PP 33/2026 takes effect 16 January 2027: five tasks for hospitals

UU 27/2022 on Personal Data Protection has been in force since it was promulgated on 17 October 2022, and its two-year adjustment period ended in October 2024, but many of its obligations felt vague: “must protect”, “must notify”, with no yardstick. PP 33/2026 changes that. The implementing regulation was promulgated on 16 July 2026 and takes effect on 16 January 2027 (Article 225: six months after promulgation).

Hospitals process health data, which counts as specific personal data. For patient data, the hospital is the controller; its system vendor is generally a processor. Here are five tasks worth starting now.

1. Record every processing activity

Article 74 requires controllers to record their personal data processing activities — including purpose, basis, data types, parties who can access the data, data-flow mapping, transfer details, retention period, and security measures — and to update the record when anything changes. Controllers must also ensure their processors keep records. Start with a list of systems: HMS, laboratory, PACS, queue apps, WhatsApp, email, and backup storage.

2. Set a retention policy

Article 75 requires a written retention policy. For medical records, retention follows the medical records rules; for everything else — access logs, CCTV footage, job applicant data, customer service conversations — the hospital itself must set and enforce the periods.

3. Build a 3×24-hour path for data subject requests

A patient’s request to correct their data (Article 71) or access it (Article 77) must be fulfilled within 3×24 hours of receipt — hours, not working days. For a copy of the data, the hospital must confirm the request and state how long it will take within 3×24 hours of receiving and verifying it, then hand over the copy at the first opportunity (Article 78). Decide who receives requests, how identity is verified, and how the deadline is tracked.

4. Assess impact before processing

High-risk processing — including processing health data — requires a personal data protection impact assessment (Article 120), carried out before the processing starts (Article 121). A new system launched next year without one starts out non-compliant.

5. Rehearse the incident procedure and check transfers abroad

A personal data protection failure must be notified in writing to the patient and the Agency within 3×24 hours of becoming known (Article 114). If the incident disrupts a public service, the public must be told as well (Article 115). Procedures that have never been rehearsed rarely finish in 72 hours. Also review services that store data outside Indonesia — email, instant messaging, cloud services — because transfers abroad need a lawful basis, and consent cannot be used for recurring transfers (Article 173).

What does not exist yet

The Personal Data Protection Agency that will supervise and impose administrative sanctions has not been formed. The draft Presidential Regulation establishing it was harmonised and submitted to the President for enactment by a letter from the Minister of Administrative Reform dated 20 May 2026; in the meantime the data-protection function is carried out by the Ministry of Communication and Digital Affairs through its Directorate General of Digital Space Supervision (Kompas, 27 July 2026). As of 4 November 2026, the ministry said the draft was final and had been submitted to the President through the State Secretariat, but it has not been enacted. The ministry has also set up a special task force to oversee personal-data incidents during the transition (ANTARA, 4 November 2026).

Details of some obligations are waiting for that agency too. The procedure for breach notifications (Article 119) and for consent to transfers abroad (Article 174) will be set by Agency Regulations, which can only be issued once the Agency exists. That is no reason to wait: the obligations apply from 16 January 2027, and the evidence — records, policies, assessments — has to exist when someone asks.

Our position

We do the same work for Adievia’s own systems: processing records, a retention policy the system enforces automatically, and a privacy policy that names every transfer abroad. As a processor, we provide technical controls and supporting documentation for hospitals — the legal decisions remain the hospital’s as controller. This article is not legal advice.

Follow-up: PP 33/2026 is ten weeks away: the evidence you need ready. A note on sources: as of 8 November 2026 the official copy of PP 33/2026 is not yet available on peraturan.go.id or the BPK legal database; the article numbers here are checked against the text copies circulating in legal databases.

More: data security and PDP Law guide.