Implementation of the 2026 Personal Data Protection Act: What Institutions and Corporations Need to Prepare
Implementation guidelines for the 2026 Personal Data Protection Act, including the establishment of the Personal Data Protection Agency. Prepare compliance communications in collaboration with PT Cakti Media Indonesia.
The establishment of the Personal Data Protection Agency is expected to be completed by 2026, following a two-year delay from the timeline set forth in Law No. 27 of 2022. Every government agency and private corporation needs to begin preparing internal compliance measures as well as communication strategies regarding this sensitive issue.
Current Implementation Status
Alexander Sabar, Director General of Digital Space Oversight at the Ministry of Communication and Digital Economy (Kemkomdigi), stated that the government is drafting a Presidential Regulation on the Personal Data Protection Agency (PDP), which will be responsible for implementing the provisions of the law. Discussions are continuing at the harmonization stage and are expected to be completed by 2026.
Interim Oversight Function by the Ministry of Communication and Digital Technology
Until the PDP Agency is established, the Ministry of Communication and Digital Economy carries out its oversight functions—both proactively and reactively—by inspecting the electronic systems of registered Electronic System Operators. The completion of the PDP implementation assessment tool is also carried out by the Electronic System Operators (PSE).
Risks for Institutions That Are Not Yet Compliant
More than 60 percent of companies in Indonesia have not yet fully complied with the PDP Law, while data breaches continue to rise significantly. Article 58 of the PDP Law mandates the establishment of this agency no later than two years after the law takes effect.
Preparatory Steps for Your Institution
Conduct an inventory of the personal data managed by the institution.
Appoint a Data Protection Officer.
Develop a privacy policy and incident response procedures.
Train all staff who access personal data.
Prepare a crisis communication plan in the event of a data breach.
The Role of Communication in PDP Compliance
Compliance with the Personal Data Protection Act (PDP Act) is not merely a technical and legal matter, but also a matter of public trust. PT Cakti Media Indonesia helps institutions develop compliance communications, easy-to-understand privacy policies, and crisis communication protocols for data breaches.
Sumber
ANTARA Jatim, "Kemkomdigi Targetkan Pembentukan Badan PDP Rampung 2026", 17 Mei 2026
Kompasiana, "Penerapan UU PDP di Indonesia dan Perkembangan Kebijakan", 18 Juli 2025
CNBC Indonesia, "Telat 2 Tahun, Komdigi Janji Badan Penjaga Data Warga RI Berdiri 2026", 3 Februari 2026
Jurnal PRIN, "Kebuntuan Pembentukan Lembaga Pelindungan Data Pribadi", 18 Februari 2026
Jl. Bintaro Utara Blok B1 No.21, RT.11/RW.8, Bintaro, Kec. Pesanggrahan, Kota Jakarta Selatan, Daerah Khusus Ibukota Jakarta 12330