A two-year grace period has come and gone since Indonesia’s first omnibus Personal Data Protection Act (PDP Law) was enacted in 2022(1) as the law came into full effect on 17 October 2024. However, two vital signs of life, implementing regulations and appointment of a data protection authority, are still nowhere to be seen.

The Indonesian government is still finalising the PDP Law’s implementing regulation, and the draft of such regulation was circulated on 31 August 2025 for public discussion (RPP PDP) and has been analysed.(2) In addition to the implementing regulation, the PDP Law allows for the creation of an independent authority (PDP Authority) by the president, mandating a presidential regulation to establish and govern such PDP Authority to be responsible and report to the president directly.