When will Indonesia's personal data protection authority be formed? On 28 October 2026, the Ministry of Communication and Digital Affairs (Komdigi) said the harmonisation of the rules needed to create it is complete, and that the body now awaits a decision by the President. No date was given. The authority matters because Law No. 27 of 2022 on Personal Data Protection, the PDP Law, and its implementing regulation, PP 33/2026, leave much of their day-to-day enforcement to it. PP 33/2026 takes effect on 16 January 2027, whether or not the authority exists by then.
What Komdigi said on 28 October
Bisnis.com reported the statement from a talk show in Jakarta on cross-border data flows between Indonesia and Germany under the Indonesia-EU trade agreement, IEU-CEPA. Arif Wahyudi, a policy analyst in Komdigi's directorate for digital space strategy and supervision policy, said harmonisation was finished and the government was waiting for the President's decision. He said several technical rules under the PDP Law must be set by the authority itself, which makes its existence crucial.
He said Komdigi is preparing policy recommendations and technical rules for the new body, working with stakeholders including the Indonesian Data Protection Practitioners Association (APPDI), so that less time is needed later to debate substance. He also said some matters in setting up the authority lie outside Komdigi's technical remit, and he hoped industry would push for it to become operational sooner.
Why the authority matters
According to a client alert published by RSM Indonesia on 18 September 2026, PP 33/2026 was promulgated on 16 July 2026 and takes effect six months later under its Article 225. The regulation gives the authority a central role. Controllers must notify affected individuals and the authority of a personal data breach within three times 24 hours. The authority can issue written warnings, suspend processing, order data to be deleted and impose administrative fines of up to 2% of annual revenue or receipts. It is also to issue further rules on which destination countries offer equivalent protection and on standard contractual clauses for transfers abroad.
Cross-border transfers are where the gap is felt most. At the 28 October event, Arif Wahyudi said the transfer rules are not a simple choice between allowed and not allowed, but involve levels of protection: recognition that a destination country is adequate, and organisation-level safeguards such as contractual clauses, binding corporate rules and certification. He said elements of contractual clauses already exist but their implementation standards still have to be set by the authority. Bisnis.com also reported a 2026 study by the Center for Indonesian Policy Studies (CIPS) which found that many Indonesian companies accept European standard contract clauses unchanged, for lack of capacity and of suitable domestic instruments.
A long road, and mixed signals
The authority has been expected for some time. In July 2026, detikInet reported Deputy Minister of Communication and Digital Affairs Nezar Patria as saying its formation was in the final stage, that it would work independently and sit outside Komdigi's structure, and that its reports would go to the President through Komdigi. At that point the presidential regulation was expected to be finished in about two months.
In September, CNBC Indonesia reported Wahyudi Djafar, executive director of Catalyst Policy-Works, as saying the request to begin drafting the regulation was submitted in 2024 and stalled during that year's political transition. He estimated that even if the regulation were issued in 2026, the authority would need one to two more years to set up its structure, staff, budget and procedures. Speaking to Bisnis.com on 8 September, he gave 2028 as the earliest date it could be effective.
The reporting is not fully consistent. The 8 September Bisnis.com article said the presidential regulation had reportedly been signed, while Komdigi's statement of 28 October says the decision is still awaited. We have relied on the more recent official statement, but readers should treat the exact status as unconfirmed until the regulation is published.
What happens in the meantime
The PDP Law is not dormant without the authority. CNBC Indonesia noted that its criminal provisions can already be enforced through the police, prosecutors and courts, and that Komdigi still supervises electronic system operators under PP 71/2019. But Wahyudi Djafar argued that administrative compliance rests with the authority, so much of it is in practice voluntary until the body exists. RSM Indonesia points to Article 223 of PP 33/2026, which lets processing continue pending the authority's further rules as long as it does not conflict with the regulation, and warns that this is not a reason to delay preparation. It also cautions that approved destination countries and standard contractual clauses should not be assumed to exist yet.
What organisations can prepare
This section is our analysis, not legal advice. The obligations in PP 33/2026 do not wait for the authority, and the authority's first rules are likely to land on organisations that already know their own data.
- Keep an up-to-date record of what personal data you process, where it is stored and which systems and vendors touch it, including flows to other countries.
- List every cross-border transfer and the basis you rely on today, so you can adjust quickly when the authority publishes its rules on adequate destinations and contractual clauses.
- Test whether your incident process can identify affected individuals and produce a notification within three days, since that duty applies from 16 January 2027.
- Make sure you can produce evidence of what you have done, from consent records to impact assessments, because a new supervisor will start by asking for it.
What to watch next
Watch for the presidential regulation itself: its number, the authority's name, how its leaders are appointed and how it is funded. CIPS has called for an independent authority with a clear mandate, powers to issue technical guidance and a complaints process, and for implementing rules drafted with businesses and civil society. Watch for the authority's first regulations on transfers, which matter for trade with partners such as Germany, where CIPS put digitally deliverable services trade with Indonesia at US$669 million in 2024. And watch whether Komdigi issues interim guidance on supervision if the authority is not ready by 16 January 2027.
Sources
- Lembaga PDP Sudah Harmonisasi, Tinggal Tunggu Restu Prabowo · Bisnis.com(opens in a new tab)
- 'Wasit' Perlindungan Data Pribadi Segera Dibentuk Secara Independen · detikInet(opens in a new tab)
- Lembaga Perlindungan Data Belum Ada di RI, Padahal Aturannya Sudah Ada · CNBC Indonesia(opens in a new tab)
- UU dan PP Sudah Ada, Pengamat: Aturan PDP Belum Efektif Tanpa Lembaga · Bisnis.com(opens in a new tab)
- PP 33/2026: Six Implementation Priorities before 16 January 2027 · RSM Indonesia(opens in a new tab)
This briefing was prepared by the Indotek editorial desk with AI assistance, from the public sources listed above. It is general information, not legal or professional advice.
Cloud & Data
How Indotek can help
Whatever form the authority takes, its first questions will be about where personal data lives, where it travels and who can reach it. Building systems that answer those questions is the kind of work Indotek does.
- Data platforms: we build lakehouse and warehouse platforms with governed ingestion, lineage and clearly owned data products, so you can show where personal data comes from and where it goes.
- Security and residency by design: we let access, encryption and data-location requirements shape the architecture from the start, so cross-border flows are deliberate and documented rather than discovered.
- Cloud architecture: we design landing zones, network and identity so that each workload's location, and who can access it, is explicit and secure by default.
- Platform engineering: we put infrastructure as code and observability in place, so changes to systems that hold personal data are recorded and incidents can be traced quickly.
