Indonesia's Personal Data Regulation Takes Effect 16 January 2027: A Small Business Minimum
Government Regulation 33/2026, which implements Indonesia's Personal Data Protection Law, takes effect on 16 January 2027. Here is an eight-week minimum for firms that collect data through web forms, chat and member cards.Government Regulation Number 33 of 2026, the implementing rule for Indonesia's Law 27 of 2022 on Personal Data Protection (known locally as UU PDP), takes effect on 16 January 2027. According to a review published by SIP Law Firm on 23 October 2026, the 225-article regulation was promulgated on 16 July 2026 and its Article 225 sets a six-month waiting period, which leaves about eight weeks for businesses that collect customer data to get organised.
This is not legal advice, and we read a law firm's review, not the regulation's text. The aim is narrower: to show the sensible minimum a small business can finish before that date.
What the regulation contains
The points below come from the SIP Law Firm review. A "PP" (Peraturan Pemerintah) is a government regulation that fills in the detail of a law.
- Record of processing activities. A data controller must maintain a record of processing activities, often called a ROPA. It covers, among other things, data sources, the basis and purpose of processing, data categories, third-party recipients, retention periods and security measures.
- Notice for indirectly collected data. Where data is not collected from the person directly, for example from a vendor, an affiliate or a public source, the data subject must be told no later than 30 working days after collection. The notice must be easy to reach and kept current.
- No exoneration clauses. Clauses that reduce or remove the controller's obligations are prohibited. A line such as "we accept no responsibility for any leak" in a privacy policy needs review.
- Administrative fines. Article 185 provides for administrative fines of up to 2% of annual revenue. The explanatory note defines revenue as gross economic inflow, not net profit.
- Transition. Article 223 says existing processing may continue as long as it does not conflict with the regulation.
Two points need to be kept in proportion. The 2% figure is a ceiling, not a tariff. And as of September 2026 the personal data protection agency had not been fully established, according to the same review. The review also cautions that waiting for the agency is no reason to delay preparation.
On small businesses: the source we read mentions neither an exemption nor relief. We do not know whether one exists and will not invent one.
Why a small firm should still move
Nearly every business holds personal data: a contact form on the website, WhatsApp conversations, member cards, a list of delivery addresses. What this Indonesia data protection regulation asks for is, at heart, tidiness: knowing what data you hold, why, who can open it, and until when. That tidiness pays off whoever ends up supervising, because it is also what you lean on when a customer asks a question or an incident happens.
An eight-week minimum
This section is our practical advice. It is arranged so that an owner and one administrator can do it without special tools.
Weeks 1 and 2: the data list
Create one spreadsheet with one row per place where data is collected. This is the seed of your record of processing activities.
| Column | Example |
|---|---|
| Collection point | Website contact form |
| Data taken | Name, WhatsApp number, email |
| Purpose | Answering enquiries and sending quotes |
| Basis | Consent given when submitting the form |
| Stored where | Email inbox, leads spreadsheet |
| Who can open it | Owner, one administrator |
| Shared with | Courier (name, address, phone) |
| Kept for | 12 months after last contact |
Repeat for chat, member cards, the till, marketplaces and the books. Any column you cannot fill in is your first finding.
Weeks 3 and 4: an honest privacy notice
Rewrite your privacy page from that sheet, not from a template. The test is simple: every sentence must be true of your business.
- Say what data you collect and for what purpose.
- Name the other parties who receive it, such as couriers or payment providers.
- Say how long you keep it and how a customer can contact you about their data.
- Remove any sentence that waives your responsibility entirely.
- Link the notice next to every form, and add one short line to your chat greeting.
If you buy or receive contact lists from others, record the source. The 30-working-day notice rule described above applies to data of that kind.
Weeks 5 and 6: access
- Remove former staff from every location on the data list.
- Change shared passwords, then turn on two-step verification for email, marketplaces and ad accounts.
- Name one person who answers customer questions about data, and a stand-in for days off.
Weeks 7 and 8: retention and a dry run
- Set a retention period per type of data, then delete what has passed it: old leads who never bought, contact exports in download folders, backups on old phones.
- Review the contracts or terms of vendors who hold your customer data. Ask where it is stored and what they do when an incident occurs.
- Run a small drill: ask a friend to play a customer who wants to know what data you hold about them. Time how long your team takes to answer.
One caveat on retention: our source does not address how retention periods interact with duties to keep documents for tax or bookkeeping. Do not delete transaction records before confirming with a consultant.
What you do not need to do
There is no need to rush into buying compliance software or to copy a large company's privacy policy. A long notice that does not match reality is worse than one true page. Start with the data list, because the other three jobs rest on it.
If your customer conversations are spread over several phones, moving them into a shared WhatsApp inbox with notes per customer makes "where is my data" far easier to answer. Polynusa offers that, see the pricing page.
Note: this is a summary for general readers. Confirm your business's obligations with a legal consultant or the data protection authority.
Sources
- SIP Law Firm, 23 October 2026: PP 33/2026 Pelindungan Data Pribadi
FAQ
When does Indonesia's Government Regulation 33/2026 take effect?
According to a review by SIP Law Firm, the regulation was promulgated on 16 July 2026 and its Article 225 sets the effective date six months later, on 16 January 2027.
Are small businesses exempt from the regulation?
The source we read mentions no exemption or relief for small businesses, so we cannot say whether one exists. Ask a legal consultant about your own case.
What is a record of processing activities?
A list of every way your business handles personal data, covering among other things the data source, the basis and purpose of processing, data categories, third-party recipients, retention periods and security measures.