Digital transformation has turned personal data into one of the most valuable assets for organizations. At the same time, the increasing exchange and use of data has also raised the expectations of regulators, customers, investors, and the public regarding responsible data governance.
With the issuance of Government Regulation Number 33 of 2026 as the implementing regulation of Law Number 27 of 2022 on Personal Data Protection (the PDP Law), Indonesia has entered a new phase in the implementation of a more comprehensive personal data protection regime. Pursuant to Article 225, this regulation will come into force 6 (six) months after the date of its promulgation, namely on 16 January 2027. Accordingly, companies have increasingly limited time to ensure their compliance readiness.
However, the question that needs to be asked is no longer merely “Is the company already compliant?”, but rather “Is the company ready to manage personal data as part of its governance and business strategy?”
PDP Compliance Is No Longer Merely a Regulatory Requirement
Many organizations still view personal data protection as an administrative legal obligation. In fact, the current PDP regulations demand a more fundamental change, namely how companies manage personal data comprehensively in their day-to-day operations.
Government Regulation No. 33 of 2026 regulates various important aspects, ranging from the basis for processing personal data, data subject rights, data security governance, personal data protection impact assessments, the appointment of Officers or Officials of Personal Data Protection (PPDP), cross-border data transfers, to supervision and administrative sanctions.
Given this broad scope, compliance can no longer be achieved merely through the drafting of policies or formal documents. Companies need to ensure that their business processes, technology, human resources, and risk management are aligned with the applicable provisions.
Five Strategic Preparations Companies Need to Undertake Now
With the implementation period drawing closer, there are several priority steps that management needs to address immediately.
1. Mapping the Personal Data Managed by the Company
The first step is to understand what data the company collects, uses, stores, shares, and deletes. Without adequate data mapping, organizations will struggle to identify compliance obligations, security risks, and the data subject rights that must be fulfilled.
2. Reviewing the Basis and Purpose of Data Processing
Every personal data processing activity must have a clear legal basis and a legitimate purpose. Companies need to ensure that the practices that have been carried out to date remain relevant and in line with the provisions of the PDP Law and its implementing regulations. Excessive data collection or data collection without a clear purpose has the potential to give rise to compliance risks.
3. Strengthening Governance and Documentation
Privacy policies, internal procedures, agreements with third parties, incident management mechanisms, as well as the recording and documentation of data processing activities need to be evaluated and updated periodically. Good documentation not only supports compliance, but also helps organizations demonstrate their accountability in the event of an examination by a regulator. Companies also need to identify processing activities that have the potential to pose high risks in order to determine whether a Personal Data Protection Impact Assessment needs to be conducted before the processing begins.
4. Evaluating the Obligation to Appoint and the Competence of the PPDP
Companies need to evaluate whether the Personal Data processing activities they carry out meet the criteria that require the appointment of an Officer or Official Performing the Personal Data Protection Function (PPDP). Where a company is required to appoint a PPDP, the party performing that function must meet the requirements of professionalism, knowledge of the law and practice of Personal Data Protection, and the ability to perform their duties effectively.
The obligation to appoint a PPDP applies, among other things, where the processing is carried out for the purposes of public service, the core activities require regular and systematic monitoring of Personal Data on a large scale, and/or the core activities involve the processing of Personal Data of a specific nature or relating to criminal offenses on a large scale.
5. Managing Third-Party Risk and International Data Transfers
In the digital era, many organizations use technology service providers, cloud providers, and business partners that also process personal data. This situation requires companies to evaluate contracts, security mechanisms, and the compliance of the parties involved, including where personal data is transferred outside the territory of Indonesia.
The Risk of Non-Compliance Is Becoming More Significant
Non-compliance with personal data protection provisions may give rise to consequences that are broader than administrative sanctions alone. In addition to the potential temporary suspension of Personal Data processing activities, deletion or destruction of Personal Data, and administrative fines, companies may also face operational disruption, loss of customer trust, reputational decline, and increased exposure to legal disputes.
In an increasingly digital business landscape, a reputation for managing personal data has become part of a company’s competitive advantage.
Compliance Assessment: The Most Strategic First Step
Based on experience in implementing various regulations in different countries, the biggest challenge for organizations generally lies not in a lack of commitment, but in the lack of clarity regarding their current compliance position. Therefore, conducting a PDP Compliance Assessment is an important first step to:
- Measure the organization’s level of readiness for the PDP Law and Government Regulation No. 33 of 2026.
- Identify compliance gaps.
- Map legal, operational, and reputational risks.
- Determine remediation priorities based on risk level.
- Develop an implementation roadmap that is realistic and aligned with business needs.
Organizations that begin this process early will have sufficient time to carry out improvements in a structured manner before Government Regulation No. 33 of 2026 comes into force.
How Can SW Indonesia Help?
SW Indonesia understands that every organization has different data characteristics, business models, and levels of governance maturity. Therefore, an effective compliance approach must be tailored to the needs of each company.
SW Indonesia provides services that include:
- PDP Compliance Assessment.
- Data Privacy Gap Analysis.
- Drafting of personal data protection policies and procedures.
- Contract review and third-party management.
- Support for the implementation of PDP governance.
- Organizational training and awareness-building.
- Support for the function of the Officer or Official of Personal Data Protection (PPDP).
Supported by professionals who hold competency certifications in the field of Personal Data Protection (PDP), SW Indonesia helps organizations translate regulatory requirements into implementation steps that are practical, measurable, and aligned with business objectives.
Preparation for Government Regulation No. 33 of 2026 should not wait until the regulation takes effect, namely 6 (six) months after the date of its promulgation. Organizations that act earlier will not only be better prepared to meet their regulatory obligations, but will also be able to build customer trust, strengthen corporate governance, and make personal data protection part of a sustainable business advantage.
Disclaimer: This article has been prepared for general informational purposes and does not constitute legal advice. Its application to your company’s specific circumstances should be consulted with our team.
For consultation or other legal services from SW Business Advisory, please contact:
Fanny, S.H.
Senior Associate
T. (+6221) 2222-0200
Bella Siboro, S.H.
Associate
T. (+6221) 2222-0200
