IndonesiaImplementing Regulation on Personal Data Protection, breach notification
Government Regulation No. 33 of 2026, Article 114
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://static.banyumaskab.go.id/website/file/peraturan_pemerintah_no._33_tahun_2026_100926115902.pdfA breach notification rule binding public and private bodies.
As of .
What it requires
- An app that suffers a failure of personal data protection affecting an individual in Indonesia must give written notification within 3 x 24 hours (72 hours) to the affected individual and to the institution, stating the personal data disclosed, when and how it was disclosed, and the handling and recovery efforts, and must also give the data protection officer or contact person details.
These lines are LexLint's reading of the law's text, as of .
What this law does
Article 114(1) requires a Personal Data Controller, on a failure of personal data protection, to give written notification no later than 3 x 24 hours to the data subject and to the institution (Lembaga). The period runs from the moment the failure is known with certainty, properly and reasonably (Article 114(2)). The notification must at least state the personal data disclosed, when and how it was disclosed, and the controller's handling and recovery efforts (Article 114(3)).
It must also give the details of the data protection officer or the contact person the controller designates (Article 114(4)). The controller must also notify the public where the failure disrupts public services or seriously affects the public interest (Article 115(1)). The controller must draw up documentation of each failure (Article 116(1)). Government Regulation No. 33 of 2026 was signed and promulgated in Jakarta on . Under Article 225 it takes effect after 6 months counted from the date of promulgation.
When LexLint raises it
When your app profile says your app processes biometric data, processes voice recordings, crawls the web or sends automated outreach.