UU PDP and Your Business Software: A Practical Checklist for Indonesian Companies

Law No. 27 of 2022 on Personal Data Protection, usually called UU PDP, came into force in October 2022 with a two-year transition period that ended in October 2024. Since then, any company that collects names, phone numbers, KTP numbers, addresses or salary data is expected to handle them according to the law. That covers almost every business with a customer list or a payroll.

Most of the work is not legal paperwork. It is in your software: where data is stored, who can see it, how long it is kept and what happens when something goes wrong. This article walks through the practical side. It is not legal advice, and you should confirm the details with a lawyer for your situation.

What counts as personal data

UU PDP splits personal data into two groups:

• General data, such as full name, gender, nationality, religion, marital status, and any combination of data that identifies a person, like a phone number plus an address.
• Specific data, which carries higher risk: health information, biometric data, genetic data, criminal records, children's data and personal financial data.

Salary slips, bank account numbers and BPJS details in an HR system sit in the sensitive end of that list, so payroll and HR tools deserve the strictest controls.

Where personal data hides in a typical business

• CRM and sales pipelines: names, phone numbers, emails, purchase history.
• POS and e-commerce: delivery addresses, order history, sometimes KTP photos for credit or rental.
• WhatsApp chats and exported spreadsheets that sit on staff laptops.
• HR and payroll: KTP, NPWP, family details, salary, bank accounts, medical leave notes.
• Backups and test databases that are full copies of production.

The spreadsheets and backups are usually the weakest point, because nobody thinks of them as a system.

What the law expects, in plain terms

1. A lawful basis. Consent is one basis, but so are fulfilling a contract, meeting a legal obligation and legitimate interest. You should know which one applies to each kind of data you collect.
2. Purpose limitation. Data collected to deliver an order should not quietly become a marketing list.
3. Limited retention. Keep data only as long as the purpose, or another law, requires.
4. Data subject rights. People can ask to access, correct or delete their data, withdraw consent and object to some automated decisions.
5. Security. Reasonable technical and organisational measures to prevent leaks and unauthorised access.
6. Breach notification. If data leaks, the affected people and the authority must be notified in writing within 3 x 24 hours, stating what data was exposed, when and how, and what is being done about it.
7. Vendors. If a developer, hosting provider or SaaS tool processes data for you, they act as your processor and should be bound by a contract.

Penalties include administrative sanctions, from written warnings to fines of up to 2% of annual revenue. Unlawfully collecting, disclosing or using someone else's personal data is also a criminal offence, with prison terms of up to four to six years and fines of up to Rp4 to 6 billion for individuals. Corporate fines can be up to ten times higher.

The implementing regulation is here

The detailed rules arrived this year. Government Regulation (PP) No. 33 of 2026 was promulgated on 16 July 2026 and takes effect on 16 January 2027. It sets out obligations for data controllers and processors in more detail, including data protection impact assessments, data protection officers, cross-border transfers and administrative sanctions. It also clarifies that the 3 x 24 hour breach clock starts once a failure has been established, based on evidence such as system logs or a forensic report.

The supervisory agency, the Lembaga PDP, had not been fully formed as of October 2026. Legal advisers are clear that this is no reason to wait: the law's obligations already apply, and companies have until January 2027 to get ready for the PP.

A checklist for your systems

• Data inventory. List which systems hold which personal data, why, and for how long.
• Recorded consent. Where consent is your basis, store what the person agreed to, when, and which version of the text they saw.
• Role-based access. A cashier does not need the full customer export; a sales rep does not need salaries.
• Audit logs. Record who viewed, exported or changed sensitive records.
• Encryption. HTTPS everywhere, encrypted databases and encrypted backups.
• Retention jobs. Scheduled tasks that delete or anonymise old records instead of relying on someone to remember.
• Access and deletion requests. A way to export one person's data, and to delete it without breaking invoices you must legally keep.
• Breach detection. Alerts for unusual logins and mass exports, so you can meet the notification deadline at all.
• Clean test data. Developers should work with dummy or masked data, not a copy of production.

Where to start

Do the inventory first. Most companies find two or three places with far more personal data than they expected, usually exports and old backups. Fix access and retention there, then move to consent records and request handling. If you are building or replacing a system anyway, ask for these features in the brief instead of retrofitting them later.

Need help reviewing how your CRM, POS or HR system handles personal data, or building the missing pieces? Get in touch with CodeWorks and we can map it out together.