PP 33/2026: What It Means for AI Projects

Government Regulation No. 33 of 2026 (PP 33/2026) is the implementing regulation for Indonesia's Personal Data Protection Law (PDP Law, Law No. 27 of 2022). It was promulgated on 16 July 2026 and takes effect on 16 January 2027. For system integrators, software houses, and AI builders, the impact is direct: clients will start asking about DPIAs, sub-processor lists, data processing locations, and human review paths in every AI project.

This article is for teams building AI solutions for enterprise clients in Indonesia: customer service chatbots, document processing, computer vision, scoring, or internal AI agents. The goal is practical, to have the answers ready before those questions land in the next RFP.

What is PP 33/2026 and when does it take effect?

PP 33/2026 contains 225 articles across 12 chapters. It operationalizes the PDP Law's obligations: lawful basis for processing, data subject rights, data protection impact assessment (DPIA), personal data protection officers (PPDP), cross-border data transfers, and administrative sanctions. Article 225 sets its effective date at six months after promulgation, which is 16 January 2027.

The PDP Law sets what must be done. PP 33/2026 defines how those obligations are executed and how organizations must prove they were. For AI projects, the keyword is evidence: documents, processing records, and decision trails that can be inspected.

Why this is a system integrator issue, not only the client's legal team

Under the PDP Law framework, the client is usually the Personal Data Controller. When a team builds and operates an AI system that processes the client's customer or employee data, its position is generally Personal Data Processor. Every third-party service in the architecture, such as a language model API, a SaaS vector database, an observability service, or a GPU cloud provider, can act as a sub-processor.

PP 33/2026 makes this relationship more formal. Processor appointment agreements must contain a minimum set of terms, and the use of sub-processors requires the controller's written consent (Articles 14 and 15). Processors must also report data protection failures to the controller at the first opportunity.

In practice, architecture choices that were once internal technical decisions now need to be explained, agreed on, and documented together with the client.

Five questions that will appear in AI project RFPs

1. Does this project require a DPIA?

Most likely, yes. PDP Law Article 34 mandates an impact assessment for high-risk processing. PP 33/2026 details what counts as high risk (Articles 120 to 122), including automated decisions with significant impact, large-scale processing, profiling or scoring, and the use of new technology. The regulation's Explanatory Notes name artificial intelligence and machine learning as examples of new technology.

The DPIA is the controller's obligation, but its content depends on information from the building team: what data enters the model, where it is processed, how long it is stored, and which controls apply. A team that can hand over that information in a clean format clears evaluation faster.

2. Who are the sub-processors in the architecture?

Build the list now, before a client asks for it. A single simple RAG application can involve many services: document storage, an embedding model, a vector database, a language model, logging, monitoring, and backup. Every service needs to be recorded, including its processing location.

3. Where is data processed, including prompts and logs?

This is the question most often answered too quickly. Source data may be stored in Jakarta, but a prompt containing customer data can be sent to a model API abroad, and conversation logs can end up in a monitoring service in another region.

PDP Law Article 56 governs the transfer of personal data outside Indonesian jurisdiction. PP 33/2026 sets a tiered mechanism (Article 165): first, a destination country with an equivalent level of protection; then, adequate and binding safeguards such as standard contract clauses; then, data subject consent under strict conditions. Before any transfer, the controller must run a risk assessment (Articles 162 to 164).

As of late September 2026, the Personal Data Protection Agency has not yet been established. The list of equivalent countries, standard contract clauses, and risk assessment guidance are not yet available. Using a model API abroad does not automatically violate the rules, but its compliance path currently carries the most uncertainty. Processing data inside the country is the option with the fewest open questions. For the practical side of connecting customer data to an LLM, see also Using an LLM on customer data, what Indonesia's PDP Law requires.

4. How can an automated decision be reviewed by a human?

PDP Law Article 10 gives data subjects the right to object to decisions based solely on automated processing. PP 33/2026 clarifies the objection procedure, including human intervention as a remedy. If a system scores credit, filters candidates, or approves claims, the client needs an escalation path to a human that actually works, not just a button in the interface.

For banking clients, this principle aligns with OJK's AI Governance framework for the Indonesian banking sector, which emphasizes accountability, human oversight, and reliability across the AI lifecycle.

5. If an incident occurs, how fast can it be reported?

PDP Law Article 46 requires the controller to notify affected data subjects and the Agency within at most 3 x 24 hours after a personal data protection failure. Because the controller depends on the processor's report, the incident runbook needs to move faster than that window. Make sure access logs, prompt trails, and configuration change records are available and traceable.

Architecture decisions and the obligations attached to them

Architecture decision	Related obligation	What to prepare
Choosing a language model API	Sub-processor, cross-border transfer	Processing location, written client consent
Storing documents and embeddings	Data security, retention	Storage location, retention policy, encryption
Logging prompts and responses	Processing records, incident handling	Log retention period, access controls, log location
Using AI for decisions about individuals	Right to object, DPIA	Human review path, documented decision logic
Using a SaaS monitoring service	Sub-processor, cross-border transfer	What data is sent and where

What is still uncertain?

PP 33/2026 delegates several technical provisions to Agency Regulations, including DPIA guidelines and standard contract clauses for data transfers. The agency itself is not yet operational. However, the PP's transitional provisions (Article 223) make clear that until those Agency Regulations are issued, processing remains subject to this PP.

The sensible posture is to build the foundation now and adjust the details as the downstream rules are issued. Waiting for full certainty means starting to prepare only after the deadline has passed.

Delivery team checklist before 16 January 2027

1. Inventory all active AI projects that process client personal data.
2. Map the data flow per project, including prompts, embeddings, logs, and backups.
3. Build the sub-processor list with processing locations, then obtain the client's written consent.
4. Prepare the DPIA information package for the client: purpose, data types, location, retention, and security controls.
5. Build a human review path for every automated decision that affects individuals.
6. Write an incident runbook with a reporting target to the client well under 3 x 24 hours.
7. Update proposal and contract templates so the questions above are answered upfront.

Where IONext fits

IONext is sovereign AI infrastructure hosted in Indonesia. For projects that process personal data, IONext provides GPU compute, managed inference through an OpenAI-compatible API, and open-weight model hosting, with processing and storage in Jakarta. PT Data Awan Nusantara, IONext's operator, is certified to ISO/IEC 27001:2022 by TÜV NORD (Certificate No. 01 07 E 26000410). Certification details and IONext's position on the PDP Law are on the Security and Compliance page.

The boundary needs to be stated honestly. Onshore infrastructure simplifies the questions of location and data transfer, but it does not make a project automatically compliant. DPIA obligations, lawful basis for processing, and fulfilling data subject rights remain with the controller and must be executed properly. Teams can sign up and try ORBIT, the workspace for building and monitoring AI infrastructure, together with IONA, the operational intelligence layer that reads production conditions and recommends the next step. System integrators taking this kind of project to bank, BUMN or government clients can work with IONext through the IONext Partner Program for system integrators.

Frequently asked questions

When does PP 33/2026 take effect? 16 January 2027, six months after its promulgation on 16 July 2026.

Is using an overseas LLM API prohibited? Not automatically. Cross-border transfer of personal data is allowed with conditions, but its supporting instruments, such as the list of equivalent countries and standard contract clauses, have not been issued yet because the Data Protection Agency is not yet established.

Is an ISO/IEC 27001 certification enough to meet PP 33/2026? No. ISO/IEC 27001 strengthens information security, but PDP compliance also covers lawful basis, data subject rights, DPIA, and documentation that must be mapped separately.

Sources

• Law No. 27 of 2022 on Personal Data Protection
• Government Regulation No. 33 of 2026 implementing Law No. 27 of 2022 (State Gazette of the Republic of Indonesia 2026 No. 88)
• OJK, AI Governance Framework for the Indonesian Banking Sector
• Kompas.id, Implementing regulation for the PDP Law finally issued, supervisory agency still awaited
• CNBC Indonesia, Much of Indonesian citizen data is stored abroad, experts warn on this

This article is a general explanation and not legal advice. For compliance needs, refer to the official text of the regulation and consult a legal advisor.