PP 33/2026 PDP Effective January 16, PDP Agency Doesn't Exist Yet: 71 Day Checklist for Developers

PP 33 of 2026 is an implementing regulation of the Personal Data Protection Law (UU 27/2022) which will come into effect on January 16 2027, only 71 days left. The technical regulations already exist, but a supervisory institution has not been formed. This week the DPR again urged the government to form a PDP Agency. For developers and digital business owners, now is the time to prepare a system.

What happened this week?

On 4–6 November 2026, Commission I of the DPR urges the government to immediately establish a Personal Data Protection Agency. This pressure emerged after three generals were named as suspects in the alleged illegal wiretapping of the President and a number of figures. We have already discussed the technical side of the case in the article Wiretapping the President via LIMS.

Member of Commission I, Taufiq R. Abdullah, called the formation of the agency "a law order from 4 years ago" and asked the government "not to delay" (IDX Channel, 6 November 2026).

The problem is, the clock is ticking. PP 33/2026 was promulgated on July 16 2026 with a grace period of six months. Starting January 16 2027, technical obligations such as 3×24 hour leak notification, impact assessment, and appointment of PDP officers have clear article references. This still applies even though the institution has not yet been established.

What is the main content of PP 33/2026?

According to the cybersecurity.or.id summary, this PP contains 12 chapters and 225 articles. Here are the most impactful points for product and engineering teams, compiled from analysis by Veritask, FWP, and Hukumonline:

There is one small difference between sources. Veritask wrote July 16 2026 as the enactment date, while FWP and cybersecurity.or.id called it the promulgation date. The effective date remains the same in all sources, namely January 16, 2027.

Why is the absence of a PDP body still a problem for you?

Many people think that rules cannot be enforced as long as the institution does not exist. That's only half true. Administrative fines were imposed by the Institution. But there are three things that still work:

• Civil lawsuit. PP 33/2026 (Articles 105–110) regulates compensation routes. Data subjects can ask the controller and sue if refused.
• Criminal provisions of the PDP Law. This provision has been in effect since 2024 and is handled by law enforcement officials, not institutions.
• B2B Contracts. Corporate clients, banks and state-owned companies are starting to include PP 33/2026 compliance clauses in vendor agreements. FWP notes that processor appointment agreements now require 11 minimum standard clauses.

Once the Institute is formed, incidents that occur after January 16 2027 can be immediately assessed with this rule. Cases such as the leak of 5.7 million Fore Coffee accounts illustrate how quickly the public demands an explanation.

How does the 3×24 hour leak notification flow?

This is the obligation that most often makes the team panic, because the time is short and involves many parties. Article 114 calculates the time from when the failure was "known for certain, proper and reasonable". So your logs and triage process should be able to show when that point occurred.

Processors such as cloud providers, email services, or CRM vendors are required to report “at the earliest opportunity,” with no fixed hours. Therefore, write a firm time limit in the contract, for example 24 hours. That way you still have time left before the 72 hour deadline.

Example: calculate automatic notification deadlines

Store a "known for certain" timestamp in the incident ticket system, then calculate the deadline automatically. Simple example in Node.js:

// Hitung tenggat notifikasi 3x24 jam (Pasal 114 PP 33/2026)
const knownAt = new Date("2027-02-03T14:20:00+07:00"); // saat insiden dipastikan
const deadline = new Date(knownAt.getTime() + 72 * 60 * 60 * 1000);

const fmt = (d) =>
  d.toLocaleString("id-ID", { timeZone: "Asia/Jakarta", dateStyle: "full", timeStyle: "short" });

const sisaJam = Math.floor((deadline - Date.now()) / 36e5);
console.log(`Tenggat notifikasi: ${fmt(deadline)} WIB`);
console.log(sisaJam > 0 ? `Sisa ${sisaJam} jam` : "LEWAT TENGGAT, eskalasi ke DPO dan legal");

What do developers need to prepare in 71 days?

The following is a practical checklist that can be divided per sprint. The sequence follows the suggested schedule from cybersecurity.or.id: assessment, governance, implementation, then validation.

1. Personal data inventory. Map tables, columns, buckets, and logs that store private data. Prioritize specific data such as health, biometrics, financial and child data.
2. Note the processing basis. Every data flow must have one of the six bases in Article 30. Don't automatically use "agreement" if it is actually an agreement.
3. Create a data subject rights request channel. Forms or endpoints for access, correction, deletion and withdrawal of consent, complete with proportional identity verification.
4. Set up a 72-hour incident runbook. Determine who confirms the incident, who drafts the letter, and the notification template.
5. Vendor audits and overseas transfers. List of all SaaS and third-party APIs, including their server locations. For overseas servers, prepare a transfer impact assessment.
6. Run DPIA for high-risk features like automatic scoring, eKYC, or location tracking.
7. Appoint a PDP officer if your core activities meet the criteria of Articles 142–147.

Quick step: look for the personal data column in the code

For initial inventory, schema scan and database migration. This command uses grep standards and does not modify any files:

# Cari nama kolom yang lazim berisi data pribadi di file SQL/migrasi
grep -rniE "\b(nik|no_ktp|npwp|nama_ibu|tanggal_lahir|tgl_lahir|alamat|no_hp|phone|email|rekening|lat(itude)?|lon(gitude)?)\b" \
  --include=*.sql --include=*.prisma --include=*.ts --include=*.py . \
  | cut -c1-160 | sort -u > inventaris-pii.txt

wc -l inventaris-pii.txt

The results can be transferred to the processing activity record (record of processing). A simple JSON format like this is easy to store in a repo and review via a pull request:

{
  "aktivitas": "Pendaftaran akun dan eKYC",
  "kategori_data": ["nama", "NIK", "foto wajah", "nomor HP"],
  "data_spesifik": true,
  "dasar_pemrosesan": "perjanjian",
  "prosesor": [{ "nama": "Penyedia OCR", "lokasi_server": "ID" }],
  "transfer_luar_negeri": false,
  "retensi": "5 tahun setelah akun ditutup",
  "dpia_wajib": true,
  "pemilik": "tim-onboarding"
}

What is the impact on businesses using third-party APIs?

Every time your application sends your NIK, KTP photo, or account number to another API, you become the controller and the API provider becomes the processor. Consequences:

• Requires a processing agreement with minimum clauses, including audit rights and subprocessor rules.
• Responsibility remains with the controller (Articles 13–16). Vendor-side leaks remain your business in the eyes of the data subject.
• Send only necessary data. For example, if you only need NIK format validation, there is no need to send a photo of your KTP.

If you use services such as KTP OCR, account validation, or NIK parsing in the APIPedia console, enter them into the vendor inventory as well. Note what endpoints receive personal data.

FAQs

When will PP 33/2026 come into effect?

January 16 2027, six months after it was promulgated on July 16 2026. Counting from November 6 2026, the remaining time is 71 days.

Do small startups also have to comply?

Yes. The PDP Law applies to every controller and processor, without limits on business size. The difference is in certain obligations. For example, DPO is only mandatory if the core activity meets large-scale criteria or involves specific data. Article 185 also allows fines to be reduced to IDR 0 based on certain considerations.

If the PDP Agency doesn't exist yet, where are leak notifications sent?

PP said the notification was sent to the data subject and the Institution. As long as the Institute has not been formed, no official channels have been announced. In the meantime, still send notifications to data subjects within 72 hours and document everything. In practice, companies also report to Komdigi, as does Fore Coffee.

How long does it take to respond to a data subject rights request?

Hukumonline notes a 3×24 hour limit for fulfilling data subject requests, following the provisions of the PDP Law. Make sure your request channels can meet those targets, including the identity verification process.

Is it still allowed to use a cloud server in Singapore?

Yes, as long as one of the three layers of transfer in Articles 160–166 is met: the destination country is equivalent, there are adequate and binding safeguards, or there is the consent of the data subject. Conduct a transfer impact assessment and record the results.

This article is general information, not legal advice. Refer to the official text of PP 33/2026 and consult with legal advisors for specific cases.

Source

• Veritask: PDP Technical Arrangements and Obligations of Controllers and Processors Published Through PP 33/2026
• FWP: Implementing Regulations for the PDP Law Issued, Important Provisions of PP 33 of 2026
• cybersecurity.or.id: Personal Data Protection Effective January 16 2027
• Hukumonline Pro: Government Issues PDP Implementation Framework, Effective January 16 2027
• IDX Channel: DPR Urges Government to Immediately Form Personal Data Protection Agency