Summary of Government Regulation Number 33 of 2026 on Regulation for Implementing Law Number 27 of 2022 on Personal Data Protection

The grounds for Personal Data processing as referred to in paragraph (1) include:

1. explicitly valid consent from the Personal Data Subject for 1 (one) or several specific purposes that have been communicated by the Personal Data Controller to the Personal Data Subject;

2. fulfilment of contractual obligations where the Personal Data Subject is a party, or to fulfil a request of the Personal Data Subject prior to entering into an agreement;

4. fulfilment of the protection of the vital interests of the Personal Data Subject;

5. fulfilment of other legitimate interests, having regard to the purpose, the necessity, and the balance between the interests of the Personal Data Controller and the rights of the Personal Data Subject.

Violations may be subject to administrative sanctions as set out in Article 184 paragraph (1) of GR 33/2026.

In the processing of Personal Data based on the explicitly valid consent of the Personal Data Subject as referred to in Article 30 paragraph (3) letter a, the Personal Data Controller is obliged to provide Information in accordance with the provisions of this Government Regulation.

Violations may be subject to administrative sanctions as set out in Article 184 paragraph (1) of GR 33/2026.

A Child, or the parent and/or guardian of a Child, may submit a request for the fulfilment of the Child’s rights as a Personal Data Subject to the Personal Data Controller in accordance with the provisions of laws and regulations.

Violations may be subject to administrative sanctions as set out in Article 184 paragraph (1) of GR 33/2026.

Article 39

paragraph (4)

The processing of Personal Data of Persons with Disabilities as referred to in paragraph (1) must obtain the consent of the Person with a Disability and/or the guardian of the Person with a Disability in accordance with the provisions of laws and regulations.

Violations may be subject to administrative sanctions as set out in Article 184 paragraph (1) of GR 33/2026.

Transparency as referred to in Article 58 is carried out by:

1. ensuring that the Personal Data Subject is aware of the Personal Data being processed;

2. ensuring that the Personal Data Subject is aware of how the Personal Data is processed; and

3. delivering Information and communications relating to the processing of Personal Data that are easily accessible, understandable, and written in clear language.

In documenting as referred to in paragraph (1), the Personal Data Controller must explicitly state the purpose of Personal Data processing in:

1. the internal policy of the Personal Data Controller; and

2. a Personal Data Protection notice that is easily accessible to the Personal Data Subject.

The Personal Data Controller grants access to the Personal Data Subject after verifying the access request as referred to in paragraph (1).

Violations may be subject to administrative sanctions as set out in Article 184 paragraph (1) of GR 33/2026.

A Personal Data Subject is entitled to terminate the processing of, delete, and/or destroy Personal Data concerning themselves in accordance with the provisions of

laws and regulations.

The Personal Data Controller is obliged to delete Personal Data where:

3. there is a request from the Personal Data Subject.

Violations may be subject to administrative sanctions as set out in Article 184 paragraph (1) of GR 33/2026.

The Personal Data Controller is obliged to destroy Personal Data where:

2. there is a request from the Personal Data Subject.

Violations may be subject to administrative sanctions as set out in Article 184 paragraph (1) of GR 33/2026.

The Personal Data Controller is obliged to notify the Personal Data Subject of the deletion and/or destruction of Personal Data.

Violations may be subject to administrative sanctions as set out in Article 184 paragraph (1) of GR 33/2026.

A Personal Data Subject is entitled to obtain and/or use Personal Data concerning themselves from the Personal Data Controller in a form that conforms to a structure and/or format commonly

used or readable by electronic systems.

In the event of a Personal Data Protection Failure, the Personal Data Controller is obliged to deliver written notification no later than 3 x 24 (three times twenty-four) hours to:

1. the Personal Data Subject; and

2. the Agency.

Violations may be subject to administrative sanctions as set out in Article 184 paragraph (1) of GR 33/2026.

The Personal Data Controller is obliged to notify the public of a Personal Data Protection Failure where:

1. the Personal Data Protection Failure disrupts public services; and/or

2. the Personal Data Protection Failure has a serious impact on the public interest.

Violations may be subject to administrative sanctions as set out in Article 184 paragraph (1) of GR 33/2026.

Article 133 paragraph (1).

Other relevant provisions in GR 33/2026: Article 134, Article 136.

A Personal Data Controller in the form of a legal entity that carries out a merger, spin-off, acquisition, consolidation, or dissolution of the legal entity is obliged to deliver a notification of the transfer of Personal Data to the Personal Data Subject.

This is made in an agreement between the former Personal Data Controller and the new Personal Data Controller.

In the event of dissolution, the Personal Data Controller must notify the Personal Data Subject that the Personal Data Controller has been dissolved, of the party with which it will cooperate, and of the contact person or PPDP assigned.

Violations may be subject to administrative sanctions as set out in Article 184 paragraph (1) of GR 33/2026.

The exercise of the rights of the Personal Data Subject is carried out by sending a request for the exercise of rights, as regulated in the provisions of laws and regulations, to:

1. the former Personal Data Controller, after the former Personal Data Controller sends a notification that a merger, spin-off, acquisition, consolidation, or dissolution of the legal entity will take place, until such merger, spin-off, acquisition, consolidation, or dissolution of the legal entity takes effect; and

2. the new Personal Data Controller, after the new Personal Data Controller sends a notification that a merger, spin-off, acquisition, consolidation, or dissolution of the legal entity has taken place.

1. In transferring Personal Data as referred to in Article 160, the Personal Data Controller is obliged to ensure that the country in which the Personal Data Controller and/or Personal Data Processor receiving the transfer of Personal Data is domiciled has a level of Personal Data Protection that is equivalent to or higher than that regulated in the law on Personal Data Protection.

2. Where the provisions referred to in paragraph (1) are not fulfilled, the Personal Data Controller is obliged to ensure that adequate and binding Personal Data Protection exists.

3. Where the provisions referred to in paragraph (1) and paragraph (2) are not fulfilled, the Personal Data Controller is obliged to obtain the consent of the Personal Data Subject.

This concerns the transfer of Personal Data to other countries, such that these provisions are intended to ensure an adequate process for the transfer of Personal Data.

Violations may be subject to administrative sanctions as set out in Article 184 paragraph (1) of GR 33/2026.

1. The Agency is authorised to publish the results of the supervision of Personal Data Protection in accordance with the provisions of laws and regulations.

2. Publication is carried out through open announcements that are accessible to the public.

1. The Personal Data Controller must provide a channel for requests for the exercise of the rights of Personal Data Subjects, whether electronic and/or non-electronic, that is easily accessible to the Personal Data Subject.

2. Where the Personal Data Controller processes Personal Data electronically, the request for the exercise of the rights of the Personal Data Subject is submitted electronically.

A request for the exercise of the rights of a Personal Data Subject as referred to in Article 20 may be submitted by:

1. the Personal Data Subject;

2. the parent and/or guardian of the Child;

3. the guardian of a Person with a Disability; or

4. an authorised representative of the Personal Data Subject, in accordance with the provisions of laws and regulations.

1. A recorded request as referred to in Article 20 must contain:

1. the identity of the party submitting the request;

2. an explanation of the rights of the Personal Data Subject and the interest of the Personal Data Subject in submitting the request; and

3. a description of the Personal Data Subject’s request regarding the Personal Data processed by the Personal Data Controller.

2. The identity referred to in paragraph (1) letter a is completed by attaching proof of identity.

This relates to the request for the exercise of rights by the Personal Data Subject to the Personal Data Controller.

The processing of Personal Data in fulfilling a request of the Personal Data Subject as referred to in Article 40 paragraph (1) letter b is carried out on the following conditions:

1. there is a written or recorded request from the Personal Data Subject to the Personal Data Controller;

2. the Personal Data Controller and the Personal Data Subject will enter into an agreement that requires the processing of Personal Data; and

3. the agreement to be agreed upon by the Personal Data Subject and the Personal Data Controller is used as the basis for exercising the rights and obligations of the Personal Data Subject and the Personal Data Controller.

The Personal Data Controller may rely on the fulfilment of the protection of the vital interests of the Personal Data Subject as the basis for Personal Data processing where:

1. there is a threat to the life, physical safety, and/or property/assets of the Personal Data Subject or another party; and

2. it is difficult to obtain the consent of the Personal Data Subject as referred to in letter a.

Article 49

paragraph (1)

The Personal Data Controller may use as the basis

for Personal Data processing the performance of duties

in the context of:

1. the public interest;

2. public services; or

3. the exercise of authority based on laws and regulations.

The Personal Data Controller is obliged to refuse to grant the Personal Data Subject access to changes in Personal Data where:

1. it endangers the security, physical health, or mental health of the Personal Data Subject and/or another person;

2. it results in the disclosure of the Personal Data of another person; and/or

3. it is contrary to national defence and security interests.

The Personal Data Controller may reject an objection where:

1. there are no legal consequences and/or significant impact on the Personal Data Subject; and

2. the Personal Data Controller has a highly accurate system and mitigation systems to avoid any impact on the Personal Data Subject.

The postponement and restriction of Personal Data processing as referred to in paragraph (1) are excluded where:

1. there are provisions of laws and regulations that do not allow the postponement and restriction of Personal Data processing;

2. it may endanger the safety of other parties; and/or

3. the Personal Data Subject is bound by a written agreement with the Personal Data Controller that does not allow the postponement and restriction of Personal Data processing.

The rights of the Personal Data Subject as referred to in Article 79 paragraph (1), Article 90 paragraph (1), Article 93, Article 97, and Article 111 paragraphs (1) and (2) are excluded for:

1. national defence and security interests;

2. law enforcement process interests;

3. public interest in the administration of the state;

4. supervisory interests over the financial services sector, monetary affairs, the payment system, and financial system stability carried out in the administration of the state; or

5. statistical and scientific research interests.

1. The public may play a role, whether directly or indirectly, in supporting the implementation of Personal Data Protection.

2. The performance of the role referred to in paragraph (1) may be carried out through education, training, advocacy, outreach, and/or supervision in accordance with the provisions of laws and regulations.

3. Further provisions on the performance of the role of the public as referred to in paragraph (2) are regulated in an Agency Regulation.

The administrative sanctions referred to in paragraph (1) are in the form of:

1. written warning;

2. temporary suspension of Personal Data processing activities;

3. deletion or destruction of Personal Data; and/or

4. administrative fine.

Administrative sanctions may be imposed by the Agency in coordination with the relevant ministries or institutions. Administrative sanctions may be imposed concurrently and directly without a written warning, taking into account:

• the level or impact of the violation;

• the continuity of business activities or public services;

• compliance or compliance history with the provisions of the PDP Law/GR 33/2026;

• the basis of consideration and clear reasons;

• other considerations applied by the Agency.

1. Administrative sanctions in the form of an administrative fine as referred to in Article 184 paragraph (2) letter d are imposed at a maximum of 2% (two percent) of the annual revenue or annual receipts of the Personal Data Controller and/or Personal Data Processor, in relation to the violation variables.

These variables are regulated in paragraph (2) and are calculated based on the negative impact arising from the violation, the duration of the violation, the type of data affected, the amount of data affected, the process by which the violation was discovered, the level of cooperation of the Personal Data Controller and Personal Data Processor in the examination process, the business scale of the Personal Data Controller and/or Personal Data Processor, the ability of the Personal Data Controller and/or Personal Data Processor to pay, the compliance of the Personal Data Controller and/or Personal Data Processor, and other variables determined by the Agency.

Where the Decision of the Agency has obtained permanent legal force, payment becomes an obligation of the sanctioned party and is deposited into the state treasury as Non-Tax State Revenue (PNBP).

1. The Agency issues a decision imposing administrative sanctions based on the results of the examination and investigation of alleged Personal Data Protection violations no later than 30 (thirty) days from the completion of the examination and investigation.

4. The decision imposing administrative sanctions as referred to in paragraph (1) is delivered to the Personal Data Controller and/or Personal Data Processor.

5. A Personal Data Controller and/or Personal Data Processor subject to administrative sanctions must implement the decision no later than 30 (thirty) days from the date of announcement.

The decision imposing administrative sanctions is made no later than 30 (thirty) days after the examination is completed. The announcement is made in coordination with the relevant ministries or institutions through the Agency’s official media.

The Decision is implemented no later than 30 (thirty) days from the date of announcement, although an extension of the implementation period may be requested from the Agency.

The decision imposing administrative sanctions contains the name of the sanctioned party, the type of violation, the provision violated, the type of administrative sanction, the obligations to be performed by the relevant party, and the period for fulfilling such obligations.

1. A Personal Data Controller and/or Personal Data Processor subject to administrative sanctions may submit a written objection to the head of the Agency no later than 14 (fourteen) days from receipt of notification of the decision.

Based on the submission of the objection, the Agency issues a decision on the objection no later than 14 (fourteen) days from receipt of the objection, either accepting the objection in part or in whole, or rejecting the objection with reasons for the rejection, which must be communicated no later than 7 (seven) days from the issuance of the Decision.

If the objection is rejected without clear reasons, the Personal Data Controller and/or Personal Data Processor may file a lawsuit with the State Administrative Court (PTUN).