From Policy to Proof: What PP No. 33 of 2026 Really Changes for Organizations

Thought Leadership

By Cisometric, Published on October 29, 2026

An organization may have a comprehensive privacy policy, established data protection procedures, and designated personnel responsible for compliance. Yet, when a customer withdraws consent for their personal data to be processed, can the organization verify that the change has been applied across its internal systems and third-party platforms?

This question illustrates a growing challenge in data protection governance. Documented procedures provide a framework for compliance, but their effectiveness depends on how they are implemented across business processes, applications, and external processing arrangements.

Indonesia's Government Regulation No. 33 of 2026 (PP 33/2026) brings these operational responsibilities into sharper focus. Issued on 16 July 2026 and scheduled to take effect on 16 January 2027, the regulation provides detailed implementation requirements for Law No. 27 of 2022 on Personal Data Protection (UU PDP), covering data processing, data subject rights, privacy risk assessments, incident notification, third-party processing, and regulatory accountability.

Ilafi Firsta Putri, CIPP/E (Certified Information Privacy Professional/Europe), Data Protection Officer (DPO) at Cisometric, examined its implications. Ilafi oversees Cisometric's internal data protection practices and advises organizations on privacy implementation, ISO/IEC 27701, compliance assessments, Records of Processing Activities (RoPA), Data Protection Impact Assessments (DPIA), and data flow mapping.

Through her consulting experience, Ilafi has observed that organizations often establish privacy documentation without fully evaluating how those requirements operate in practice. For her, PP 33/2026 reinforces an important shift in how compliance readiness should be assessed.

"For me, the single most consequential shift is moving from 'having privacy documentation' to 'being able to demonstrate that privacy is actually implemented.'"

This perspective raises an important question for management, privacy teams, and security professionals: If an organization were asked to demonstrate compliance today, would its operational evidence support what its policies claim?

Key takeaways

PP 33/2026 reinforces the need to demonstrate that data protection requirements are implemented in daily operations.
Compliance evidence should reflect actual processing activities, control effectiveness, and documented decisions.
Incident readiness requires reliable investigation, escalation, and notification procedures.
Third-party processing creates accountability risks that require continuous oversight.
Accurate data mapping and early privacy risk assessments are essential to operational compliance.

What does PP 33/2026 change for organizations?

PP 33/2026 provides more detailed implementation requirements for obligations established under UU PDP. With 225 articles, the regulation addresses matters such as:

Lawful processing
Data subject rights
Controller and processor responsibilities
Impact assessments
Technical safeguards
Cross-border transfers
Administrative sanctions

While UU PDP already establishes the legal foundation for personal data protection, PP 33/2026 provides greater procedural specificity. Organizations that previously concentrated on interpreting regulatory requirements and developing governance documentation must now assess whether their existing processes and controls can satisfy those requirements.

Several provisions illustrate the operational implications. Article 74 addresses records of processing activities, Article 120 establishes requirements for assessing high-risk processing, and Article 123 addresses technical and operational safeguards, including encryption, pseudonymization, resilience, and periodic evaluation.

These requirements connect privacy governance directly with system architecture, security controls, and business operations.

A retention policy, for example, needs to be supported by appropriate data lifecycle management. Similarly, an access control policy should correspond to actual permission configurations, privileged access management, and mechanisms for reviewing access rights.

From a compliance assessment perspective, this introduces an important distinction between control design effectiveness and control operating effectiveness. The former evaluates whether a control is appropriately designed to address a requirement or identified risk. The latter examines whether that control functions consistently within the operational environment.

An organization may have an established encryption policy, but its effectiveness still depends on implementation decisions involving cryptographic key management, access restrictions, and the protection of personal data across relevant systems. Demonstrating compliance therefore requires visibility into the controls themselves and the evidence supporting their operation.

What reliable evidence of compliance actually look like

Evidence of compliance needs to be traceable to actual processing activities. Depending on the requirement, this may involve system records, assessment documents, operational logs, approval histories, or evidence of completed corrective actions.

Ilafi identifies several important sources of evidence, including RoPA, DPIAs, consent records, data subject request logs, incident records, and vendor assessments. However, the value of these records depends on their accuracy and whether they reflect the organization's current operating environment.

The following areas illustrate how organizations can maintain reliable evidence of compliance across different data protection activities:

1. RoPA and data flow mapping

RoPA (Record of Processing Activities) provides a structured record of personal data processing activities, while data flow mapping helps organizations understand how personal data moves between applications, infrastructure, departments, and external processors.

Under Article 74 of PP 33/2026, data controllers are required to maintain processing records containing specified information about their activities, including relevant data flows.

For organizations operating across multiple technology environments, maintaining accurate records can be challenging. A new system integration, cloud migration, or change in vendor arrangements may introduce additional processing activities that are not reflected in existing documentation.

An outdated processing inventory can subsequently affect the organization's ability to respond to data subject requests, assess third-party risks, or determine the scope of an incident. Maintaining RoPA therefore requires coordination with the teams responsible for introducing or modifying processing activities.

When consent is used as the lawful basis for processing, organizations should maintain records demonstrating how consent was obtained, the purposes it covered, and how subsequent withdrawals were handled.

The operational challenge is ensuring that consent decisions are reflected across relevant systems. For example, when an individual withdraws consent for marketing activities, the organization needs to determine whether processing dependent on that consent has stopped, including where external platforms are involved. Any separate lawful basis or applicable retention obligation must be evaluated independently.

Data subject requests require similar traceability. Articles 20–27 of PP 33/2026 address procedures for submitting, verifying, and handling requests.

A reliable request history should allow the organization to establish when a request was received, how it was assessed, which actions were performed, and whether the response complied with the applicable requirements. Where fulfillment depends on multiple systems or departments, the records should also substantiate the actions recorded as completed.

3. DPIAs and risk mitigation evidence

For high-risk processing, a DPIA (Data Protection Impact Assessment) provides documented evidence of how an organization evaluates privacy risks before undertaking the relevant activities.

Under Articles 120–122, PP 33/2026 addresses DPIA requirements, including assessments of processing purposes, necessity, proportionality, potential risks, and protective measures.

An effective assessment should establish how identified risks influenced implementation decisions. If a DPIA identifies excessive access privileges, for example, the organization should be able to demonstrate whether access restrictions were introduced and how their effectiveness was evaluated.

This makes the relationship between assessment findings and implemented safeguards particularly important. A DPIA that identifies risks without corresponding mitigation decisions or actions may provide an incomplete account of how those risks are managed.

Could your organization reconstruct a personal data incident within 72 Hours?

One of the most demanding operational requirements under PP 33/2026 concerns the notification of personal data protection failures.

Article 114 establishes a 3 × 24-hour notification requirement for notifying affected data subjects and the relevant authority. The period is calculated from when the failure becomes known under the conditions specified in the regulation.

For cybersecurity and privacy teams, meeting this requirement involves several interconnected processes, including incident detection, investigation, classification, impact assessment, escalation, and notification.

A security alert alone does not necessarily establish that a personal data protection failure has occurred. Analysts must evaluate the available evidence, determine whether the activity represents a false positive, an unsuccessful attack attempt, or a confirmed incident, and establish whether personal data has been affected.

Importantly, personal data protection failures extend beyond unauthorized disclosure or exfiltration. PP 33/2026 also addresses failures involving unauthorized alteration, destruction, loss, and loss of access to personal data.

Consider a ransomware incident that disrupts access to customer records. The Security Operations Center (SOC) may initially prioritize containment, identifying affected systems, and recovery. Meanwhile, the privacy function needs to assess the nature of the personal data protection failure, its potential consequences for data subjects, and the applicable notification obligations.

These assessments depend on coordination between cybersecurity operations, the DPO, Legal, and management. The organization must also maintain sufficient evidence to establish the incident timeline, document its classification decisions, and substantiate the actions taken.

This creates several questions worth examining during incident response testing:

Can security analysts identify the affected personal data and processing activities using available telemetry and system records?
Are incident severity assessments and escalation criteria aligned with privacy reporting requirements?
Can the organization establish when the failure became known and document the basis for its notification decisions?
Are responsibilities for regulatory communication, evidence preservation, and remediation clearly assigned?

The effectiveness of an incident response framework depends on how these processes function under actual incident conditions. Regular testing can help identify weaknesses in investigation, escalation, and regulatory assessment before an organization faces a reportable event.

Third-Party Processing: Where accountability becomes more complex

As organizations increasingly rely on cloud infrastructure, SaaS platforms, and outsourced business processes, personal data frequently moves across systems managed by external parties.

According to Ilafi, third-party processing represents one of the most significant accountability gaps she encounters:

"You can outsource the process, but you cannot outsource the accountability."

Organizations sometimes assume that responsibility for protecting personal data transfers to a vendor when the processing activity is outsourced. However, where a vendor processes personal data on behalf of a controller, the controller retains responsibility for that processing under the applicable legal framework.

PP 33/2026 provides more detailed requirements for controller-processor relationships under Articles 13–16. These include contractual arrangements governing processing activities, the responsibilities of each party, oversight mechanisms, and conditions for engaging subprocessors.

For Ilafi, effective third-party governance also requires visibility into what data vendors process, why it is processed, where it is stored, who can access it, and how incidents are handled.

These considerations become particularly relevant when vendors introduce new subprocessors, modify their infrastructure, or change the locations where personal data is processed. Without ongoing assessments and monitoring, an organization's processing records and risk evaluations may no longer reflect its actual exposure.

Cross-border transfers introduce additional requirements. Articles 160–166 of PP 33/2026 address the conditions for transferring personal data outside Indonesia, including assessment of the transfer arrangement, receiving parties, associated risks, and applicable protection mechanisms.

For organizations using international cloud and SaaS providers, this requires a clear understanding of the processing arrangement. The location of a primary database may provide only part of the picture, as personal data may also be accessed, replicated, or processed through other parties and jurisdictions.

A reliable third-party governance program therefore needs to account for the full vendor relationship, from initial due diligence and contractual safeguards to ongoing monitoring, material changes, and eventual termination.

Privacy risk assessment needs to begin before deployment

PP 33/2026 also establishes more detailed requirements for processing activities that may create elevated risks for data subjects.

Article 120 requires DPIAs before processing activities that meet the regulation's high-risk criteria. These include certain forms of automated decision-making, systematic evaluation or monitoring, large-scale processing, processing involving specific categories of personal data, and the use of new technologies. The explanatory provisions identify artificial intelligence and machine learning among the relevant examples of new technologies.

Consider a financial services organization developing an automated customer risk-scoring system. The platform combines transaction records, behavioral information, and other customer attributes to support decisions that may significantly affect individuals.

A DPIA may need to evaluate:

Whether the data collected is necessary and proportionate to the intended purpose
Whether the processing creates risks of inaccurate or discriminatory outcomes
Whether appropriate safeguards are in place

These findings can influence decisions about data minimization, access restrictions, system design, and the management of automated processing.

However, the value of a DPIA depends heavily on when it is conducted.

Ilafi notes that organizations sometimes involve privacy teams too late, particularly when launching new products or entering relationships with third parties. By that stage, decisions concerning architecture, data collection, and processing arrangements may already have been finalized, making corrective action more complex.

Integrating privacy assessment into architecture reviews, project approval processes, and change management allows relevant risks to be evaluated while technical and operational alternatives remain available.

For organizations with established security governance processes, this also creates an opportunity to coordinate privacy requirements with existing risk assessments and technology review procedures.

Closing data visibility gaps: Insights from Cisometric’s Data Privacy consulting case

The importance of accurate data mapping becomes clear in one of Ilafi's consulting experiences involving a company in the hospitality sector.

Problem

The organization experienced difficulty answering customers who asked where their personal data was stored. Although it processed customer information as part of its operations, the company lacked a clear RoPA and data flow documentation that could support an accurate response.

The company also had no clearly defined data retention periods, creating uncertainty about how long different categories of customer information should be maintained.

Solution

Cisometric supported the organization in:

Mapping their personal data processing activities
Developing RoPA and data flow documentation
Establishing appropriate retention periods

Following implementation, the company gained better visibility and control over its personal data processing activities. They were also better prepared to respond to customer inquiries and demonstrate its privacy practices.

For your business

The case illustrates a fundamental dependency in data protection governance. Without an accurate understanding of where personal data resides, how it moves between systems, and which parties process it, organizations may struggle to fulfill even established privacy obligations.

For businesses operating across fragmented technology environments, resolving these visibility gaps can provide the foundation for more effective privacy risk management and regulatory readiness.

What should be prioritized before January 2027

With PP 33/2026 scheduled to take effect on 16 January 2027, organizations should evaluate their current privacy practices against the regulation's implementation requirements.

Ilafi recommends prioritizing five areas when conducting an initial readiness assessment:

Review RoPA and data flow maps
Reconcile existing processing inventories with actual systems, applications, data transfers, and third-party arrangements. Identify activities that remain undocumented or have changed since the last review.
Evaluate policies and operational controls
Examine whether documented procedures correspond to existing technical configurations, workflows, and assigned responsibilities. Identify control design gaps and implementation failures that require remediation.
Test data subject rights procedures
Review completed requests to establish whether the organization can demonstrate proper verification, processing decisions, fulfillment, and compliance with applicable timelines.
Assess risk and incident management readiness
Identify processing activities that require DPIAs and test how personal data protection incidents are investigated, classified, escalated, and documented.
Reassess third-party processing arrangements
Review vendor assessments, processor agreements, subprocessor relationships, and cross-border transfers to identify gaps in oversight and accountability.
These assessments should result in clear remediation priorities, assigned responsibilities, and mechanisms for monitoring progress. Management can then use internal audits, periodic reviews, and operational records to evaluate whether improvements remain effective as business processes and technology environments change.

Strengthen your Data Protection accountability with Cisometric

PP 33/2026 gives organizations greater clarity on the operational requirements supporting Indonesia's personal data protection framework. Preparing for its implementation requires coordination across privacy governance, cybersecurity, IT, legal, and business functions, particularly where processing activities extend across multiple systems and third parties.

At Cisometric, Ilafi and the data privacy consulting team support organizations in assessing their current privacy posture, identifying implementation gaps, and developing practical governance processes and controls. This includes compliance assessments, RoPA and data flow mapping, DPIA support, and privacy management implementation.

Through her experience, Ilafi emphasizes one principle that organizations should consider when evaluating their readiness.

"You cannot protect what you don't know."

She encourages organizations to begin with a fundamental question:

"Do we really know what Personal Data we have, why we use it, and where it goes?"

Accurate answers provide a foundation for identifying privacy risks, determining appropriate controls, and establishing accountability across the personal data lifecycle.

Explore Cisometric's Data Privacy and Compliance Consulting services to identify implementation gaps and strengthen your organization's data protection governance.

Stay connected with Cisometric for insights on cybersecurity, data privacy, regulatory compliance, and digital trust.

LinkedIn: Cisometric

Instagram: @cisometric

Youtube: @Cisometric

FAQ

Does PP 33/2026 replace Indonesia's existing Personal Data Protection Law?

No. PP 33/2026 is the implementing regulation of Law No. 27 of 2022 on Personal Data Protection (UU PDP). It provides more detailed procedures and requirements for implementing obligations established under the existing law and is scheduled to take effect on 16 January 2027. Cisometric's Data Privacy Consulting team can help organizations assess their existing compliance programs against these requirements, identify implementation gaps, and prioritize necessary improvements.

Does every organization need to appoint a Data Protection Officer under PP 33/2026?

No. Article 142 establishes specific criteria requiring the appointment of a personal data protection officer, including certain public service processing activities, regular and systematic large-scale monitoring, and large-scale processing of specific categories of personal data. Organizations should assess whether their processing activities meet these criteria. Cisometric's Data Protection Officer and privacy consulting team can support organizations in evaluating their governance requirements, defining relevant responsibilities, and strengthening their data protection practices.

Does every AI application require a DPIA under PP 33/2026?

Not automatically. The requirement depends on whether the processing activity meets the high-risk criteria under Article 120, which include certain automated decisions, systematic monitoring, large-scale processing, and the use of new technologies. Organizations developing AI applications that process personal data should evaluate these criteria before deployment. Cisometric supports DPIA implementation by helping organizations identify privacy risks, assess processing activities, and establish appropriate mitigation measures.

When does the 3 × 24-hour incident notification period begin?

Under Article 114, the notification period is calculated from when a personal data protection failure becomes known under the conditions specified in the regulation. A security alert alone does not necessarily establish that a reportable failure has occurred, making incident investigation, classification, and documentation essential. Cisometric's cybersecurity and data privacy capabilities can help organizations strengthen the coordination between security investigations, privacy impact assessments, and incident escalation procedures.

What administrative sanctions can apply under PP 33/2026?

PP 33/2026 provides for administrative sanctions including written warnings, temporary suspension of processing activities, deletion or destruction of personal data, and administrative fines. Article 185 establishes a maximum administrative fine of 2% of annual revenue or receipts, subject to the applicable assessment criteria. Through compliance assessments and privacy governance consulting, Cisometric helps organizations identify weaknesses in their data protection practices and develop corrective measures to address compliance risks.