PP 33/2026 is ten weeks away: the evidence you need ready
From 16 January 2027, PP 33/2026 obligations apply and will be checked through evidence. A six-week order of work for hospitals that have not started.
In September we wrote about five tasks for hospitals under PP 33/2026. The date it takes effect, 16 January 2027, is now about ten weeks away. The question is no longer “what is required” but which documents you can show when someone asks.
The order of work below takes about six weeks. Treat the remaining time as room to close the gaps you find along the way, not as a reason to start later.
Obligations framed as records, policies, and assessments can only be proven with documents. Good intentions without documents cannot be shown.
Weeks 1–2: list your systems and record processing
List every place patient data lives: HMS, laboratory, PACS, queue apps, WhatsApp, email, backup storage. For each system, fill in the processing record required by Article 74, including: purpose, basis, data types, parties who can access the data, data-flow mapping, transfer details, retention period, security measures, and the data protection officer’s contact. Ask each vendor, acting as a processor, to send its own record.
Evidence: one processing record covering every system, dated and signed.
Week 3: retention policy
Medical records follow the medical-records retention rules. What tends to be forgotten is everything else: access logs, CCTV footage, job applicants’ files, and customer-service conversations. Set their retention periods in writing (Article 75), and make sure a person or a system actually carries out the deletion.
Evidence: a written retention policy, with a record of who carries it out.
Week 4: the 3×24-hour path for patient requests
Test the path with one mock request: a patient asks for a copy of their data. Record who receives the request, how the patient’s identity is verified, when the confirmation and estimated delivery time are sent, and when the copy is handed over. The confirmation is due within 3×24 hours of the request being received and verified, and the copy is then delivered at the first opportunity (Article 78). For access and correction requests, the 3×24-hour limit applies to fulfilling them (Articles 71 and 77). All of it counts in hours, not working days.
Evidence: a written procedure and a record of the test.
Week 5: incident drill
Run one tabletop exercise: a laptop containing patient data goes missing. Who decides that this is a personal-data protection failure? Who drafts the notification? Can it all be done within 3×24 hours (Article 114)? Written notice goes to the patient and to the Agency. Until the Agency exists its function is carried out by the Ministry of Communication and Digital Affairs, so set that reporting channel in the procedure. If the incident disrupts services, the public must be told as well (Article 115).
Evidence: minutes of the drill and the fixes agreed.
Week 6: impact assessments for upcoming systems
An impact assessment is carried out before processing starts (Article 121). If a new system is planned to go live in 2027, such as a patient app or a new integration, start its assessment now.
Evidence: an impact assessment for each new system.
Status as of 8 November 2026
The Personal Data Protection Agency has not been formed. The draft Presidential Regulation establishing it is final and has been submitted to the President through the State Secretariat (ANTARA, 4 November 2026). Until the Agency exists, its function is carried out by the Ministry of Communication and Digital Affairs, and the detailed procedure for breach notifications (Article 119) is still waiting for an Agency Regulation.
A note on sources. As of 8 November 2026 the official copy of PP 33/2026 is not yet available on peraturan.go.id or the BPK legal database. The article numbers here are checked against the text copies circulating in legal databases, and we will check them again once the official copy is published. One database records the promulgation date as 15 July 2026 rather than 16 July. If that is correct, the obligations apply one day earlier, so have the evidence ready before 15 January.
Our position
As a processor, we hand over processing records and technical-control documentation for Adievia’s systems to any hospital that asks. The legal decisions remain the hospital’s as controller. This article is not legal advice.