JAKARTA: Indonesia has published long-delayed implementation rules for its 2022 Personal Data Protection (PDP) Law, spelling out for the first time how companies may legally transfer personal data abroad, even as the authority to enforce those rules remains to be created four years after the landmark law took effect.
Government Regulation No. 33/2026, signed on July 16 but only circulated publicly in late August, sets out detailed obligations for any business that collects or processes personal data, to consent requirements and how consumers can seek redress.
It also sets out a detailed regime for cross-border data transfers, recognising adequacy decisions and binding corporate rules as legal pathways for moving Indonesian personal data overseas.
For companies that have spent years navigating a legal gray zone, the new regulation offers a clearer framework for complying with personal data protection law after years of uncertainty.
“This gives clarity. Now we know what we need to do,” said Danny Kobrata, partner at K&K Associates, describing years of “wait and see” caution among businesses.
“Now there’s no more excuses for companies not to comply, because the rules are already clear,” he said, adding that the lack of implementing rules had hindered business compliance.
The regulation also assigns that authority to publish a list of “adequate” countries and issue standard contractual clauses for transfers outside the list.
However, it has not resolved the rules for cross-border data flows between Indonesia and the United States.
Jakarta and Washington struck a deal on the Arrangement on Reciprocal Trade (ART) last February, under which Jakarta recognised the United States as an “adequate” jurisdiction for data protection, a provision long sought by American cloud, e-Commerce and technology firms looking to move Indonesian user data more freely.
The ART has drawn scrutiny, with experts concerned about possible constitutional and PDP Law violations and highlighting differences in the two countries’ privacy regimes. — The Jakarta Post/ANN
