Indonesia's Personal Data Protection Law: what it means for cookies

What is Indonesia's PDP Law?

Law No. 27 of 2022 on Personal Data Protection, known as the UU PDP, is Indonesia's first general data protection law. It was enacted and took effect on 17 October 2022. Article 74 gave controllers, processors and other parties two years from enactment to bring their processing into line, so the law has applied in full since 17 October 2024. Existing sector rules on personal data, such as those under the electronic systems regulations, remain valid where they do not conflict with it (Article 75).

The law left a lot to implementing rules. Government Regulation No. 33 of 2026 on personal data protection, enacted and promulgated on 16 July 2026, details the obligations of controllers and processors, data subject rights, transfers abroad and administrative sanctions. It takes effect six months after promulgation, on 16 January 2027. The agency that is meant to supervise the law is still missing: on 22 July 2026 the Ministry of Communication and Digital Affairs (Komdigi) said the government was finalizing a Presidential Regulation for an independent personal data protection authority that would report to the President through the ministry, and press reports in September 2026 described it as still pending.

Who does the law apply to?

Article 2 applies the law to any person, public body or international organization that carries out legal acts regulated by it, whether in Indonesia or outside Indonesia when the act has legal effect in Indonesia or on Indonesian citizens abroad. A foreign website or app that processes the personal data of people in Indonesia falls within that wording. Processing by individuals for personal or household activities is excluded. There is no size threshold.

Do cookies need consent in Indonesia?

The law does not mention cookies. It applies to them when they process personal data, meaning data about an individual who is identified or identifiable, directly or indirectly, alone or combined with other information, through electronic or non-electronic systems. Article 20 requires every controller to have a legal basis and lists six:

1. explicit valid consent for one or more specific purposes communicated to the person;
2. performance of a contract to which the person is a party, or steps at the person's request before one;
3. a legal obligation of the controller;
4. protection of the person's vital interests;
5. a task in the public interest, a public service or the controller's legal authority;
6. other legitimate interests, taking into account the purpose, the need and the balance between the controller's interests and the person's rights.

Strictly necessary cookies can rely on the contract or on legitimate interests, with information. Advertising and cross-site tracking cookies are hard to justify on legitimate interests, so consent is the safer basis. Before relying on consent, the controller must tell the person the legal basis and purpose of the processing, the type and relevance of the data, the retention period, the processing period and the person's rights (Article 21).

What must consent look like?

Article 22 requires consent to be written or recorded, and it can be given electronically. Where the request also covers other matters, it must be clearly distinguishable from them, in an understandable and accessible format, and in simple and clear language. Consent that does not meet these conditions is void, and a contract clause that asks for processing without explicit valid consent is also void (Article 23). Article 24 requires the controller to show proof of the consent it relies on. Processing children's personal data needs the consent of a parent or guardian (Article 25). Government Regulation No. 33 of 2026 adds, according to published summaries, a duty to provide consent mechanisms and to keep evidence of consent, and steps to identify child users and verify parental consent.

How are transfers abroad regulated?

Article 56 allows a controller to transfer personal data to controllers or processors outside Indonesia in three tiers. First, the controller must ensure the recipient's country has a level of protection equal to or higher than the law's. If not, it must ensure there is adequate and binding protection, such as contractual safeguards. If neither is possible, it must obtain the person's consent. Government Regulation No. 33 of 2026 details the procedure.

Who enforces the law, and what are the penalties?

Under Articles 58 to 60, the agency set by the President will make policy, supervise compliance, enforce administrative law and facilitate out-of-court dispute settlement. Administrative sanctions under Article 57 are a written warning, temporary suspension of processing, deletion or destruction of data, and an administrative fine of up to 2% of annual revenue or receipts relative to the violation, imposed by the agency. Because the agency did not yet exist when this page was written, no administrative fine had been imposed under the law.

Criminal penalties already apply through the courts. Unlawfully obtaining, collecting or using another person's personal data to benefit oneself or others carries up to 5 years in prison and a fine of up to IDR 5 billion, unlawful disclosure up to 4 years and IDR 4 billion, and falsifying personal data up to 6 years and IDR 6 billion (Articles 67 and 68). Corporations can be fined up to 10 times those maximums and have their business frozen or closed (Article 70).

What should a website serving Indonesia do?

• List the cookies and tags that process personal data; the cookie scanner gives a first inventory.
• Choose a legal basis for each purpose, and ask for explicit consent for advertising and tracking cookies.
• Keep proof of consent, since Article 24 puts the burden on the controller.
• Review transfers to analytics and ad vendors abroad against the three tiers of Article 56 before 16 January 2027.

Indonesia is not in Cookiequiet's default list of regulated countries, but geo-targeting is free on every plan, so you can add Indonesia to a custom list. Visitors there then see the opt-in banner with Reject all, and the consent log keeps the record of each choice. The banner's 24 languages do not yet include Indonesian, and every string is editable per language. See also Singapore, the Philippines and the GDPR.