UU PDP Fines in 2026: Business Obligations Remain

Criminal fines under UU PDP Articles 67 and 68 were adjusted in 2026. This does not remove customer-data duties or administrative exposure. Start with the data collected, its purpose, who can access it, and the breach procedure; then review the criminal-penalty changes.

On January 2, 2026, Indonesia's criminal-code adjustment law, UU No. 1/2026 on Penyesuaian Pidana, took effect and adjusted the criminal fines inside dozens of sectoral laws, UU PDP (the Personal Data Protection Law) among them. The nominal fines written into UU PDP's criminal articles dropped, in some cases sharply.

Hukumku.id's analysis traces the specific numbers, and they're worth understanding correctly before assuming what they mean for a business.

What actually changed

UU PDP's criminal fines were originally written as fixed rupiah amounts. Pasal 67 ayat (1) and (3), covering unlawfully obtaining or using someone else's personal data, each carried a maximum fine of Rp5 billion. Pasal 67 ayat (2), unlawfully disclosing personal data, carried Rp4 billion. Pasal 68, falsifying personal data, carried Rp6 billion.

This changes maximum penalties; it is not a currency redenomination. Article 79 of UU 1/2023 sets eight fine categories. UU 1/2026, Article II(5), maps prison maximums above three through five years to Category IV and above five through eight years to Category V. Annex I, entry 137, explicitly places UU PDP Articles 67(1), (2), and (3) in Category IV (Rp200 million) and Article 68 in Category V (Rp500 million). Article IX sets the effective date as 2 January 2026.

Category commentary and reporting on the signing provide context. For a particular case, check the official text, the actor, and corporate liability rules. Do not treat Rp200–500 million as a ceiling on all company exposure.

Why the smaller number shouldn't change how an SME behaves

Criminal and administrative sanctions have different grounds and procedures. Articles 67 and 68 require specific offence elements, including intent and unlawful conduct. UU PDP Article 57 provides for warnings, temporary processing suspension, deletion or destruction, and administrative fines up to 2% of annual revenue or receipts against the violation variable. A maximum is not an automatic fine for every incident.

Administrative action can disrupt data-dependent operations even without a criminal case. The numerical comparison depends on business size: 2% exceeds Rp200 million only when the revenue basis exceeds Rp10 billion. This article has no enforcement dataset supporting claims that either route occurs more often.

What this means for posture, not paperwork

None of this is legal advice, and a live case still needs a lawyer who can read the specific facts. What it does argue for is treating UU PDP compliance as an engineering discipline rather than a document filed once.

• Keep a real data inventory. Know which systems hold personal data, why, and under what legal basis. You can't answer "was this processing lawful" without first knowing what's being processed.
• Keep consent and legal-basis records where you can produce them fast. Assign ownership and keep records searchable so staff can answer a supervisory request within the applicable deadline.
• Write a breach runbook before you need one. Who gets notified, in what order, what gets logged, and who has authority to talk to the regulator. I've written about the wider discipline of running vendor-built systems with this kind of structure in a playbook for SME software projects: the same instinct, control through visibility rather than after-the-fact scrambling, applies here.
• Put data-handling terms in every processor contract. If a vendor touches your customers' personal data, your exposure includes what they do with it. Specify retention, deletion, and breach-notification duties, then check that the vendor follows them. A contract clause alone does not establish compliance.

Review actual data-handling practices

Changed criminal fine amounts do not remove data-protection duties. Review access, retention, deletion, and incident procedures with operations staff. Have legal counsel assess the obligations and case-specific exposure, and have the technical team demonstrate that agreed controls work.