The framework
The operative statute in Indonesia is the Personal Data Protection Law (Law 27/2022), enforced by the PDP supervisory agency mandated by law, still not established.
For media planning that means an opt-in posture, with consent capture built before campaigns launch.
Key instruments
Personal Data Protection Law (Law 27/2022)
Indonesia's PDP Law became fully applicable in October 2024, and its long-awaited implementing regulation, Government Regulation 33 of 2026, was issued in mid-2026 to apply six months after promulgation, with detail on transfers, impact assessments and data protection officers. The dedicated supervisory agency still does not exist, so enforcement stays with the digital ministry for now.
Marketing and advertising
GDPR-style bases including consent, contract and legitimate interests, but explicit consent dominates commercial practice; Indonesian-language consent requirements apply. Treat the consent note above as the planning rule; the penalty line below is what mispricing it costs.
Cross-border transfers
Adequacy first, then safeguards, then consent, the order the PDP Law and its 2026 implementing regulation set; sectoral localization persists for public-sector and some regulated data.
Enforcement and penalties
Administrative fines up to 2% of annual revenue plus corporate criminal liability for misuse.