IndonesiaImplementing Regulation on Personal Data Protection, administrative sanctions
Government Regulation No. 33 of 2026, Article 184
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://static.banyumaskab.go.id/website/file/peraturan_pemerintah_no._33_tahun_2026_100926115902.pdfAn enforcement supervision rule binding public and private bodies.
- Audit expectation
- none
As of .
What it requires
- An app processing the personal data of an individual in Indonesia that breaches a listed provision of the Regulation risks an administrative sanction: a written warning, temporary suspension of processing, deletion or destruction of the data, and an administrative fine of up to 2% of annual revenue or receipts.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Logging duty
Article 184 of the Government Regulation lists the provisions whose breach draws an administrative sanction (written warning, temporary suspension of processing, deletion or destruction of data, administrative fine) and who imposes it. It creates no duty to keep a log or record; the record duty of Article 74, which the list includes, is not a provision this row cites.
- Kind
- None
- As of
What this law does
Article 184(1) subjects a breach of the provisions it lists, among them Article 165(1) to (3) on cross-border transfer, to administrative sanctions. The listed provisions also include Articles 114(1) and 115(1) on breach notification. Under Article 184(2) the sanctions are a written warning, temporary suspension of personal data processing, deletion or destruction of personal data, and an administrative fine, which may be combined.
Article 185(1) sets the administrative fine at up to 2% of the annual revenue or annual receipts of the controller or processor, applied to the violation variables. The variables are calculated on the basis of the negative impact, the duration, the type of data affected and the number of data subjects affected, among others (Article 185(2)). Article 185(3) allows the fine to be set as low as Rp0.00 or 0% for particular considerations.
Article 187 leaves the procedure for imposing administrative sanctions to a regulation of the institution (Peraturan Lembaga). Government Regulation No. 33 of 2026 was signed and promulgated in Jakarta on . Under Article 225 it takes effect after 6 months counted from the date of promulgation.
When LexLint raises it
When your app profile says your app crawls the web, trains models, generates content with AI, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings or processes biometric data.