The cost of UU PDP non-compliance: fines, sanctions, and business risk

Many Indonesian companies still treat UU PDP as a regulation for "later" or assume "nobody has been fined yet." Both assumptions are now incorrect. The transition period ended in October 2024, enforcement infrastructure is being built, and the sanctions are designed to be felt, not merely symbolic.

This page details the sanctions that can be imposed, how they are calculated, and the indirect costs that are often overlooked in risk assessments. UU PDP is also only one layer of Indonesia IT compliance: an organisation exposed here is usually carrying obligations under the OJK, Bank Indonesia or BSSN rules at the same time, and those carry their own reporting clocks.

UU PDP sanction structure

UU PDP recognises three categories of sanction: administrative, civil, and criminal. All three can apply simultaneously for a single incident.

How the administrative fine is calculated

Article 57 paragraph 3 sets the administrative fine at up to 2 percent of annual income or annual revenue "terhadap variabel pelanggaran", measured against the variable of the violation. That qualifier is the part most often dropped, but it is also the part nobody can yet pin down. The statute does not say whether the variable means the revenue of the processing activity that fell short, the revenue of one business line, or the company's whole turnover, and the legal summaries of PP 33/2026 we have seen do not settle it either. Until the authority or the courts do, the safe planning assumption is the upper one: 2 percent of total annual revenue is the worst case, not an overstatement.

How the violation variable is to be measured has not been settled. The implementing regulation, PP 33/2026, was reported as promulgated on 16 July 2026 and applies from 16 January 2027, but its official text was not yet public when we checked on 10 October 2026, so whether it settles the calculation method is not yet confirmed. The Personal Data Protection Authority is still being established, and as at this update there are no reported cases of a UU PDP administrative fine actually being imposed. Any rupiah figure circulating as the "maximum UU PDP fine" is therefore an estimate rather than the product of an applied rule.

Do not read the list of sanctions as a ladder. Article 57 paragraph 2 names four administrative sanctions, a written warning, temporary suspension of processing activities, erasure or destruction of personal data, and an administrative fine, and joins them with "and/or", so the statute does not require them in that order. Hukumonline's article-level summary of PP 33/2026 reports that Pasal 184 ayat (7) and (8) go further: more than one sanction can be imposed at the same time, and a sanction can be imposed with or without a written warning first. A fine can therefore be the first sanction, alongside others. The 2 percent figure is a ceiling rather than a flat rate, and the same summary reports that Pasal 184 ayat (6) has the authority weigh the level or impact of the violation, the continuity of the business or public service, and the organisation's compliance record. Treat those PP 33 details as reported until its official text is published.

Indirect costs that are often overlooked

Regulatory fines are the easy-to-calculate part. Indirect costs are frequently larger.

Violations most likely to trigger sanctions

Risk comparison: compliant vs non-compliant

The most practical first step

For most companies, the most efficient starting point is a UU PDP gap assessment: a short audit that identifies where you stand against the main obligations and which priorities need to be addressed first.

Alpha Code provides this assessment as part of its DPO-as-a-Service offering, including a prioritised report ready for presentation to a board of directors or audit committee.