The cost of UU PDP non-compliance: fines, sanctions, and business risk

Many Indonesian companies still treat UU PDP as a regulation for "later" or assume "nobody has been fined yet." Both assumptions are now incorrect. The transition period ended in October 2024, enforcement infrastructure is being built, and the sanctions are designed to be felt, not merely symbolic.

This page details the sanctions that can be imposed, how they are calculated, and the indirect costs that are often overlooked in risk assessments.

UU PDP sanction structure

UU PDP recognises three categories of sanction: administrative, civil, and criminal. All three can apply simultaneously for a single incident.

How the administrative fine is calculated

Article 57 paragraph 3 sets the administrative fine at up to 2 percent of the annual income or annual revenue tied to the violation. That last qualifier is the part most often dropped. The 2 percent ceiling attaches to the revenue associated with the processing activity that fell short, not to the company's total turnover. A company with several business lines is therefore not automatically exposed to 2 percent of its consolidated revenue, and any rupiah figure calculated from whole-company revenue overstates the real exposure.

How the violation variable is to be measured has not been settled. The implementing regulation that would specify the calculation method has not been issued, the Personal Data Protection Authority is still being established, and as at this update there are no reported cases of a UU PDP administrative fine actually being imposed. Any rupiah figure circulating as the "maximum UU PDP fine" is therefore an estimate rather than the product of an applied rule.

What is settled is the shape and order of the sanctions. A fine is not the first step. Article 57 paragraph 2 sets out a ladder that begins with a written warning, then temporary suspension of processing activities, then erasure or destruction of personal data, and only then an administrative fine. The 2 percent figure is also a ceiling rather than a flat rate, so the degree of intent, the impact on data subjects, and mitigation efforts still determine the final amount.

Indirect costs that are often overlooked

Regulatory fines are the easy-to-calculate part. Indirect costs are frequently larger.

Violations most likely to trigger sanctions

Risk comparison: compliant vs non-compliant

The most practical first step

For most companies, the most efficient starting point is a UU PDP gap assessment: a short audit that identifies where you stand against the main obligations and which priorities need to be addressed first.

Alpha Code provides this assessment as part of its DPO-as-a-Service offering, including a prioritised report ready for presentation to a board of directors or audit committee.