YOGYAKARTA, 20 April 2026 – The Center for Law, Technology, RegTech & LegalTech Studies (CTRL) of the Faculty of Law, Universitas Gadjah Mada, officially released its first Policy Brief edition of 2026, highlighting the urgency of implementing Law Number 27 of 2022 on Personal Data Protection (PDP Law).
The policy brief, titled “Accelerating the Implementation of the PDP Law: Regulatory, Institutional, and Compliance Challenges”, was prepared by a legal research team led by Dr. Wahyu Yun Santoso, S.H., M.Hum., LL.M., together with Amirudin Nur Wahid and Fakhrul Haholongan Pulungan.
The policy brief highlights the phenomenon of digital transformation in Indonesia, where data from We Are Social indicates that approximately 185.3 million people are connected to the internet. However, the rapid growth of information-sharing culture has not yet been fully accompanied by a mature regulatory framework for personal data protection.
To date, operational instruments such as Government Regulations governing compensation mechanisms, data portability, and administrative sanctions have yet to be established. This situation creates legal uncertainty for businesses, including micro, small, and medium enterprises (MSMEs) and start-ups, while also hindering the achievement of SDG 9 (Industry, Innovation, and Infrastructure) in building an inclusive and secure digital ecosystem.
Through this policy brief, CTRL FH UGM contributes to supporting the global SDGs agenda, particularly SDG 16 (Peace, Justice and Strong Institutions), by strengthening public access to information and protecting citizens’ fundamental freedoms in the digital space.
Furthermore, CTRL FH UGM highlights increasingly complex future challenges arising from the development of artificial intelligence (AI) and modern computational algorithms. The risks of data breaches and information exploitation through illegal platforms represent real threats that require the establishment of an independent Personal Data Protection Authority.
As a strategic step, the Center for Law and Technology FH UGM recommends that the government immediately prioritize the completion of implementing regulations and conduct comprehensive synchronization with existing sectoral regulations. These efforts are expected to position the PDP Law as a unified reference that balances the constitutional rights of data subjects with the responsibilities of data controllers.
Author: Amirudin Nur Wahid (Research Assistant, Center for Law, Technology, RegTech & LegalTech Studies “CTRL”)
