Contents of the PDP Law Derivative Regulations

The Ministry of Communication and Digital Affairs (“Komdigi”) refers to the derivative regulations of Law No. 27 of 2022 on Personal Data Protection (“PDP”), as amended by Law No. 1 of 2026 on Criminal Adjustments (collectively referred to as “Law 27/2022”), including the establishment of a supervisory body and technical implementation, which are still being processed across ministries. However, Komdigi guarantees that maximum sanctions will only be enforced after the legal framework is complete.

Komdigi's Director of Certification and Electronic Transaction Supervision, Teguh Arifiyadi, explained that the sanction mechanism starts with a warning and other administrative measures before culminating in a fine. This approach is intended to ensure that business actors have room to improve compliance before being subject to financial penalties.

“In government simulations, the maximum fine is expected to be rarely reached if operators have implemented adequate compliance standards. This shows that the policy orientation is not on punishment, but on the formation of a compliance ecosystem,” he explained to Hukumonline.

The drafting of both the Draft Regulation of the Government (“Draft Regulation”) implementing Law 27/2022 and Regulation of the President establishing the PDP Agency has been underway since 2022–2024 and has received presidential approval in 2025.

“We hope that it can proceed to the completion process this year,” he added.