Indonesia's Law No. 27 of 2022 on Personal Data Protection (UU PDP) was enacted on October 17, 2022, and its two-year compliance grace period under Article 74 expired in October 2024. Every controller and processor operating in Indonesia has been bound by its obligations for nearly two years. The institution meant to enforce those obligations — the Lembaga Pelindungan Data Pribadi, mandated by Article 58 — does not exist.
On July 21, 2026, Deputy Communications and Digital Minister Nezar Patria told reporters the presidential regulation (Perpres) establishing the authority was in its final stages and targeted for completion within roughly two months, putting the deadline near late September 2026. The draft has a long paper trail: it received presidential drafting clearance back on March 4, 2025, and was formally submitted to the President's desk on May 20, 2026, where it has sat awaiting signature for over three months. A companion regulation on administrative-fine procedures cleared State Secretariat review in December 2025 and is also waiting.
Why the delay is more than bureaucratic friction
There is a real case for taking time here. Standing up a genuinely independent regulator — one with investigative powers, cross-border enforcement authority, and the capacity to levy fines up to 2% of annual revenue under Article 57(3) — is not a rubber-stamp exercise. Indonesia is trying to avoid the trap several regional peers fell into: a data authority so thinly resourced or so captured by the ministry that appointed it that it enforces nothing. Patria's own framing gestures at this tension directly: the body will "work independently with its entire structure," he said, while still routing all reporting to the president through the Komdigi ministry — a structure his ministry is evidently trying to calibrate rather than rush.
But three years of drafting, and eleven months between presidential clearance and a signature that still hasn't come, is no longer calibration — it's a structural gap. Because the Lembaga PDP doesn't exist, the fine regime that gives the law teeth cannot be issued either: the flagship 2%-of-revenue penalty is inert until both the Perpres and its companion fine-procedure regulation are signed. In the interim, Indonesian authorities are enforcing data-related violations through older, weaker instruments — Kominfo Regulation 5/2020 on electronic system provider registration and the ITE Law's content-blocking powers — neither of which was built for data protection and neither of which carries anything like the PDP Law's fine authority.
The Constitutional Court is now in the mix
The delay has attracted litigation. On June 19, 2026, four petitioners — advocates and students, including Pardamean Sihombing and Eprina Manurung — filed petition No. 236/PUU-XXIV/2026 with the Constitutional Court, seeking judicial review of Articles 58(5) and 61 of the PDP Law. Their argument is that the government's failure to establish the mandated authority is itself unconstitutional, violating the legal-certainty principle in Indonesia's 1945 Constitution. Hearings have included expert and witness testimony; one witness, describing herself as a victim of a data breach, told the Court she had nowhere to report the incident because no authority existed to receive the complaint. The petitioners are asking the Court to order the government to establish the Lembaga PDP within a fixed two-year window.
That petition creates an awkward parallel-track problem. If the government signs the Perpres in September as promised, but the Constitutional Court later narrows or reinterprets Articles 58 or 61, the newly created authority could find its founding instrument built on ground the Court has since moved. Regulators in that position tend to freeze rather than act — which would mean Indonesia trades an enforcement vacuum for an enforcement authority too legally uncertain to use its own powers.
The innovation cost of an enforcement void
A missing regulator is sometimes framed as a business-friendly outcome — less compliance risk, less red tape. That reading gets it backwards. Legitimate platforms and data processors in Indonesia have spent two years building compliance programs against a law with no supervisory body to certify, guide, or benchmark them against. Ambiguity is not the same as low burden; it just shifts the burden onto companies trying to guess what a future regulator will eventually demand, while bad actors face essentially no enforcement risk at all. Indonesia's own private sector has been asking for the Lembaga PDP for this reason — clarity, not leniency, is what reduces compliance cost.
The practical test for peopleofinternet.com's readers is simple: does the Perpres get signed in September as Patria promised, and does its independence hold up in practice once Komdigi is the reporting channel for an agency meant to sometimes investigate Komdigi-adjacent state data systems? A late but genuinely independent authority is a defensible outcome of careful institution-building. A fourth consecutive year of missed deadlines, compounded by a Constitutional Court case the government cannot control the timing of, would confirm the petitioners' core claim — that Indonesia has spent four years treating a legal mandate as optional.