The entry into force of Government Regulation (PP) No. 33 of 2026 concerning the Implementing Regulation of the Personal Data Protection Law (UU) on 16 January 2027 marks an important milestone for companies in strengthening personal data governance and controls. This overview outlines the implications of personal data protection risks for business continuity, financial performance, and customer trust. It covers potential administrative sanctions, risks arising from excessive data retention, the use of artificial intelligence applications, third-party service provider management, and companies’ readiness to handle data subject requests and personal data incidents. Furthermore, data flow mapping, cross-functional allocation of responsibilities, and the establishment of measurable and properly documented improvement priorities are essential to strengthening compliance. Through a risk-based approach and enhanced internal controls, companies can identify compliance gaps, reduce potential operational disruptions, and build lasting customer trust.
Imagine a company having to temporarily suspend the processing of customer data. Orders may be delayed, services may be difficult to operate, and the sales team may lose access to the information it needs. In a data-dependent business, such disruption can be more burdensome than a fine. This is why personal data protection needs to be included on the board of directors’ agenda: decisions about data determine how resilient the company is in maintaining its operations.
Government Regulation Number 33 of 2026 on the Implementing Regulation of the Personal Data Protection Law, which takes effect on 16 January 2027, gives companies new urgency to improve data governance. The preparation period should be used to test one fundamental point: does the company truly control the data it collects? The answer needs to be evident in how people work, the access granted, and the decisions made when problems arise.
Reading the Risks Behind the Fine
The maximum administrative fine of 2% of annual revenue or annual receipts easily attracts attention. This limit is also set out in Article 57 of Law Number 27 of 2022 on Personal Data Protection. The figure is a maximum limit, not an automatic rate for every violation. For management, the implication remains important because revenue and profit are two different measures. Companies with thin margins need to understand the magnitude of this exposure more carefully.
However, calculating risk based only on fines will produce an overly narrow picture. Administrative sanctions may also include the temporary suspension of processing, as well as the deletion or destruction of personal data. If the affected process supports core services, the consequences may extend to cash receipts, relationships with partners, and customer trust. Therefore, risk assessments should link each data processing activity to the business processes that depend on it.
Consider the illustrative example of a company that stores customer data in a third-party marketing application. If the company does not understand who can access the data and how the data is deleted after the contract ends, the problem has already taken shape before a breach occurs. Dependence on service providers needs to be balanced by clear contracts and demonstrable oversight.
Excess Data Carries Hidden Costs
The habit of retaining data “just in case” should be reconsidered. Copies of identity cards, transaction histories, and former employees’ documents are often retained because they are considered potentially useful. In fact, every additional piece of data expands what must be secured and monitored. Management needs to ask whether the benefit of retaining the data remains proportionate to the security costs and the risks that are also retained.
Here, compliance can improve business discipline. Data mapping helps a company see what information is collected, for what purpose, on what legal basis, and how long it needs to be retained. The results can form the basis for limiting unnecessary collection and establishing deletion in accordance with applicable obligations. The company also gains a clearer picture of the data actually needed to serve customers.
This clarity is also relevant when a company uses Artificial Intelligence (AI). Before documents containing personal data are entered into an AI application, the company needs to understand the purpose of use, storage settings, and the parties that can access them. The convenience of an application does not remove the need to assess data processing, including cross-border transfers if they occur. This evaluation should form part of approving the use of an application from the outset.
Test Readiness through Everyday Scenarios
Well-organized policies do not yet answer whether controls work. Try a simple simulation: a customer requests access to their personal data, an employee leaves, or a service provider reports an incident. Who receives the information, who makes the decision, and what evidence is available? Different answers across functions indicate points that need to be addressed. Simulations help reveal obstacles before the company faces them under pressure.
The allocation of responsibilities needs to follow the process. The legal team assesses the basis for processing and contractual obligations, the technology team maintains security, while business process owners explain the need to use the data. The board of directors needs to ensure that cross-functional decisions have clearly assigned accountability. Without this, each function may feel that it has performed its duties while the risks between functions remain unaddressed.
The compliance assessment then needs to produce a realistic order of work. Prioritize activities that have the potential to cause significant impact on individuals or disrupt core services. Assign a person responsible, a deadline, and evidence of completion for each improvement. Progress is more usefully measured by gaps that are actually closed for example, former employees’ access being revoked or service provider contracts being improved than by the number of policies that have been completed.
Support from SW Indonesia
SW Indonesia can support companies through personal data protection compliance assessments, mapping of data flows and responsibilities, and identification of gaps in policies, procedures, and arrangements with third parties. The support can continue with
an assessment of risk exposure, the preparation of improvement priorities, and the strengthening of control documentation in accordance with the company’s needs. With this approach, management has a clearer basis for allocating resources and monitoring readiness for implementation.
Ahead of the entry into force of Government Regulation Number 33 of 2026, the board of directors needs to request a concrete picture of the areas where business operations depend on personal data and the improvements that remain incomplete. Customer trust is built through everyday decisions about how their data is used. Companies that are able to explain and demonstrate those decisions will be better prepared to maintain services when requests, inspections, or incidents arise.
References: Government Regulation Number 33 of 2026; Law Number 27 of 2022 on Personal Data Protection, particularly Article 57.
