The Jakarta Post
Please Update your browser
Your browser is out of date, and may not be compatible with our website. A list of the most popular web browsers can be found below.
Just click on the icons to get to the download page.
Popular Reads
Top Results
No results found. Please check your search term and try again
Can't find what you're looking for?
View all search results
Popular Reads
Top Results
No results found. Please check your search term and try again
Can't find what you're looking for?
View all search resultsNew data rules could unlock cross-border data flows
Government Regulation 33/2026 brings businesses long-sought clarity on data protection, with enforcement awaiting a presidential approval of the data protection authority.
Change text size
Gift Premium Articles
to Anyone
Share the best of The Jakarta Post with friends, family, or colleagues. As a subscriber, you can gift 3 to 5 articles each month that anyone can read—no subscription needed!
Set as preferred source
A man types on a laptop keyboard in this undated illustration photo of data theft. Cases of stolen personal or public data being sold on online forums, have continued to rise worldwide. (Unsplash/Towfiqu Barbhuiya)
I
ndonesia has published long-delayed implementing rules for its 2022 Personal Data Protection (PDP) Law, spelling out for the first time how companies may legally transfer personal data abroad, even as the authority to enforce those rules remains to be created four years after the landmark law took effect.
Government Regulation No. 33/2026, signed on July 16 but only circulated publicly in late August, sets out detailed obligations for any business that collects or processes personal data, to consent requirements and how consumers can seek redress.
It also sets out a detailed regime for cross-border data transfers, recognizing adequacy decisions and binding corporate rules as legal pathways for moving Indonesian personal data overseas.
Read also: Data protection at stake in the Indonesia-US trade agreement
For companies that have spent years navigating a legal gray zone, the new regulation offers a clearer framework for complying with personal data protection law after years of uncertainty.
“This gives clarity; now we know what we need to do,” said Danny Kobrata, partner at K&K Associates, describing years of “wait and see” caution among businesses.
“Now there’s no more excuse for companies not to comply, because the rules are already clear,” he told The Jakarta Post on Tuesday, adding that the lack of implementing rules had hindered business compliance.
