Indonesia’s PDP Law and Your Website: What a Small Business Should Do Before January 2027

If your website has a contact form, a booking form, a newsletter box or analytics, it handles personal data. Indonesia’s Personal Data Protection Law (Law No. 27 of 2022) has been in force for years, but the detailed rules were missing. Now they have arrived: Government Regulation No. 33 of 2026 (GR 33/2026) was enacted on 16 July 2026 and takes effect on 16 January 2027.

We are a web agency, not a law firm, so this is general information and not legal advice. It sets out what published law-firm analysis means for the website side of a small business, and what you can prepare now. Our sources are linked, and anything important should be confirmed with a qualified Indonesian lawyer.

What changed, and when

Hogan Lovells Cadwalader notes that the PDP Law took effect in October 2022 with a two-year transitional period that expired in October 2024, but no implementing regulation followed until now. Several sources agree on the new dates: BDO Indonesia says GR 33/2026 was enacted on 16 July 2026 and takes full legal effect on 16 January 2027, and Kompas (in Indonesian) reports the same dates. Rajah & Tann says that from 16 January 2027, non-compliance with GR 33 requirements will be subject to administrative sanctions.

Two cautions. First, when Rajah & Tann wrote on 3 September 2026, it said the regulation had not yet been officially published on the State Secretariat website or formally announced, although copies had circulated among practitioners since late August. Check the current status. Second, ABNR reported on 15 September 2026 that the data protection authority had not yet been established, and that around 30 provisions contemplate further regulations from it. Until then, ABNR says, these matters continue to be administered by the Directorate General of Digital Space Supervision under the Ministry of Communication and Digital Affairs. So some detail is unsettled, but the core duties are clear enough to prepare for.

Does it apply to a small business?

ABNR says GR 33/2026 applies extraterritorially to processing outside Indonesia that has legal consequences within Indonesia or affects Indonesian data subjects. It describes the personal or household exemption as covering an individual’s processing that is for personal or household needs, not professional or commercial, and/or not intended for the public. A business website is commercial, so that exemption is not written for you.

None of the summaries we read describes a general exemption for small businesses. That is not a guarantee, so ask a lawyer about your case, especially if you are foreign-owned or your guests are mostly from overseas.

Where personal data hides on a business website

• Contact and enquiry forms: name, email, phone and message.
• Booking and checkout forms.
• Newsletter sign-ups and the email tool behind them.
• Analytics and advertising tags. ABNR says general personal data includes data that can identify an individual when combined with other information, so ask your lawyer whether your tracking identifiers count.
• Live chat, WhatsApp buttons and CRMs.
• Hosting, backups and plug-ins that store or process data for you. BDO says agreements between a controller and a processor must cover things like the scope and method of processing, data categories and processing period, and that a processor needs the controller’s written approval before engaging another processor.

Write this down. Rajah & Tann says a controller must keep a record of processing activities that works as both a register and a data-flow map, covering sources, lawful basis, purposes, data categories, third-party access, retention periods, security measures and transfers. For a small website, one page of notes is a sensible start.

What your privacy notice should say

BDO says controllers must give information on the legality and basis of processing, the purposes, the types of personal data, the retention period, the processing period and data subject rights, including the controller’s identity and contact information. Rajah & Tann describes a fuller list for data collected indirectly, such as from vendors, including sources, recipients, transfers and security measures, and says that notice must be accessible and kept updated. It also says GR 33 prohibits exoneration clauses that reduce, limit or exclude a controller’s obligations.

In practice, that means a real privacy page, linked from your footer and beside every form, that matches what the site actually does. Covering the fuller list is a safe habit. If your site runs in several languages, see our note on multilingual websites.

Consent on your forms

Hogan Lovells Cadwalader says consent under Articles 32 to 35 must be given “freely, consciously, specifically, and unambiguously”, preceded by concise information (legal basis, purpose, types of data, retention period and data subject rights), captured through a mechanism directly connected to that information, and obtained without deceptive means. Where data is used to offer goods or services, you must also disclose the third parties receiving it and how consent can be withdrawn. BDO adds that controllers must keep evidence of consent.

Consent is only one of six lawful bases, so not every form needs a checkbox. Ask your lawyer which basis you rely on. As a practical suggestion rather than a legal rule, an unticked checkbox with a link to your notice, stored with the date and time, is easy to defend.

Requests, breaches and where your data lives

• Requests. ABNR says controllers must provide accessible channels for data subject requests and verify each one. Rajah & Tann says the 72-hour deadline for fulfilling requests is reaffirmed.
• Breaches. BDO and ABNR describe a 3×24-hour notification requirement. ABNR says the clock starts when the controller definitively, properly and reasonably knows of the breach. You need a named person, backups and logs. Our WordPress security checklist is a good start.
• Cross-border transfers. Hogan Lovells Cadwalader says transfers outside Indonesia sit under Articles 160 to 174, with three bases in order of preference, and that the adequacy list and standard clauses do not yet exist. List where your hosting, email and analytics tools are based, and check who owns your accounts.

What is at stake

Rajah & Tann and ABNR both say fines are capped at 2% of annual revenue, and Rajah & Tann notes revenue means gross inflows, not net profit. ABNR lists sanctions including written warnings, temporary suspension of processing and erasure of data, which may be imposed cumulatively and without prior warning. How enforcement works in practice is still unclear while the authority is being set up.

A six-step website checklist before 16 January 2027

1. List every form, tool and plug-in that touches visitors’ data, and who runs it.
2. Write or update your privacy notice, and link it from the footer and every form.
3. Fix form consent: clear wording, a link to the notice, a record of when consent was given, and an easy way to withdraw.
4. Decide how long you keep enquiries and delete older ones. Hogan Lovells Cadwalader says a separate written retention policy is required.
5. Name who handles requests and breaches, and make sure the contact route works. Contact form emails that never arrive are a common hole.
6. Ask a lawyer to review your notice and lawful basis.

We can handle the website side: forms, consent wording, the privacy page, analytics settings and records of where your data sits, as part of our systems and technology work. Tell us about your business and we will map it with you.