IndonesiaImplementing Regulation on Personal Data Protection, cross-border transfer
Government Regulation No. 33 of 2026, Article 165
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://static.banyumaskab.go.id/website/file/peraturan_pemerintah_no._33_tahun_2026_100926115902.pdfA cross border transfer rule binding public and private bodies.
As of .
What it requires
- An app that transfers the personal data of an individual in Indonesia to a recipient outside Indonesia must ensure the recipient's country has an equal or higher level of personal data protection; failing that, ensure adequate and binding protection; and failing both, obtain the data subject's consent, after assessing the legal instrument relied on.
These lines are LexLint's reading of the law's text, as of .
What this law does
Article 165(1) requires a Personal Data Controller transferring personal data to a controller or processor outside Indonesia to ensure that the country where the recipient is located has a level of personal data protection equal to or higher than that of the Personal Data Protection Law. Where that is not met, the controller must ensure adequate and binding personal data protection (Article 165(2)).
Where neither is met, the controller must obtain the consent of the data subject (Article 165(3)). A transfer on the data subject's consent may be made only in the cases Article 173(2) lists, which include that the transfer is not repeated. The controller must assess the legal instrument it relies on before the transfer (Article 162(1)). Government Regulation No. 33 of 2026 was signed and promulgated in Jakarta on . Under Article 225 it takes effect after 6 months counted from the date of promulgation.
When LexLint raises it
When your app profile says your app processes biometric data, processes voice recordings, crawls the web or sends automated outreach.