Indonesia’s PDP Law: What Businesses Need to Put in Place

When Indonesia’s PDP Law applies to a business

A villa operator receives three booking enquiries through WhatsApp. One guest sends a passport image, another asks about an airport transfer, and a third gives a phone number for a viewing. There may be no booking platform or formal customer database, yet those messages already contain information about identifiable people.

Indonesia's Personal Data Protection Law, Law No. 27 of 2022, covers electronic and non-electronic processing. It is national legislation, not a Bali-specific licensing rule. Its territorial provisions can also reach certain activities outside Indonesia when the statutory connection to Indonesia or Indonesian citizens abroad is present.

A business that chooses the purpose and essential means of using a guest's details is generally the data controller. A booking platform or messaging contractor following its instructions may act as a processor; the roles must reflect what each party actually does. Company size does not create a general exemption. The law took effect on 17 October 2022, and its two-year compliance adjustment period ended in October 2024. Waiting for the next regulation is not a valid privacy strategy.

Where customer data enters the business: forms, chat and CRM

The data trail often becomes complicated after the first enquiry, not during it. A visitor submits a booking form, gets a reply from a sales representative, sends identification in a chat and later appears in a shared CRM. A booking confirmation may go to an operations team, while a separate agency receives the same contact for advertising. Exported spreadsheets, attachments and automated backups multiply the number of places where the record lives.

A workable inventory distinguishes what the business truly needs. A name, email address, phone number or online identifier can identify someone even without a passport. Government identity documents and payment information call for tighter access. Indonesian law treats certain information as specific personal data, including health information, children's data and personal financial data. A simple availability enquiry normally does not justify collecting a scan of an identity document; a later statutory or contractual step may have different needs.

For each processing activity, the business needs to be able to explain the purpose and legal basis, the responsible team, where the information is stored and who receives it. The inventory should cover access from abroad, onward sharing by vendors and the reason for keeping a record after the enquiry ends. A hotel group may retain a completed reservation for a different reason than it retains a prospect who never booked. The two sets of data should not drift into a single permanent marketing list.

Mapping one complete customer journey is revealing because the most exposed copy is often outside the principal system. Staff may use personal messaging accounts, an external accountant may retain attachments, and a former agency may still have an export. The inventory makes those handovers visible. Government Regulation 33/2026 introduces more detailed processing-record requirements from January 2027, but the need to understand and protect the information already follows from the existing law.

Choosing a lawful basis under the PDP Law

An enquiry for a room rate does not give a business a standing invitation to market unrelated services. The legal question changes when the same contact moves from answering a customer's request to building an advertising audience. Each purpose needs its own lawful basis and a description the person can understand.

Article 20 of Indonesia's PDP Law offers several possible grounds. They include explicit consent for specified purposes, performance of a contract or steps requested before entering one, compliance with a legal obligation, vital interests, certain public-interest or legal-authority functions, and other legitimate interests assessed against the individual's rights. Private operators will commonly examine the consent, contract-related, legal-obligation and legitimate-interest grounds. None can be chosen simply because it is convenient.

Consider two uses of a guest's email address. Sending a quotation after the guest requested it may be connected to pre-contractual steps. Adding that address to a long-running promotional campaign is a separate decision. Similarly, keeping information required for a lawful invoice does not authorise sharing the whole guest list with an unrelated brokerage. A legitimate-interest argument needs a reasoned assessment of necessity and the competing interests of the person whose information is used.

Where consent is the basis, the record should show what was explained, which choice the person made, the date, and the notice version. Revoking permission must be possible in a meaningful way, and a withdrawal should end processing that depends on that consent. Other records may still be retained when a distinct lawful ground requires it. Messaging and electronic marketing rules may impose further conditions; the PDP basis alone does not settle every question about a campaign.

Writing a privacy notice customers can actually use

A customer sees a privacy notice at the point of handing over information, or the notice is not doing much work. A footer promising that a company “respects privacy” cannot tell a guest whether an enquiry will reach a property manager, a call centre or a marketing agency.

The notice should identify the responsible legal entity and give a usable contact channel. It needs to explain the categories of information collected, the specific purposes and lawful grounds, the kinds of vendors and other recipients involved, overseas transfers where relevant, and retention periods or criteria. People should also understand how to request access, correction or deletion and how a change of purpose will be communicated. The content must match the actual processing and the disclosure duties applicable to that activity.

Language matters. “By submitting this form, you authorise any use of your data by our partners” conceals too much and offers no meaningful distinction between services. A clearer statement would separate a response to the requested viewing from an optional offer of future promotions. That contrast illustrates usable wording; a real notice must name the actual controller, its contact details and the recipients relevant to that business.

For a booking site, the explanation belongs where the form is used. When the customer relationship starts in a messaging app, the business needs a practical way to provide the information there, too. International operators should make their explanation intelligible to the audience whose details they collect. Keeping a dated history of notice versions helps establish which information was available at the time of a request or consent. GR 33/2026 will expand the operational detail in January 2027; it does not make notice obligations optional in November 2026.

CRM vendors and agencies: who controls customer data?

Buying a sophisticated CRM does not transfer responsibility for the sales team's decisions to its software provider. The company deciding why customer details are collected usually remains the controller. Under Article 51 of the PDP Law, a processor working on a controller's instructions sits within the controller's accountability arrangements. The service provider has its own obligations, but the customer business cannot treat the contract as a substitute for oversight.

An advertising agency illustrates why labels are not enough. It may simply send campaigns using a supplied list and documented instructions. Alternatively, it may combine those contacts with its own profiles and decide independently how to use the resulting audience. The legal role needs to be assessed for the particular activity, not assigned once to the company as a whole. Where businesses jointly determine purposes and methods, the law recognises joint controllers and requires clarity about their respective responsibilities.

A useful processing agreement is specific about authorised purposes, data categories, access permissions and confidentiality. It should address technical safeguards, incident escalation, audit evidence, storage and remote-access locations, and what happens to records at the end of the contract. A processor cannot simply appoint another processor without the controller's prior written approval under the statute. The controller also needs to understand how a contractor handles deletion requests and whether the contractor's own terms permit additional data uses.

The weak point may be an exported lead sheet rather than the cloud service itself. An outsourced marketer might have given copies to freelance staff, or a departing manager may still have access through a personal login. A certificate displayed on a vendor website says little about those arrangements. Clear ownership, restricted exports, access logs and a verifiable exit process make the contractual promises operational.

Cross-border data transfers: overseas cloud and remote access

A cloud vendor's headquarters tells you very little about the route taken by a customer's information. The booking system might run in one country, use backups in another and allow support staff in a third to inspect records. Conversely, a foreign shareholder does not by itself mean a particular customer record has been transferred abroad. Storage, access and onward disclosure must be mapped separately.

Article 56 of the PDP Law sets out an order of conditions for transfers outside Indonesia. The controller first considers whether the destination provides an equivalent or higher level of protection. If that condition is unavailable, adequate and binding safeguards are needed. Where neither of those routes can be satisfied, the statute provides for the data subject's consent. These are conditional alternatives, not a general permission to export any database once someone ticks a box.

Government Regulation 33/2026, taking effect on 16 January 2027, gives this framework more procedural detail and qualifies the use of particular transfer mechanisms. Some envisaged instruments depend on decisions or recognition by Indonesia's future PDP supervisory authority. That authority had not formally become operational as of 9 November 2026. Businesses should be cautious of a provider that claims every possible transfer is already approved without identifying the relevant law, instrument or recipient.

The practical assessment concerns a specific dataset. Which countries host the primary copy and backups? Who can log in remotely, what subprocessors may receive it, and what controls apply to further sharing or deletion? A small accommodation operator may be able to keep passport images out of marketing tools entirely, reducing the material exposed abroad. Separate industry-specific rules can also apply. PDP transfer obligations should not be conflated with electronic-system registration or with the company's authority to carry on business.

Handling access, correction, deletion and retention requests

A guest asks to have their details removed after cancelling a reservation. The CRM entry disappears, but the same number is still in an agency export and the booking documents remain with the accounts team. That is why privacy requests need a search process that crosses systems and contractors, not just a delete button.

Indonesia's PDP Law gives individuals rights concerning information, access and copies, rectification, withdrawal of consent, and, where the legal conditions apply, cessation and deletion. These rights are not identical. Withdrawing permission for promotions does not automatically erase records that a company is required or otherwise lawfully entitled to keep for a separate purpose. Nor is there a universal three-year retention period for every lead, guest record and invoice.

The business needs an accessible request channel and an owner who can coordinate a response. Identity verification should be proportionate: asking for a fresh passport scan to change an ordinary contact field may create more risk than the request itself. Once a request is authenticated, relevant records may need to be located in messaging accounts, email, cloud folders, local exports, vendor systems and backup arrangements. The response should reflect genuine legal retention exceptions and explain them in understandable terms.

There also needs to be an audit trail of what was found, corrected, removed or retained, who was instructed to act and when the person was told. Some rights carry short statutory or implementing-regulation timeframes, with additional procedural detail taking effect in January 2027. A monthly manual clean-up will not substitute for a timely response. Retention rules work best when they distinguish abandoned enquiries, completed bookings, required financial records and optional marketing subscriptions.

A customer-data breach: what to do in the first 72 hours

An employee uploads a guest manifest to the wrong chat group. It contains phone numbers, arrival dates and images of identity documents. Asking the recipients to delete the file may be sensible, but it does not establish who has already copied it. The immediate priority is to contain access, revoke shared links or credentials where possible, and preserve logs and messages that can establish what happened.

Not every incident starts with an obvious external leak. A lost phone may retain an authenticated CRM session; ransomware can make records unavailable without visibly publishing them. Investigation needs to establish the affected information and people, the route of exposure and any continuing access. Records involving children, identification documents or personal financial details warrant particular attention. The controller should have someone authorised to coordinate with employees and processors, while recording both the first alert and the point at which the facts become sufficiently established.

Article 46 of Law No. 27/2022 requires written notifications to affected data subjects and the designated authority within 3 × 24 hours in the event of a personal-data protection failure. At a minimum, the notice covers the information exposed, when and how it happened, and the steps taken to address and recover from it. A business cannot simply wait until a prolonged internal investigation has ended. GR 33/2026 will clarify the process from January 2027, including the assessment of when a breach has been established with sufficient certainty on reasonable grounds. With the specialised authority still being formed on 9 November 2026, the official reporting route must be established according to the arrangements actually available when an incident occurs; no generic template can supply a reliable address.

A misdirected copy of a publicly available business card and an exported file of passports are not equivalent exposures. Both deserve documentation, while the likely consequences and response will differ. A small operator benefits from an incident owner, a tested way to disable access, a record of decisions, and the ability to explain the situation promptly to affected customers. Silence is not a containment measure.

Preparing for Government Regulation 33/2026 in January 2027

Indonesia's PDP obligations did not begin with Government Regulation 33/2026. Law No. 27/2022 has been in force since October 2022, with its two-year adjustment period ending in October 2024. GR 33/2026 was promulgated on 16 July 2026 and becomes effective on 16 January 2027. For a business already collecting bookings and customer enquiries, those are two different compliance milestones.

The implementing regulation places more weight on documented operations: processing records that cover transfers, a written retention policy, accountable vendor arrangements, clearer notices and procedures for handling rights requests and security incidents. A high-risk activity may also require a data protection impact assessment, with an assessment tied to the processing and its risks. Routine use of a CRM does not automatically make every company subject to the same assessment or staffing obligations.

A data protection officer, or an officer performing the statutory privacy function, is required when the applicable Article 53 conditions are met. They concern matters such as large-scale systematic monitoring and certain large-scale uses of specific personal data. A July 2025 Constitutional Court judgment changed how one of those triggers must be read. The law permits appropriately qualified internal or external appointments; a small company is not required to hire a separate employee solely because it exists.

As of 9 November 2026, the dedicated PDP authority was still being established. Officials reported on 4 November that the draft presidential regulation had reached its final stage, which is not the same as an operating reporting portal. Companies can use the intervening period to test their own records and response procedures, while assessing difficult legal grounds, international transfers and incident duties against the rules applicable to the actual activity. Detailed legal conclusions depend on the facts and qualified Indonesian advice.