Indonesia's PDP Law and AI: What Your Business Should Prepare Now

Your team has gathered material for this month's AI trial: WhatsApp chat exports with customer names, numbers and addresses, order files from the Shopee and Tokopedia dashboards, and a receivables spreadsheet. The plan is simple. AI reads it all and flags the customers worth a promotion.

The moment AI reads customer data, your business is processing personal data under Indonesia's PDP Law (Law No. 27 of 2022 on Personal Data Protection, or UU PDP). Before switching the tool on, work in this order: map the data and its purposes, set a legal basis, bind the vendor by contract, check whether you need an impact assessment or a data protection officer, then plan deletion and breach notification. The core duties already apply; the implementing Government Regulation, PP 33/2026, adds detail when it takes effect on 16 January 2027 (Source: Katadata, 2026).

What's new, and who is enforcing it?

PP 33/2026, which implements the PDP Law, was signed by the President on 16 July 2026, and the detail it adds applies from 16 January 2027 (Source: Katadata, 2026). That date is not a new deadline for duties the law already imposes: its two-year transition after enactment on 17 October 2022 has ended (Source: JDIH Kemkomdigi, 2022).

No dedicated supervisory body exists yet either: as of late July 2026, the presidential regulation creating the PDP Agency was still pending, leaving oversight with Komdigi (the Ministry of Communication and Digital Affairs), through its Directorate General of Digital Space Supervision (Source: Kompas.com, 2026). From October 2024 to November 2025, Komdigi recorded 56 suspected violations, most reported by electronic system operators themselves (Source: CNN Indonesia, 2025).

First steps: data, purposes and your AI vendor

Start by listing everything the AI will read, even sources nobody calls a system: WhatsApp groups and staff phones, marketplace order exports, spreadsheets, CRM exports and HR files, with their columns. Article 4 classifies health, children's and personal financial data, among others, as specific personal data, while Article 31 requires controllers to record every processing activity (Source: JDIH Kemkomdigi, 2022). Payslips and clinic patient records qualify.

For each use, state the purpose and pick the right legal basis. Order-status replies can rest on the sales contract, but flagging promotion targets is a different purpose, better served by consent or a legitimate interest weighed against customers' rights. Article 20 provides six bases for processing, and Article 22 calls for consent to be recorded, separated by purpose and written in plain language (Source: JDIH Kemkomdigi, 2022).

Your AI vendor is a data processor. Article 51 lets processors act only on the controller's instructions (Source: JDIH Kemkomdigi, 2022). According to Veritask, the new regulation asks that the vendor contract cover scope, data types and purposes, categories of data subjects, duration, rights and obligations, and an audit mechanism, with sub-processors engaged only on written approval (Source: Veritask, 2026). Before signing, pin down the following.

• The country where your data is stored and processed.
• Whether your data trains their models, when a processor should work only for purposes you set.
• Which sub-processors they use.
• When and how they will notify you of an incident.

With servers outside Indonesia, Article 56 sets a sequence: the destination country must offer equal or stronger protection; failing that, adequate and binding safeguards must be in place; only if neither is available should the data subject's consent be used (Source: JDIH Kemkomdigi, 2022). The implementing regulation adds a risk mapping and assessment before any transfer (Source: Veritask, 2026).

When does Indonesia's PDP Law require an impact assessment or a data protection officer?

Before the tool goes live, test your plan against Article 34, which requires a data protection impact assessment (DPIA) for potentially high-risk processing and lists seven conditions, among them automated decisions with significant effects, specific personal data, large-scale processing, systematic evaluation or monitoring, combining datasets and new technology (Source: JDIH Kemkomdigi, 2022).

That promotion scenario could hit several conditions at once: merging WhatsApp chats with marketplace exports is combining datasets, and flagging customers resembles systematic evaluation. The DPIA doesn't have to be long. Describe the processing and purpose, check it is necessary and proportionate, assess risks to customers' rights, then set safeguards.

Where AI helps decide something consequential, such as approving instalments or blocking an account, Article 10 gives people the right to object to fully automated decisions, so make sure someone on staff can overturn them (Source: JDIH Kemkomdigi, 2022).

Check, too, whether you need a data protection officer. Article 53 names three situations: processing for public services; core activities requiring regular, systematic, large-scale monitoring of personal data; and core activities consisting of large-scale processing of specific personal data or criminal-offence data (Source: JDIH Kemkomdigi, 2022). Constitutional Court Decision No. 151/PUU-XXII/2024, delivered on 30 July 2025, held that the word "and" between the last two criteria must be read as "and/or", so one criterion is enough (Source: pasal.id, 2025).

What counts as "large scale" for your business remains open to interpretation, as does whether the role can be combined with another job or outsourced. Bring in your legal counsel at this point, because a dedicated officer means a new fixed cost.

Deletion schedules and a breach-notification drill

Decide how long each dataset is kept, and tell customers that period. Article 43 requires deletion when data is no longer needed for its purpose, consent is withdrawn, the data subject asks, or the data was obtained unlawfully (Source: JDIH Kemkomdigi, 2022). Deletion should also cover copies inside your AI tools: uploaded files, knowledge bases and chat histories.

Finally, rehearse the worst case. If data protection fails, Article 46 requires written notice to data subjects and the supervisory authority within 72 hours (3 × 24 hours in the law's wording), stating the data exposed, when and how it happened, and the recovery efforts (Source: JDIH Kemkomdigi, 2022). Choose now who assesses an incident and who drafts the notice. According to Robere & Associates, the implementing regulation also asks processors to alert the controller at the first opportunity, so write that into your vendor contract (Source: Robere & Associates, 2026).

Every step should leave evidence, because Article 47 requires controllers to prove their accountability (Source: JDIH Kemkomdigi, 2022). In Finance AI Automation, one design decision follows the same principle: when a bill is booked, its source document goes into the accounting platform with it, and every reimbursement claim has one trail from receipt photo to general ledger entry. Built by Agentiq for an anonymised client; all screens shown use fictional sample data.

What this means for your business

For an established business, data protection issues will most likely surface through a customer complaint or a reportable incident, not a surprise inspection. The sanctions are still worth knowing: Article 57 provides for written warnings, temporary suspension of processing, data deletion and administrative fines (Source: JDIH Kemkomdigi, 2022). According to Veritask, PP 33/2026 sets fines by weighing factors such as impact, duration, number of people affected, business size and cooperation (Source: Veritask, 2026).

• List the AI's data sources, including WhatsApp groups and staff phones.
• Record the purpose and legal basis for each use.
• Ask your AI vendor about data location, model training, sub-processors and incident notification.
• Check your automation plans against the high-risk triggers for a DPIA.
• Keep the data inventory, vendor agreements, DPIA and drill records in one shared folder with a named owner.

If you'd like to see this preparation sequence applied to your own data and AI tools, walk us through your process on our contact page. The Agentiq team will reply with concrete recommendations, not a template.