Implementation of the 2026 Personal Data Protection Act: What Institutions and Corporations Need to Prepare

The establishment of the Personal Data Protection Agency is targeted for completion in 2026, following a two-year delay from the mandate set forth in Law No. 27 of 2022. Every government institution and private corporation needs to begin preparing internal compliance measures as well as communication strategies regarding this sensitive issue.

Current Implementation Status

Director General of Digital Space Supervision at the Ministry of Communication and Digital Economy (Kemkomdigi), Alexander Sabar, stated that the government is drafting a Presidential Regulation on the Personal Data Protection Agency (PDP), which will serve as the implementing body for the law’s provisions. Discussions are proceeding at the harmonization stage and are targeted for completion by 2026.

Interim Oversight Functions by Kemkomdigi

Until the PDP Agency is established, Kemkomdigi is carrying out oversight functions proactively and reactively through inspections of the electronic systems of registered Electronic System Operators (PSEs). The completion of PDP implementation measurement tools is also carried out by the PSEs.

Risks for Non-Compliant Institutions

More than 60 percent of companies in Indonesia have not yet fully complied with the PDP Law, while data breach cases continue to rise significantly. Article 58 of the PDP Law mandates the establishment of this agency no later than two years after the law takes effect.

Preparatory Steps for Your Institution

• Conduct an inventory of the personal data managed by the institution.

• Appoint a Data Protection Officer (DPO).

• Develop a privacy policy and incident response procedures.

• Train all staff who access personal data.

• Prepare a crisis communication plan in the event of a data breach.

The Role of Communication in PDP Compliance

Compliance with the PDP Law is not merely a technical and legal matter, but also a matter of public trust. PT Cakti Media Indonesia assists institutions in developing compliance communications, easy-to-understand privacy policies, and data breach crisis communication protocols.

Sources

• ANTARA Jatim, “Kemkomdigi Aims to Complete the Formation of the Data Protection Agency by 2026,” May 17, 2026

• Kompasiana, “Implementation of the Data Protection Act in Indonesia and Policy Developments,” July 18, 2025

• CNBC Indonesia, “Two Years Late, Komdigi Promises Data Protection Agency for Indonesian Citizens to Be Established by 2026,” February 3, 2026

• PRIN Journal, “Stalemate in the Formation of the Personal Data Protection Agency,” February 18, 2026