Indonesia GR 33/2026: The Five Pre-Effect Compliance Priorities (Norton Rose Fulbright Read-Out, September 2026)

Indonesia GR 33/2026: The Five Pre-Effect Compliance Priorities (Norton Rose Fulbright Read-Out, September 2026)

Indonesia's first PDP Law implementing regulation, Government Regulation No. 33 of 2026 (GR 33/2026), takes effect January 16, 2027, and Norton Rose Fulbright's late-September 2026 read-out distills what boards should verify before then. The regulation "translates many of the obligations under Indonesia's Personal Data Protection Law into detailed operational requirements" — and the warning tone is that "group policies alone are unlikely to be sufficient without clear accountability, documented decisions and evidence of implementation."

The five issues NRF flags:

1. Data breaches — controllers must notify the authority and affected data subjects within 72 hours "from the time at which the personal data protection failure is definitively, duly, and reasonably established" — a trigger that requires rapid fact-finding and legal assessment, not merely detection.
2. Cross-border transfers — transfers to overseas group companies, cloud providers, shared-service centres and vendors must be supported by an appropriate transfer mechanism and documentation:

   "Existing global or GDPR-based arrangements should not be assumed to satisfy Indonesian requirements. Consultation with the Data Protection Authority may be required prior to any cross-border transfer of personal data.¹" — Norton Rose Fulbright

3. High-risk processing — a DPIA must be completed before qualifying processing, which may include "AI-enabled decision-making, biometrics, employee monitoring, profiling and large-scale processing of specific personal data."
4. Governance and third parties — processing records, lawful bases, data subject rights, retention, security and written controller-processor arrangements; certain organisations must establish a DPO function "with appropriate expertise, resources, independence and access to senior management."
5. Enforcement and transactions — sanctions may include suspension of processing, deletion or destruction of personal data, and administrative fines of up to 2% of annual revenue or receipts; personal data requirements also touch M&A, restructurings and post-completion integration.

NRF also stresses the sectoral layer: GR 33/2026 "operates alongside sector-specific requirements" from OJK (financial services), Bank Indonesia (payments) and Komdigi (electronic systems, telecommunications), and further guidance is expected "including on cross-border transfer mechanisms and other technical requirements."

What it means for compliance teams: the 2%-of-revenue fine cap is modest by APAC standards, but the operative risks are (a) the 72-hour clock's unusual "definitively established" trigger, and (b) transfer-mechanism documentation — GDPR-era intra-group SCCs cannot be assumed to carry Indonesian transfers. The "consultation with the Data Protection Authority" possibility remains a placeholder while the dedicated DPA is still unformed, which adds uncertainty to the pre-January 16, 2027 runway; Kominfo/Komdigi transition guidance is the thing to watch (watch already registered for the January 16, 2027 take-effect date).