A Customer Asks to Delete or Copy Their Data? From 2027 Indonesia's Deadline Is 3 x 24 Hours
Indonesia's Regulation 33/2026, effective 16 January 2027, requires data subject requests to be met within 3 x 24 hours. In a small business those requests arrive by chat, so what you need is a workflow, not good intentions.From 16 January 2027, when Indonesia's Government Regulation 33/2026 takes effect, a person's request concerning their own personal data must be met within 3 x 24 hours. According to a review by SIP Law Firm dated 23 October 2026, the deadline covers requests to update data, to access it, to receive a copy, to withdraw consent and to restrict processing, and it binds the data controller, meaning the party that decides what the data is used for.
In a small business such a request rarely arrives as a formal letter. It is a WhatsApp message on a Saturday night: "Please remove my number from your promotions" or "I want to know what data you hold on me". Three times twenty-four hours means Tuesday night, weekend or no weekend.
What the rule says, and what is not yet clear
From the SIP Law Firm review:
- Data subject requests for updating, access, a copy, withdrawal of consent and restriction of processing must be met within 3 x 24 hours.
- The controller must verify the requester's identity and authority. For copy requests, the count starts once the request has been received and verified.
- Processing that relies on a contract must be genuinely necessary for a contract with the data subject, and the contract must state the purpose, the data subject's rights and the consequence if the data is not processed.
- Administrative fines of up to 2% of annual revenue may be imposed for, among other things, breaches of data subject rights.
One thing should be said plainly. Our title uses "delete" because that is the request people most often make in everyday life. The review we read, however, does not mention deletion in its sentence on the 3 x 24 hour deadline. The detail of each right, deletion and its exceptions included, should be checked in the regulation's text or with a consultant. The review also does not discuss duties to keep documents for tax and bookkeeping, so we draw no conclusion on that.
The 2% figure is a ceiling, and the same review notes that the supervising agency had not been fully formed as of September 2026. The reason to prepare is not fear. Handling a data subject request Indonesia's new rule describes is a reasonable thing for a customer to ask, and customers who get a quick answer tend to stay.
A five-step workflow for requests by chat
This section is our practical advice.
1. Recognise the request
Staff do not need legal vocabulary. One rule is enough: any message that mentions "my data", "remove my number", "stop sending promotions", "send me a copy" or "change my address" gets a special tag and goes to one named owner the same day. Name a stand-in for weekends and holidays too.
2. Log the time
Write the date and time the message arrived in a single log sheet. The deadline runs from there. Reply at once with a short acknowledgement, for example: "We received your request today at 19:40 and are working on it."
3. Check it is the right person
Verification is required, and it protects your customers from impersonators. Reasonable methods for a small firm:
- The request comes from the same number or email you have on record: usually sufficient.
- It comes from a different number: ask the person to resend from the registered one, or match two details only the customer would know, such as the date and contents of the last order.
- Someone claims to act for another person: ask for proof of authority.
Do not ask for an identity card photo just to verify when another method exists. That adds sensitive data you then have to protect.
4. Search everywhere
This is where most businesses stumble. One customer's data is usually scattered:
| Place | What is usually there |
|---|---|
| Chat | Name, number, address, payment proof photos |
| Spreadsheet or CRM | Contact, notes, quote history |
| Till or marketplace | Order history |
| Bookkeeping | Invoices and payments |
| Promotion broadcast lists | Phone number |
| Staff phones | Saved contacts, screenshots |
Keep this as a fixed checklist. For each request, tick the places off one by one.
5. Fulfil, reply and keep the evidence
- Access or copy: send a tidy summary of what you hold, through the verified channel.
- Update: change it everywhere, not only in chat.
- Withdrawal of consent to promotions: remove the person from every broadcast list and flag them so they are not added again.
- Restriction or a deletion request: do what clearly can be done, such as stopping promotions and removing the data from marketing lists. For transaction and bookkeeping records, say honestly that you are confirming your retention duties, then ask a consultant.
Close with a confirmation message to the customer, then record who asked, when it arrived, how you verified, what was done, when it was finished and who did it. That record is your evidence if you are ever asked.
Test it before January
Run one drill this month. Ask an acquaintance to send a copy request on a Friday afternoon and see whether your team completes it before Monday afternoon. The first finding is usually simple: nobody thought it was their job, or nobody knew that customer data also sits on the courier's phone.
The workflow is lighter when conversations and customer notes live in one place. Polynusa's shared WhatsApp inbox, with notes and follow-up tasks per customer, is built for that kind of work, and details are on the pricing page.
Note: this is not legal advice. Confirm the detail of rights and duties for your business with a legal consultant or the data protection authority.
Sources
- SIP Law Firm, 23 October 2026: PP 33/2026 Pelindungan Data Pribadi
FAQ
Which requests must be met within 3 x 24 hours?
According to SIP Law Firm's review of Regulation 33/2026: updating data, access, a copy of the data, withdrawal of consent and restriction of processing. The detail of each right, including deletion, should be checked in the regulation's text.
Must a business delete data immediately when asked?
The review we read does not mention deletion in its sentence on the 3 x 24 hour deadline, and does not address duties to keep tax or bookkeeping documents. Log the request and confirm with a consultant before deleting transaction records.
How do you confirm the requester owns the data?
The controller must verify the requester's identity and authority. In practice, ask for the request to come from the phone number or email on record, or match two details of the most recent order.