Law No. 27 of 2022 on Personal Data Protection — notification of failure to protect personal data

There are two deadlines here and which one applies depends on the date. The PDP Law itself, Art. 46, gives 3 x 24 hours from becoming aware to notify both the affected data subject and the supervisory authority in writing, stating the personal data disclosed, when and how it happened, and the handling and recovery efforts made. The implementing Government Regulation promulgated July 16, 2026 restates that 3 x 24 hour window and clarifies that it runs from the point the failure is known with certainty and on reasonable grounds — but it does not enter into force until roughly six months after promulgation. Marked 'check' for two reasons a reviewer must resolve: Indonesia's supervisory authority was still being stood up rather than fully operational through this period, and independent sources differ on whether Art. 46's own window is 3 x 24 hours or 14 days. Read the Indonesian text of Art. 46 before relying on either.