A Lost Staff Phone or a Hacked Account: Incident Records and the 3 x 24 Hour Notice Rule
Indonesia's Regulation 33/2026, effective 16 January 2027, requires every data protection failure to be documented, with a 3 x 24 hour notice deadline that runs once the failure is confirmed. Here is a one-page incident sheet.From 16 January 2027, Indonesia's Government Regulation 33/2026 requires every personal data protection failure to be documented, and sets a 3 x 24 hour notice deadline that runs from the moment the failure is confirmed. That is according to a review by SIP Law Firm dated 23 October 2026 of the rule implementing the country's Personal Data Protection Law, which also says internal procedures for prevention and handling must exist.
In a small business a "data protection failure" is rarely a sophisticated hack. It is a staff phone left in a ride-hailing car, a marketplace account whose password was guessed, or a customer spreadsheet shared with the wrong person. This article offers one habit: record, assess, then decide.
What the rule says
From the SIP Law Firm review:
- The 3 x 24 hour deadline starts once the failure has been confirmed as "certain, proper and reasonable" (pasti, patut, dan wajar) on the basis of documentation such as system logs and forensic reports.
- Every failure must be documented, including the data affected, the chronology, the impact, the recovery and the time of notification.
- Internal procedures for prevention and handling must be available.
What the review does not spell out matters just as much. We did not find in it who receives the notice, what format it takes, or whether a threshold exists for small incidents. The same review notes that the personal data protection agency had not been fully formed as of September 2026. So we do not write that every lost phone must be reported. What is certain is that recording is required, and that assessment needs a record. The data breach notification Indonesia's regulation describes begins with documentation.
An example in progress
One large case shows the sequence. According to Katadata on 5 November 2026, PT Fore Kopi Indonesia Tbk, the company behind the Fore Coffee chain, reported a suspected personal data protection failure to the Ministry of Communication and Digital Affairs (Komdigi) on 28 October 2026, said it secured its systems within 24 hours, and asked customers to change their PIN. Komdigi said that if negligence is proven, administrative action or sanctions may follow under the Personal Data Protection Law and the regulation on electronic systems and transactions.
That case is still alleged and still under examination, so nothing can be concluded about cause or fault. Only the pattern matters here: secure, record, notify, and ask customers to take a protective step.
A one-page incident sheet
This section is our practical advice. Print it or save it as a template, and fill it in for every event, however small.
| Section | What to write |
|---|---|
| What happened | One sentence: "The shop's staff phone was lost on the way home" |
| When it was discovered | Date and time, and who noticed first |
| Chronology | The sequence with times, including what is still unknown |
| Data possibly affected | Types of data and a rough number of customers |
| Impact | What someone else could do with that data |
| Recovery steps | What was done, by whom, at what time |
| Assessment | Whether a data protection failure is confirmed, and on what basis |
| Notification | To whom, when, by what channel, the message text |
| Prevention | One change so it does not recur |
The first five rows follow the documentation elements named in the review. The rest help you decide.
The first hour
These sequences cover the two most common events.
The phone holding the business number is lost:
- Lock or wipe the phone remotely if the feature is on.
- Log out every linked device from the business WhatsApp account, then move the number to a replacement SIM through the operator.
- Change the passwords for email, marketplaces and other apps signed in on that phone.
- Write the chronology while memory is fresh.
An account is broken into or used by someone else:
- Change the password and sign out all active sessions.
- Turn on two-step verification.
- Disable access for staff who no longer work there, and check for unknown email forwarding or linked devices.
- Keep evidence: screenshots of login history, warning emails, suspicious messages. This is the documentation your assessment will rest on.
Assessing: notify or not
Because the deadline runs from confirmation, do not put the assessment off. Three questions help:
- Was customer data on that device or account, and what kind?
- Is there any sign someone opened or copied it? A locked phone wiped remotely differs from an account whose history shows a foreign login.
- If the data reached someone else, what could happen to customers? Fraud in your business's name is the most concrete risk.
Write the answers on the sheet with your reasoning. If the answer is "not affected", keep the record anyway. If it is "yes" or "not sure", contact a legal consultant the same day to settle whom to notify and how, because that detail is not in our source.
The message to customers
If you decide to tell customers, keep it short and honest:
- What happened and when.
- What kinds of data may be affected.
- What you have done.
- What they should do, including ignoring any message that asks for a one-time code or a transfer in your name.
- The genuine number for questions.
Draft it now, while nothing is wrong.
Prevention costs less
Three habits shorten the next incident sheet: the business number does not live on one personal phone only, each staff member has their own access that can be removed, and customer data is not copied to places it does not need to be. Polynusa's shared WhatsApp inbox, worked by several staff on the business number, helps with the first. Details are on the pricing page.
Note: this is not legal advice. Confirm the notification duty for your case with a legal consultant or the relevant authority.
Sources
- SIP Law Firm, 23 October 2026: PP 33/2026 Pelindungan Data Pribadi
- Katadata, 5 November 2026: Komdigi Periksa Dugaan Kebocoran 5,7 Juta Data Pelanggan Fore
FAQ
When does the 3 x 24 hour notice deadline start?
According to SIP Law Firm's review of Regulation 33/2026, the count begins once the data protection failure has been confirmed as certain, proper and reasonable on the basis of documentation such as system logs and forensic reports.
Must every lost staff phone be reported?
The source we read does not specify a threshold for small incidents or who receives the notice, so we do not claim that. The safe habit is to record every event, assess whether customer data was affected, and ask a consultant when unsure.
What belongs in an incident record?
At least the data affected, the chronology, the impact, the recovery steps and the time of notification. Those are the documentation elements named in the review of Regulation 33/2026.