Indonesia’s New Personal Data Protection Regulation: Key Changes Under GR 33/2026

On July 16, 2026, the Indonesian Government issued Government Regulation No. 33 of 2026 on the Implementation of Law No. 27 of 2022 regarding Personal Data Protection (“GR 33/2026”), providing detailed rules on how Indonesia’s Personal Data Protection Law will apply in practice.

GR 33/2026 introduces important developments across the personal data protection framework, including new requirements for data processing agreements, data subject rights, impact assessments and data protection officers, data retention, CCTV and other visual monitoring, personal data breach notifications, cross-border data transfers, and the handling of personal data in corporate transactions. It also establishes more detailed procedures for administrative sanctions and dispute resolution.