The Personal Data Protection Law for villages, schools, and agencies: what must you do?

By Mohammad Hilmi Bisri, S.Kom.. Published 10 October 2026.

Law (Undang-Undang) No. 27 of 2022 on Personal Data Protection (Pelindungan Data Pribadi, UU PDP) governs how data about a person is collected, stored, used, and deleted. The law has been in force since its promulgation on 17 October 2022 (Article 76). The two-year transition period in Article 74 ended on 17 October 2024. Its implementing regulation, Government Regulation (Peraturan Pemerintah, PP) No. 33 of 2026, takes effect in January 2027.

The UU PDP also binds government offices. Article 19 names public bodies as personal data controllers and processors. Public bodies include executive institutions and other bodies funded wholly or partly from the APBN or APBD (the state and regional government budgets) (Article 1 point 9). Data kept in paper record books is covered as well (Article 1 point 1).

Terms you need to know

• Personal data is data about a person that can identify who they are, on its own or combined with other information (Article 1 point 1).
• Specific personal data covers health data, biometric data such as fingerprints and facial images, genetic data, criminal records, children's data, personal financial data, and other data as set by regulation (Article 4(2)). Processing it counts as high risk, so the controller must assess its impact, meaning the risks it creates and how to reduce them (Article 34).
• A personal data controller is the party that decides the purpose of processing and controls it (Article 1 point 4). Here, that is your village office, school, or agency.
• A personal data processor is a party that processes data on the controller's behalf (Article 1 point 5), for example a software vendor or a server provider.
• A personal data subject is the person whose data is processed (Article 1 point 6), for example residents, pupils, and pupils' parents.

The main duties of a data controller

Have a basis for processing

The controller must have a basis for processing. Article 20 lists six bases, and the data owner's consent is only one of them. Two other bases relate directly to an agency's work: meeting a legal obligation (letter c), and performing a task in the public interest, providing a public service, or exercising authority under regulations (letter e). For children's data, Article 25(2) requires the consent of a parent or guardian in accordance with the laws and regulations.

Use data only for its purpose

Data must be processed in a limited and specific way, lawfully, and transparently (Article 27), and in line with its purpose (Article 28). For example, parents' mobile numbers collected when new pupils enrol are not passed to others for marketing.

Keep data secure and confidential

The controller must take technical measures to protect data, with a level of security that matches the nature of the data and its risks (Article 35), keep data confidential (Article 36), and prevent unauthorised access (Article 39). In a small office, this means, for example, a separate account for each staff member, passwords that are not shared, and spreadsheet links that are not open to the public.

Record processing activities

The controller must record all personal data processing activities (Article 31). PP 33/2026 sets out what the record contains, including the basis and purpose of processing, the types of data, who can access it, how long the data is kept, and the security measures (Article 74(2)).

Give notice within 3 x 24 hours of a data breach

If personal data protection fails, for example when data is disclosed, lost, or accessed without authorisation, the controller must notify the data owners and the supervisory authority in writing within 3 x 24 hours at the latest (Article 46(1) and its elucidation). The notice must state at least which data was disclosed, when and how it was disclosed, and the steps taken to handle the incident and recover (Article 46(2)). If the incident disrupts public services or has serious consequences, the public must also be informed (Article 46(3)).

Appoint a data protection officer

A controller that processes data for public services must appoint a personal data protection official or officer, from inside or outside the agency (Article 53). Constitutional Court (Mahkamah Konstitusi) Decision No. 151/PUU-XXII/2024 confirms that this public service condition is enough on its own. It does not have to be met together with the other conditions in that article.

If you use a software vendor

A vendor that stores or handles data for you is a processor. The vendor must act on your instructions, and its processing remains your responsibility as the controller (Article 51(1) and (3)). The vendor needs your written approval before bringing in another processor (Article 51(5)). If the vendor processes data outside the instructions and purposes you set, the responsibility passes to the vendor (Article 51(6)).

PP 33/2026 also sets out the minimum content of an agreement with a processor, including the scope and method of processing, the types of data, the duration, and the arrangements for supervision and audit (Article 14).

What to ask the vendor

1. Where is the data stored (an office server, the vendor's server, or a cloud service), and in which country? Transferring data outside Indonesia is subject to extra conditions (Article 56).
2. Who can open residents' data, including the vendor's staff and the server provider?
3. How often are backups made, where are they kept, and how long does recovery take if the server fails?
4. When the contract ends, is the data returned in a format that other applications can open, and are the copies on the vendor's server deleted, with written proof?
5. How quickly will the vendor report a data breach? The 3 x 24 hour limit applies to you, and PP 33/2026 requires the processor to report to the controller at the first opportunity (Article 118).

Put the answers in a written agreement. Applications made by HanzCodes can be installed on the agency's own server. Details are on the Services page.

Status of the implementing regulation and the supervisory authority

PP 33/2026 on the Implementation of Law 27/2022 was enacted and promulgated on 16 July 2026, and it takes effect six months after promulgation (Article 225).

The supervisory authority is established by the President and regulated by a Presidential Regulation (Article 58). As of 10 October 2026, we had not found that Presidential Regulation in the official regulation databases. At a Constitutional Court hearing on 27 July 2026, the government stated that the draft had been submitted to the President and that, for the time being, the Ministry of Communication and Digital Affairs (Kementerian Komunikasi dan Digital) carries out the personal data protection function through its Directorate General of Digital Space Supervision.

Sanctions

Breaches of the duties above carry administrative sanctions (Article 57(1)): a written warning, temporary suspension of processing, deletion or destruction of data, and/or an administrative fine of up to 2 percent of annual income or revenue against the violation variable (Article 57(2) and (3)). The supervisory authority imposes these sanctions.

The criminal provisions require a deliberate act. Article 67 sets a prison term of up to 5 years for anyone who unlawfully obtains, collects, or uses personal data that does not belong to them, and up to 4 years for anyone who discloses it. For obtaining or collecting, there must be an intent to benefit oneself or another person that may cause loss to the data owner. Article 68 sets a prison term of up to 6 years for anyone who creates false personal data or falsifies it with a similar intent, which may cause loss to others.

These prison terms come with "dan/atau" (and/or) a fine. Since 2 January 2026, the fine amounts follow the fine categories of the Criminal Code (KUHP) under Law No. 1 of 2026 on Criminal Penalty Adjustment (Penyesuaian Pidana): at most category IV (IDR 200 million) for Article 67 and category V (IDR 500 million) for Article 68.

This article is a summary, not legal advice. For specific decisions, refer to the text of Law 27/2022 in the BPK legal database (JDIH BPK) (external site) and PP 33/2026, and consult the competent official or unit, for example the regional government's legal department, the APIP (the government's internal auditors), or the village facilitator (pendamping desa).