/
Book a demo
InsightsBy Nura Linggih

Your AI Assistant Reads Customer Data. Indonesia's Privacy Law Gets Teeth on January 16, 2027

Timeline of Indonesia's data protection law reaching enforcement on January 16, 2027

Indonesia has had a data protection law since October 2022 — Law 27/2022, the UU PDP. What it lacked was machinery. That changed on July 16, 2026, when the government enacted its implementing regulation, PP 33/2026, and started a clock: the rules take effect on January 16, 2027.

If your business uses AI on customer data — a WhatsApp bot answering buyers, an assistant summarising client documents, an agent reconciling invoices — this law is about you. The UU PDP covers every stage of AI processing: collection, storage, training, inference and output.

The penalties are not theoretical. Administrative fines run up to 2 percent of annual revenue, alongside processing bans and, for the worst cases, criminal liability. Enforcement currently sits with Komdigi while the dedicated supervisory agency, the Lembaga PDP, is being established.

The timeline that matters

  • October 2022: UU PDP (Law 27/2022) passed — principles in place, enforcement machinery not yet.
  • January 2026: The law amended by Law 1/2026.
  • July 16, 2026: PP 33/2026, the implementing regulation, enacted — the operational detail the original law was waiting for.
  • January 16, 2027: The regulation takes effect. From this date, the obligations are enforceable, not aspirational.

What it means when your AI touches personal data

The law does not care whether a human or a model reads the data. If your assistant ingests customer chats, order histories, ID photos or payment confirmations, you are processing personal data and you need a lawful basis for it, a way to honour access and deletion requests, and real security controls around where that data goes.

The riskiest pattern we see in Southeast Asian businesses is casual data sprawl: customer conversations forwarded into general-purpose AI tools with no record of what went where. Under the UU PDP, "we pasted it into a chatbot" is a data transfer you are accountable for.

A second pattern to check: consent. Cold-contacting consumers through automated channels was already restricted; the implementing regulation sharpens the duty to show a basis for every processing activity, including the automated ones.

The four things to fix before January 16

  • Map where customer data meets AI. List every tool that sees customer information — including the unofficial ones staff paste into. You cannot defend flows you have not mapped.
  • Choose tools that see less. Prefer systems that process only what you send them, in an environment isolated per business. Rapi, for example, is built on that default: it sees what you send it, conversations are never used to answer anyone else, and it never asks for a PIN, an OTP or a password.
  • Write the retention rule down. How long do chat records, documents and outputs live, and who can delete them? A one-page policy beats an unwritten habit.
  • Assign the owner. The regulation expects accountability to sit with someone. Name the person who answers for data protection before a regulator asks who that is.

Common questions

Does the UU PDP apply to AI tools?
Yes. Law 27/2022 applies to all processing of personal data, and that includes AI systems that collect, store, train on, infer from or output personal data. Whether a human or a model does the reading makes no legal difference.
When do the new Indonesian data rules take effect?
PP 33/2026, the implementing regulation of the UU PDP, was enacted on July 16, 2026 and takes effect on January 16, 2027.
What are the penalties under the UU PDP?
Administrative fines of up to 2 percent of annual revenue, orders to stop processing, and criminal liability for the most serious violations. Enforcement currently sits with Komdigi while the dedicated Lembaga PDP is established.
Can an SME still use a WhatsApp AI assistant under the UU PDP?
Yes — the law regulates how data is handled, not whether AI may be used. Choose a system that processes only what you send it, keeps each business isolated, honours deletion requests, and never asks customers for credentials. Then document that setup.
What should a business fix first before January 16, 2027?
Map every place customer data meets an AI tool, replace casual paste-into-a-chatbot flows with systems that see only what they are sent, write down a retention rule, and name the person accountable for data protection.