Indonesia's PDP Law vs GDPR: What's Actually In Force (2026)

Indonesia's Undang-Undang Pelindungan Data Pribadi (UU PDP, Law No. 27 of 2022) is often described as "not yet in force" or "still years away." That description is wrong, and getting it wrong matters. The two-year transition period built into the Law ended on October 17, 2024. Every substantive obligation in UU PDP, the lawful-basis requirement, the rights catalog, the 72-hour breach-notice duty, the cross-border transfer rules, and both the administrative and criminal penalty provisions, is binding law today, not a future date on a roadmap.

What is missing is not the law itself but the machinery meant to run it. Indonesia has not yet established the independent supervisory authority (Badan Pelindungan Data Pribadi, or Badan PDP) that the Law itself requires, and has not yet issued the implementing government regulation (Peraturan Pemerintah, or PP) that several of the Law's own provisions explicitly defer to. This article works through what that gap actually means, article by article, against the EU's General Data Protection Regulation (GDPR), and closes with the one enforcement path that is not blocked by the missing institution: Indonesia's criminal provisions.

Jurisdiction scope: This article compares the EU's General Data Protection Regulation (GDPR) with Indonesia's Law No. 27 of 2022 on Personal Data Protection (UU PDP), as enacted and currently in force, including its still-pending implementing regulation and supervisory authority. It does not cover Indonesia's separate cybersecurity, electronic-information (ITE), or sector-specific financial-data rules except where they intersect directly with UU PDP. For the full Indonesia privacy picture, see our Indonesia data privacy laws guide.

What Is In Force, and What Is Not

This is the section to read first, because the rest of the comparison only makes sense once this distinction is clear. UU PDP is not a law waiting to take effect. It is a fully enforceable statute with an unbuilt enforcement apparatus sitting on top of it.

What is fully in force today:

• The legal-basis requirement (Pasal 20)
• The data subject rights catalog (Pasal 5-15)
• The sensitive/general data classification (Pasal 4)
• The 72-hour breach notification duty (Pasal 46)
• The cross-border transfer cascade (Pasal 56), at least its contractual-safeguard and consent steps
• The administrative sanction exposure (Pasal 57)
• The criminal provisions (Pasal 67-70) and corporate liability (Pasal 70)

What has not been established:

• Badan PDP, the independent supervisory authority. Pasal 58 requires that the institution ("lembaga") administering the Law be established by the President and be responsible to the President, with further detail set out in a Peraturan Presiden (Perpres). That Perpres has not been issued. The President granted izin prakarsa (initiative approval) to begin drafting it on March 4, 2025; the draft moved through inter-ministerial review from March to September 2025 and has been in Ministry of Law harmonization since October 2025. Komdigi restated a 2026 completion target as of February 4, 2026.
• The implementing Peraturan Pemerintah (PP). UU PDP defers critical operational detail to this regulation at multiple specific points: the final clause of Pasal 56 assigns cross-border transfer procedure to it, and Pasal 57(5) assigns administrative-sanction procedure to it. Neither has been issued. A draft (RPP) reportedly finished its own harmonization process, worked through roughly 1,989 public comments, and was reported sitting at the State Secretariat awaiting presidential signature as of reporting from October 2025. As of this review (July 2026), there is no primary confirmation it has since been signed.
• An adequacy list. Because there is no PP and no Badan PDP, there is no published determination of which countries meet Pasal 56(2)'s "equivalent or higher protection" standard.
• A confirmed Pasal 57 administrative sanction. The sanctioning body Pasal 57(4) assigns this power to is the same not-yet-established institution from Pasal 58; no sanction has been confirmed as issued.

In the interim, Komdigi, the ministry that absorbed PDP oversight when it was restructured from Kominfo in November 2024, handles oversight and complaint intake ad interim, but it is not the independent authority the Law itself calls for.

The precise way to describe this: Indonesia has a GDPR-shaped statute that is fully enforceable text sitting on top of missing enforcement infrastructure. It is not a law that has yet to take effect.

Background and Legislative Context

UU PDP, formally Undang-Undang No. 27 Tahun 2022 tentang Pelindungan Data Pribadi, was enacted and promulgated on October 17, 2022, after years of legislative drafting. It built in a two-year transition period for controllers and processors to reach compliance, which ended October 17, 2024.

The GDPR, adopted in 2016, similarly carried a two-year transition before becoming directly applicable across the EEA on a single date, May 25, 2018. The structural parallel stops there: GDPR's transition ended with a functioning regulator network already in place in every member state. UU PDP's transition ended with the Law binding but its designated regulator not yet built, a genuinely different starting position for enforcement than GDPR had at its own commencement.

Oversight in the interim sits with Komdigi, Kementerian Komunikasi dan Digital, the ministry that replaced Kementerian Komunikasi dan Informatika (Kominfo) under a November 2024 restructuring (Perpres 174/2024), which also created a Ditjen Pengawasan Ruang Digital (Directorate General for Digital Space Oversight) with PDP-related duties.

Scope

UU PDP applies to the processing of personal data by any person, public body, international organization, or corporation, whether located within Indonesia or outside it, where the processing has legal effect within Indonesia or on an Indonesian citizen abroad, an extraterritorial reach broadly similar in spirit to GDPR Article 3's own extraterritorial trigger for organizations targeting individuals in the EEA. For the complete breakdown of what UU PDP covers, see our Indonesia data privacy laws guide.

At a Glance

Definitions and Sensitive Data: Where Indonesia Diverges from GDPR

UU PDP splits personal data into two categories under Pasal 4: data pribadi yang bersifat spesifik (specific/sensitive personal data) and data pribadi yang bersifat umum (general personal data).

The specific/sensitive category (Pasal 4(2)) covers health data and information, biometric data, genetic data, criminal records, children's data, personal financial data, and any other data further regulation designates. The general category (Pasal 4(3)) covers full name, sex, nationality, religion, marital status, and any personal data combined to identify a person.

On its face, this is a GDPR-shaped design, a bounded list of categories triggering elevated protection, similar in structure to GDPR Article 9's special-category list. In substance, the two lists diverge in ways worth flagging directly:

The practical read: Indonesia's sensitive-data list protects what its own policymakers judged most locally sensitive, finance, criminal history, and children, rather than reproducing the EU's list, which is built around discrimination-risk categories like race, religion, political opinion, and sexuality. A compliance program built only around GDPR's Article 9 list will both over-protect a category UU PDP treats as ordinary (religion) and under-protect a category UU PDP treats as sensitive that GDPR does not (financial data).

Legal Bases: Pasal 20 vs GDPR Article 6

Pasal 20(1) requires every controller to have a lawful basis for processing personal data. Pasal 20(2) then lists six bases that map onto GDPR Article 6(1) almost one to one:

Pasal 20(2)(f) deserves particular attention because it is a genuine correspondence rather than a coincidence of translation. Its text explicitly imports a balancing-test standard, weighing the controller's purpose and need against the subject's interests, the same substantive test Article 6(1)(f) applies in practice even though GDPR's own text states it more tersely. Indonesia does have a legitimate-interests basis, contrary to how the law is sometimes described.

Data Subject Rights: Pasal 5-15

UU PDP's rights catalog runs from Pasal 5 through Pasal 15, and it tracks GDPR closely, including two rights sometimes wrongly assumed to be missing from non-EU privacy laws.

Both data portability (Pasal 13) and the right to object to automated decision-making (Pasal 10) are present and substantively scoped close to their GDPR counterparts. Pasal 13 reads almost like a direct translation of Article 20, and Pasal 10 is explicitly limited to profiling and automated decisions with legal or significant effect, mirroring Article 22 rather than functioning as a generic objection right. There is no separately numbered general right to object to processing comparable to GDPR Article 21; Pasal 10 covers only the automated-decision variant.

Pasal 15 carves out exceptions, but narrowly and precisely. They apply only to Pasal 8 (erasure), Pasal 9 (consent withdrawal), Pasal 10(1) (object to automated decisions), Pasal 11 (restriction), and Pasal 13(1)-(2) (portability), for national defense and security, law enforcement, public administration, financial-sector/monetary/payment-system supervision, and statistics/scientific research. They do not reach Pasal 5 (transparency), Pasal 6 (rectification), Pasal 7 (access), or Pasal 12 (compensation), which carry no statutory exception.

Breach Notification: Pasal 46

Pasal 46(1) requires a controller to notify a personal data protection failure in writing no later than 3x24 hours (72 hours) to both the data subject and the "lembaga" (currently Komdigi, ad interim). Pasal 46(2) requires the notice to state what data was exposed, when and how it was exposed, and what remediation steps the controller has taken. Pasal 46(3) requires public notification in certain circumstances.

This is a structurally different design from GDPR, which runs two separate clocks: a hard 72-hour deadline to the supervisory authority under Article 33, and a "without undue delay" standard, not a fixed number, for notifying affected individuals under Article 34 (triggered only where the breach poses a high risk to the individual). UU PDP instead runs a single 72-hour clock to both recipients at the same time, with no separate, softer standard for the individual leg. Indonesia and the Philippines are unusual in this respect among APAC jurisdictions, most of which follow GDPR's pattern of a single hard regulator clock paired with a separate or no individual-notice clock. For how Indonesia's timeline compares against the rest of the world, see our data breach notification deadlines by country guide.

Pasal 46 sets no numeric severity or headcount threshold; the trigger is simply "kegagalan Pelindungan Data Pribadi" (a personal data protection failure), whatever its scale.

Cross-Border Data Transfers: Pasal 56 and the Missing Regulation

Pasal 56 sets out a four-step cascade for transferring personal data outside Indonesia, and it maps closely onto GDPR's Chapter V structure:

1. Pasal 56(2): the controller must ensure the receiving country has a level of personal data protection "equivalent to or higher than" UU PDP itself, similar to a GDPR Article 45 adequacy decision.
2. Pasal 56(3): if step (2) is not met, the controller must ensure adequate and binding protection exists, similar to GDPR Article 46's appropriate safeguards, such as Standard Contractual Clauses or Binding Corporate Rules.
3. Pasal 56(4): if neither (2) nor (3) is met, the controller must obtain the data subject's consent, functioning the same way GDPR Article 49's consent derogation does, as a last resort rather than a primary basis.
4. Pasal 56's final clause defers further provisions on transfer procedure to a Peraturan Pemerintah.

The structural match to GDPR is genuinely close. What breaks down is the mechanism that would make step (2) usable: nobody has been designated to assess and publish which countries meet the "equivalent or higher" standard, because that assessment procedure is exactly what the still-unissued PP was supposed to define. No adequacy list exists. In practice, this pushes controllers transferring data out of Indonesia toward step (3) contractual safeguards or step (4) consent, even though the Law's own cascade nominally starts at step (2). It is a direct, concrete instance of the text-versus-machinery gap this whole comparison turns on, not just an abstract point about the missing Badan PDP.

Penalties: Administrative Sanctions vs Criminal Prosecution

This is where UU PDP diverges from GDPR most sharply, and it is the page's most useful practitioner takeaway: Indonesia is not toothless. Its teeth are criminal, not administrative.

Administrative sanctions (Pasal 57)

Pasal 57(1) lists specific violations subject to administrative sanction, including breach of the legal-basis requirement (Pasal 20(1)), the breach-notification duty (Pasal 46(1) and (3)), and the cross-border cascade (Pasal 56(2)-(4)). Pasal 57(2) sets out four escalating sanction types: written warning, temporary suspension of processing activity, deletion or destruction of the data, and an administrative fine. Pasal 57(3) caps the fine at 2% of annual revenue or annual receipts relative to the violation.

That single flat 2% ceiling is structurally similar to GDPR's percentage-of-turnover concept under Article 83, but simpler: GDPR splits violations into a lower tier (2% of global turnover or EUR 10 million) and a higher tier (4% of global turnover or EUR 20 million), while UU PDP applies one flat rate with no two-tier split. In magnitude, Indonesia's cap sits closer to GDPR's lower tier than its headline 4% figure.

Both the body empowered to impose these sanctions (Pasal 57(4), the "lembaga") and the procedural detail for imposing them (Pasal 57(5)) are assigned to the missing PP and the not-yet-established Badan PDP. No Pasal 57 sanction has been confirmed as issued.

Criminal provisions (Pasal 67-70)

GDPR has no criminal penalty regime of its own. Article 84 leaves criminal sanctions entirely to individual EU member states' discretion, and the Regulation itself imposes none. UU PDP does, directly, in the statute:

At an approximate mid-2025/2026 exchange rate of roughly Rp15,600-15,900 per US dollar, Rp5 billion is in the neighborhood of USD 320,000 and Rp6 billion roughly USD 385,000; treat any USD figure here as a dated, approximate conversion, not a fixed equivalence.

The critical distinction for compliance planning: these provisions target intentional misuse by a bad actor, unlawful acquisition, disclosure, use, or falsification of someone else's data, not mere non-compliance by a controller. A controller that mishandles data through negligence faces the administrative track (Pasal 57); someone who deliberately misuses another person's data faces prosecution through Indonesia's ordinary criminal courts, running alongside, not instead of, the administrative exposure.

And critically, the criminal track does not depend on the missing Badan PDP. It runs through the ordinary courts, not the still-unbuilt regulator, making it the one enforcement path UU PDP creates that is not blocked by the institutional gap described above. No confirmed prosecution under Pasal 67-70 has been identified as of this review; this point concerns the track's legal availability, not a track record.

Corporate Liability: Pasal 70

Pasal 70 extends the Pasal 67 and 68 criminal provisions to corporations. Punishment may fall on the corporation's management, controlling parties, those who ordered the act, beneficial owners, and/or the corporation itself (Pasal 70(1)). A corporation itself can only be fined, not imprisoned, for obvious reasons (Pasal 70(2)).

The fine ceiling for a corporation is up to 10 times the maximum fine otherwise threatened under Pasal 67 or 68 (Pasal 70(3)): Rp50 billion (10x Rp5 billion, for Pasal 67(1)/(3) conduct) or Rp60 billion (10x Rp6 billion, for Pasal 68 conduct), roughly USD 3.2-3.9 million at the approximate exchange rate above. Pasal 70(4) allows additional penalties beyond the fine, including confiscation of profits or assets, freezing all or part of the corporation's business, permanent prohibition from certain acts, closure of all or part of its business premises, and fulfilling any neglected obligation.

That produces a genuinely interesting asymmetry: for any company with roughly under USD 160-195 million in annual revenue, the criminal corporate-fine ceiling can exceed what a 2%-of-revenue administrative fine under Pasal 57 would produce. For most companies operating in Indonesia, criminal exposure is not the secondary risk behind administrative fines; it can be the larger one.

Recent Developments

October 17, 2024. UU PDP's two-year transition period ended; every substantive obligation became fully binding.

November 5, 2024. Perpres 174/2024 restructured the overseeing ministry, renaming Kominfo to Komdigi and creating a new Ditjen Pengawasan Ruang Digital with PDP-related duties.

March-September 2025. The President granted izin prakarsa (initiative approval) on March 4 to begin drafting the Badan PDP Perpres, which then moved through inter-ministerial review.

Since October 2025. The draft Perpres has been in Ministry of Law harmonization. Separately, a draft implementing PP (RPP) reportedly finished harmonization and roughly 1,989 rounds of public comment, and was reported sitting at the State Secretariat (Setneg) awaiting presidential signature as of that same period.

February 4, 2026. Komdigi publicly restated a target of completing Badan PDP in 2026, confirming the authority remained unestablished as of that date.

As of this review (July 2026). No primary source confirms either the Badan PDP Perpres or the implementing PP has since been signed. Treat both as still pending, not issued, absent a specific dated primary confirmation.

Dual-Compliance Guidance

Organizations subject to both frameworks face a compliance posture with no GDPR precedent: a statute that is fully binding on paper, but whose enforcement infrastructure, and its own cross-border cascade's top step, is not yet functional.

For the EU side of this comparison, see our what is GDPR guide. For Indonesia's complete privacy picture, see our Indonesia data privacy laws guide.

Disclaimer

This article presents general legal information about Indonesia's Law No. 27 of 2022 on Personal Data Protection (UU PDP) and the EU's General Data Protection Regulation. It does not constitute legal advice. UU PDP's implementing regulation and supervisory authority are both still in process, and their status may change at any time following further government action. Organizations subject to either framework should consult a lawyer licensed in the relevant jurisdiction for advice specific to their situation. This article reflects information available as of July 23, 2026.

Authorities Cited

1. Kementerian Komunikasi dan Digital (Komdigi), JDIH portal: Undang-Undang No. 27 Tahun 2022 tentang Pelindungan Data Pribadi (UU PDP), full article text. https://jdih.komdigi.go.id/produk_hukum/view/id/832/t/undangundang+nomor+27+tahun+2022
2. Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 3, 6, 8-10, 15-23, 33-35, 45-49, 83-84. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679
3. Hukumonline. "Menanti Disahkannya Aturan Turunan UU PDP" (Awaiting the Enactment of UU PDP's Implementing Regulations). https://www.hukumonline.com/berita/a/menanti-disahkannya-aturan-turunan-uu-pdp-lt68fae7fbe057d/
4. Antara News Jatim. Komdigi statement on the Badan PDP 2026 completion target. https://jatim.antaranews.com/berita/1031282

---

Last updated: July 23, 2026. Indonesia's implementing regulation and supervisory authority are both in active process; readers should confirm current status against Komdigi's official notifications before relying on any date in this article for compliance purposes.

Frequently Asked Questions

Is Indonesia's UU PDP actually in force?

Yes, fully. The Law's two-year transition period ended October 17, 2024, and every substantive obligation, legal-basis requirements, rights, the 72-hour breach notice duty, cross-border rules, and both administrative and criminal penalties, is currently binding. What has not been established is the enforcement machinery: the independent supervisory authority (Badan PDP) has not been set up, and the implementing government regulation (PP) several provisions defer to has not been issued.

Does Indonesia have a data protection authority like the EU's DPAs?

Not yet, operationally. Pasal 58 requires an independent authority, Badan Pelindungan Data Pribadi (Badan PDP), established by the President via a Peraturan Presiden. That Perpres has not been issued; drafting received presidential initiative approval on March 4, 2025 and has been in Ministry of Law harmonization since October 2025, with Komdigi restating a 2026 completion target as of February 2026. Until it exists, Komdigi handles oversight and complaint intake on an interim basis.

Does UU PDP have a legitimate-interests lawful basis like GDPR?

Yes. Pasal 20(2)(f) provides a basis for 'other legitimate interests,' explicitly qualified by weighing purpose, necessity, and the balance of interests between the controller and the data subject, the same substantive test GDPR Article 6(1)(f) applies in practice. This is a genuine correspondence, not a gap some descriptions of Indonesian law suggest.

How does Indonesia's sensitive-data category differ from GDPR's special categories?

Pasal 4(2) treats financial data and criminal records as sensitive; GDPR's Article 9 excludes financial data entirely and handles criminal-conviction data separately under Article 10. Conversely, religion sits in Indonesia's general, non-sensitive category (Pasal 4(3)), the opposite of GDPR, where religious belief is textbook Article 9 data. Race, political opinion, union membership, and sexual orientation, all GDPR Article 9 categories, have no Pasal 4(2) counterpart at all.

What happens to cross-border data transfers without a functioning Badan PDP?

Pasal 56 sets out a four-step cascade similar to GDPR's Chapter V: an adequacy-style equivalence test, then contractual safeguards, then consent as a last resort. In practice, only the contractual-safeguard and consent steps work today, because the assessment procedure and adequacy list for the first step were assigned to the still-unissued implementing regulation.

Can someone be criminally prosecuted under Indonesia's data protection law?

Yes, and this is UU PDP's sharpest divergence from GDPR, which imposes no criminal penalties at the EU level at all. Pasal 67 and 68 criminalize unlawful, intentional acquisition, disclosure, use, or falsification of another person's data, carrying up to 4-6 years imprisonment and fines of Rp4-6 billion, plus confiscation of criminal proceeds under Pasal 69. Because prosecution runs through Indonesia's ordinary courts, it is not blocked by the still-unestablished Badan PDP.

What is the maximum penalty a company can face under UU PDP?

Two tracks run alongside each other. The administrative track (Pasal 57) caps fines at 2% of annual revenue or receipts. The criminal track (Pasal 70) can fine a corporation up to 10 times the individual maximum under Pasal 67 or 68, up to Rp50 billion or Rp60 billion, which can exceed the administrative cap for many companies. No confirmed sanction or prosecution under either track has been identified as of this review.

Does UU PDP give Indonesians a right to data portability?

Yes. Pasal 13 grants a right to obtain one's own data in a structured, machine-readable format and transmit it to another controller, closely mirroring GDPR Article 20. Indonesia also grants a right to object to fully automated decisions with legal or significant effect under Pasal 10, mirroring GDPR Article 22. Both rights are sometimes wrongly assumed missing from non-EU privacy laws; UU PDP has both.