Indonesia’s New Personal Data Protection Regulation: Key Changes Under GR 33/2026
On July 16, 2026, the Indonesian Government issued Government Regulation No. 33 of 2026 on the Implementation of Law No. 27 of 2022 regarding Personal Data Protection (“GR 33/2026”), providing detailed rules on how Indonesia’s Personal Data Protection Law will apply in practice.
GR 33/2026 introduces important developments across the personal data protection framework, including new requirements for data processing agreements, data subject rights, impact assessments and data protection officers, data retention, CCTV and other visual monitoring, personal data breach notifications, cross-border data transfers, and the handling of personal data in corporate transactions. It also establishes more detailed procedures for administrative sanctions and dispute resolution.
For businesses, the regulation means that existing data protection policies, agreements and operational processes may need to be reviewed and updated before GR 33/2026 takes effect. This article highlights the key changes and practical steps businesses should consider now.
Click here to read the full report






