A 72-hour breach clock, and nobody to call
Government Regulation 33/2026, signed on 16 July 2026, sets out how Indonesia's 2022 personal data law works in practice. From 16 January 2027, organisations must notify affected people and the supervisory authority within 72 hours of confirming a breach, and the authority can fine up to 2% of annual gross revenue. But that authority has not been created. The presidential regulation needed to set it up has not been issued, and on 27 July 2026 the ministry opposed a court petition asking for a deadline.
01Safety lens
| Incident reportingDoes it require incidents to be reported? | Yes |
|---|---|
| Unacceptable usesDoes it name uses that are not acceptable? | Unclear |
| General-purpose modelsDoes it address general-purpose models? | Unclear |
| EnforcementHow strongly is it enforced? | Unclear |
| Who receives reportsIs a body named to receive incident reports, and does it exist? | Named, not set up |
| Cross-borderDoes it address AI systems or incidents that cross borders? | Unclear |
| Frontier AIDoes it address frontier AI, the most capable models and their control? | Unclear |
Incident reporting here means personal data breaches, not AI incidents.
Why these values
Incident reporting is yes because the cited summaries say organisations must notify affected people and the supervisory authority within 72 hours of confirming a breach. Recipient is named but not established: the authority is named, and HLC reports that it has not been created. The regulation's own text was not available, so cross-border and frontier scope stay unclear.
Lens checked on · How the lens is coded
02Compared with the EU
The GDPR also gives 72 hours to notify the supervisory authority (Article 33). A failure to notify falls in its lower fine tier, up to 10 million euros or 2% of worldwide annual turnover, whichever is higher (Article 83(4)(a)). The higher tier, 20 million euros or 4%, covers infringements such as the basic principles and data subjects' rights (Article 83(5)). Indonesia's cap is 2% of annual gross revenue, and its supervisory authority does not exist yet.
03My take
This one is not about AI directly, and I am including it on purpose. AI rules lean on the same machinery as data protection: someone has to receive the incident report, and someone has to be able to say no. The 72-hour clock matches the GDPR deadline for notifying the supervisory authority, so on paper Indonesia is at the European standard. But a deadline only matters if there is an authority at the other end, and in the August and September 2026 reports I found there is none. That makes 16 January 2027 the date to watch. I have only read legal summaries so far, not the regulation text, so I will read the primary text before treating the details as final.
04Sources
- Summary of Government Regulation 33/2026 under the personal data protection lawNusantara DFDL, English · Archived copy 2026-10-03
- On the missing data protection authority and the court petition for a deadlineHLC, English · Archived copy 2026-08-31
Spotted an error? Report it on GitHub with a source and I will fix it in the open.
Report an error