risk processing; DPO where required
- Written notice of breaches to data subjects and the authority within 3 x 24 hours
- Cross-border transfers only to adequate countries, with safeguards or with consent
Regulator
Komdigi (until the PDP Agency is established)
Penalties
Administrative fines up to 2% of annual revenue, plus criminal penalties for unlawful collection, disclosure or use.
02Electronic System Operator (PSE) rules
Registration and obligations of private electronic system operators.
When it applies
Platforms, apps and online services offered to users in Indonesia.
What you must do
- Register with the ministry
- Cooperate with access and takedown requests
- Content moderation duties
Regulator
Komdigi
Penalties
Warnings, fines and access blocking.
03Sector rules (OJK, Bank Indonesia)
Licensing, IT risk and data rules for fintech, lending and payments.
When it applies
Regulated financial services and their technology partners.
What you must do
- Licensing before launch
- IT risk management and data centre requirements
- Consumer protection rules
Regulator
OJK; Bank Indonesia
Penalties
Licence action and sanctions.
04Electronic Information and Transactions Law (ITE)
Electronic transactions, content, platform obligations and cyber offences, amended in 2024.
When it applies
Electronic system operators and users in Indonesia.
What you must do
- Reliable and secure electronic systems
- Content and takedown obligations
- Child protection duties added in 2024
Regulator
Komdigi
Penalties
Administrative sanctions and criminal penalties.
05OJK supervision of crypto-assets
Crypto-asset trading supervision transferred from Bappebti to OJK in January 2025.
When it applies
Crypto-asset exchanges, traders and custodians serving Indonesia.
What you must do
- OJK licensing and registration
- Consumer protection and market conduct rules
- AML/CFT controls
Regulator
Otoritas Jasa Keuangan (OJK)
Penalties
Licence action and sanctions.
Compliance checklist
01 · Before you launch
- Register as an electronic system operator
- Indonesian-language privacy notice and consent
- Map transfers and their legal basis
- Check OJK or Bank Indonesia licensing
02 · At launch
- 3 x 24-hour breach notification process
- Rights request handling
- DPO where processing is large-scale or sensitive
03 · Before 16 Jan 2027
- Gap review against GR 33/2026
- DPIAs for high-risk processing
- Watch for the PDP Agency regulation
Key dates
- Oct 2022UU PDP enacted
- 17 Oct 2024Transition period ends; UU PDP fully applicable
- 16 Jul 2026GR 33/2026 signed
- 16 Jan 2027GR 33/2026 takes effect
Common mistakes
- Skipping PSE registration
- English-only consent
- No 3 x 24-hour breach process
FAQs
Does UU PDP apply outside Indonesia?
Yes, where processing has legal consequences in Indonesia or for Indonesian citizens abroad.
Who enforces it now?
Komdigi, until the dedicated PDP Agency is set up by presidential regulation.
Sources
Reviewed 12 October 2026. General information, simplified for planning; not legal advice. Check current law before relying on any requirement, and get advice for your facts. For markets outside India, advice is coordinated with locally qualified counsel.