Fashion brands’ readiness in personal data protection is entering a new chapter. Indonesia has officially issued Government Regulation Number 33 of 2026 on the Implementing Regulation of Law Number 27 of 2022 on Personal Data Protection (GR 33/2026). GR 33/2026 addresses several issues in Law Number 27 of 2022 (PDP Law) that have so far been implemented without technical details, creating a number of questions and uncertainties.

The issuance of GR 33/2026 is still not widely known. Althought this regulation was enacted on 16 July 2026, it has not yet been made public and has only been circulated internally to a number of business actors and legal practitioners. The copy of GR 33/2026 that I obtained is still in the form of a scanned copy, and not the official text issued by the Government. Nevertheless, this does not in any way diminish the legitimacy GR 33/2026’s validity.

GR 33/2026 will only come into effect on 16 January 2027 (6 months after enactment). This regulation contains several additional principles and expands the landscape of the implementation of personal data protection. GR 33/2026 consist of 12 Chapters and 225 Articles; business actors, particularly fashion brands, are required to pay attention to: lawful basis for processing data, Data Protection Officer (DPO), Data Protection Impact Assessment (DPIA), cross-border data transfer, administrative fines, and dispute resolution. From these matters, the following is my analysis connecting GR 33/2026 with its specific impact on fashion brands in Indonesia.Lawful Basis for Processing of Data

Because the operational activities of a fashion brand are closely tied to personal data (through loyalty programs, consumer data and cooperation contracts with vendors, for example), GR 33/2026 affirms the legal basis for data processing already set out in the PDP Law. GR 33/2026 establishes a period of 3x24 hours for a fashion brand acting as a personal data controller to provide the following: (a) access to data; (b) correction or updating of data; (c) provision of copies; (d) deletion or destruction of data; (e) withdrawal of consent; (f) implementation or refusal postponement or restriction; and (g) notification, counted from the moment the request of the personal data subject is received and verified, or from the moment the reason for acceptance/refusal is submitted by the personal data controller. In addition, the personal data controller is obliged to carry out notification within 3x24 hours from the moment a failure of personal data protection is known with certainty, propriety, and reasonableness.

Furthermore, consent for data processing must meet four requirements, among others: (a) given freely, consciously, and unambiguously; (b) accompanied by concise and proportional preliminary information; (c) obtained either electronically or non-electronically; and (d) not obtained unlawfully. Lastly, in the interest of an agreement involving the data subject and for other legitimate interests (generally referred to as a Legitimate Interest(s) Assessment, or “LIA”), the controller is obliged to provide information clearly and concisely, to conduct a balancing analysis of interests between the controller and the subject, as well as to mitigate legal risks and losses that have an impact on the personal data subject.

Referring to the legal basis for data processing in GR 33/2026, a fashion brand, as a data controller, is obliged to pay attention to and integrate the entirety of the processing aspects into its internal policies as well as into operational activities related to the element of “personal data.”

Data Protection Officer (DPO)

Continuing the mandate under Constitutional Court Decision Number 151/PUU-XXII/2024, the appointment of a Data Protection Officer (DPO) is mandatory once a single personal data protection activity is met, whereas previously the requirements applied cumulatively. The activities in question are: (a) processing of data in the interest of public service; (b) core data protection activities which, by their nature, scope, or purpose, require regular and systematic monitoring of personal data on a large scale; and/or (c) activities that are large-scale in nature involving specific personal data and/or data related to criminal acts.

GR 33/2026 explains that the duties arising from the appointment of a DPO are, at minimum, to provide compliance advice, to monitor activities, to conduct impact assessments (DPIA), and to act as a liaison for the parties. In addition, in carrying out its obligations, the DPO so appointed has access to top management, evaluates matters objectively and independently, and operates free from conflict of interest. As for more specific competency criteria, GR 33/2026 delegates such provisions to its derivative regulations.

For fashion brands, the appointment of a DPO is generally intended to support the management of personal data in connection with periodic data-monitoring needs, such as loyalty-program channels, sales-activity management, optimization of the rights of personal data subjects, as well as contracts with third parties or other business activities.

Data Protection Impact Assessment (DPIA)

A Data Protection Impact Assessment (DPIA) is, in principle, already regulated within the PDP Law. GR 33/2026 merely reinforces and clarifies the details of the DPIA provisions in the PDP Law for high-risk data processors, particularly in the context of “large-scale activities.” The assessment of “large-scale activities” refers to the volume of data involved in the activity, number of data subjects, purpose of processing, the duration of processing, type of processing, as well as its geographical scope. No specific figure is set out in GR 33/2026.

GR 33/2026 also introduces what is referred to as “new technology” as one of the triggers for a DPIA. GR 33/2026 explicitly explains: the use of new technology in data processing such as artificial intelligence (AI), machine learning, smart technology, the internet of things (IoT), and so forth.

In my view, by not regulating a specific numerical standard for the volume of data subjects, this eliminates ambiguity and provides proportionality in the application of DPIA to data processing activities. For fashion brands, the implication of this provision places a limit on business activities, one example is marketing improvisation through AI Storefront strategies such as Generative Engine Optimization (GEO) or website integration using an AI Helper. Such activities must first go through a DPIA.

Cross-Border Data Transfer

The PDP Law regulates cross-border data transfer by dividing it into three main principles: equivalence of the level of protection, adequate and binding protection, as well as the consent of the data subject. However, because the technical implementation was not properly mapped out, cross-border data transfer in practice has created confusion and uncertainty.

GR 33/2026 now clarifies these three main principles into standards that are more technical and implementable. For equivalence of the level of protection, the controller is obliged to ensure that the destination country already has adequate personal data protection legal rules and is included in the list of countries determined by the DPA. For adequate and binding protection, GR 33/2026 establishes standard contractual clauses (SCC) also reffered to s the Data Protection Authorities (DPA). Then, for the consent of the personal data subject the controller is obliged to: obtain the consent of the personal data subject, ensure the transfer is carried out only once, and conduct a DPIA and inform the DPA and the personal data subject.

GR 33/2026 has clarified the rules on cross-border data transfer. An important note for fashion brands is that this provision must be interpreted in a tiered manner, and no part of it may be skipped. Based on my analysis, activities generally falling within the scope of this provision include international sales and marketing, integration of international payment systems, cloud hosting on global e-commerce websites (Shopee, Etsy, Shop App, etc.), as well as data consolidation with international corporate partnerships.

Documentation of Data Processing Activities

GR 33/2026 establishes the obligation of the controller to carry out documentation of data processing activities. Such documentation is carried out through two main instruments: a Register of Processing Activities (RoPA), which must be implemented by the controller with adequate components and must, at minimum, include the following: details of the controller/processor, purpose of processing, source of data collection, categories of data, retention period, legal basis, rights of the data subject, risk-mitigation measures, and to third-party access.

The controller/processor is obliged to carry out documentation separately, to verify and provide adequate and proportional technical evidence and information upon request, as well as to actively provide records to the DPA as well as to internal/external audit institutions. Accordingly, the controller is obliged to carry out documentation of activities through these two instruments by fulfilling the components set out in GR 33/2026.

For fashion brands, documenting each item of data plays an important role. To implement this, a fashion brand can apply a personal-data-protection work-scope matrix guideline in accordance with GR 33/2026, which has been aligned with the minimum components so that it can be implemented in every business activity.

Administrative Sanctions

GR 33/2026 contains four types of sanctions that may be imposed individually or jointly, and without being preceded by a written warning. The four types of sanctions are: written warning, temporary suspension of personal data processing activities, deletion/destruction of personal data, and administrative fines.

GR 33/2026 sets administrative fines ranging from 0% up to a maximum of 2%, calculated based on the annual income or annual revenue of the personal data controller/processor (important note: joint data controllers, or a controller and processor working together, bear joint and several liability for a failure of personal data protection). Furthermore, the administrative fine is determined based on 10 variables of violation, ranging from the negative impact and duration of the violation to other variables determined by the DPA.

In my view, the existence of these consideration variables allows fines to be applied while satisfying the principle of legal certainty and taking into account the good faith of the controller/processor in remedying the personal data violation. In addition, this is reinforced in GR 33/2026 itself: the DPA may exercise discretion to reduce the amount of the fine to as low as 0%, or IDR. 0., provided that the controller/processor can prove its good faith with respect to the violation/negligence in personal data protection that has arisen.

Dispute Resolution

GR 33/2026 provides that dispute may be resolved through internal mediation with the DPA, arbitration, court proceedings, or other alternative dispute resolution mechanisms, in accordance with the applicable procedural law. Furthermore, GR 33/2026 establishes a special mechanism for resolving personal data protection disputes: internal mediation with the DPA as the primary channel, followed only afterward by mediation through arbitration or other alternative dispute resolution, or litigation through the courts.

Resolution through internal mediation together with the DPA may be carried out if the parties, in good faith, report the dispute to the DPA. The reporting party is obliged to prepare, at minimum, a document with a framework consisting of five elements: (a) identity of the parties; (b) chronological summary; (c) a statement that there is no duplicate report; (d) evidence related to the issue that has arisen; and (e) the legal standing of the reporting party.

After such a document is submitted, the DPA will determine and provide a recommendation with three possible outcomes: (a) if a criminal element is found, the DPA will refer the matter to the police, accompanied by the DPA’s recommendation; (b) if an administrative-violation element is found, the DPA will consider and impose a sanction in accordance with GR 33/2026; and (c) if neither a criminal nor an administrative element is found, the DPA resolves the dispute between the parties.

Key Takeaways

GR 33/2026 (enacted 16 July 2026) will take effect on 16 January 2027, giving fashion brands roughly six months from enactment to prepare before enforcement begins.

Data subject requests (access, correction, copies, deletion, consent withdrawal, restriction) and data-breach notifications must both be handled within a strict 3x24-hour window, and consent must be free, informed, unambiguous, and obtained lawfully.

A Data Protection Officer (DPO) must now be appointed if a brand meets just one rather than all of the statutory trigger conditions, such as large-scale or systematic monitoring of personal data.

A Data Protection Impact Assessment (DPIA) is required for large-scale processing and, notably, for the adoption of “new technologies” such as AI, machine learning, and IoT, directly affecting AI-driven marketing tools like GEO-based storefronts and AI website helpers.

Cross-border data transfers (international sales, payment integrations, global e-commerce hosting, and cross-border partnerships) must satisfy a tiered set of requirements: destination-country adequacy, DPA-approved standard contractual clauses, and specific data-subject consent.

Controllers must maintain documented Records of Processing Activities (RoPA) and separate processor documentation, ready for production to the DPA or auditors on request.

Non-compliance can trigger one or more sanctions simultaneously, including written warnings, suspension of processing, data deletion, and administrative fines of up to 2% of annual revenue. The DPA, however, retains discretion to reduce fines where good faith is demonstrated.

Disputes are channeled first through internal mediation with the DPA before arbitration or litigation, making early, well-documented engagement with the DPA the most practical first line of defense.