The Operational Challenge of PP 33/2026: Maintaining Privacy Compliance Across the Organization

A company may successfully complete a privacy compliance assessment and have the necessary evidence to support its findings. However, what happens when a new application is deployed, a vendor introduces another subprocessor, or an existing business process begins collecting additional personal data?

Each change can affect the accuracy of processing records, the effectiveness of established controls, and the privacy risks associated with the company’s operations. Compliance evidence collected during an earlier assessment may no longer represent how personal data is currently being handled.

In our previous article, we examined how Indonesia's Government Regulation No. 33 of 2026 (PP 33/2026) reinforces the importance of demonstrating that personal data protection obligations are implemented through documented processes and operational evidence.

Also read: From Policy to Proof: What PP No. 33 of 2026 Really Changes for Organizations

But producing evidence at a particular point in time raises another question: How can organizations ensure that their privacy controls continue to function as business processes and technology environments evolve?

To explore this challenge, we return to the insights of Ilafi Firsta Putri, CIPP/E, Data Protection Officer (DPO) at Cisometric. Through her responsibilities in internal data protection governance and external privacy consulting, Ilafi helps organizations translate regulatory requirements into processes, responsibilities, and controls that can be maintained throughout their operations.

Her perspective highlights an important consideration ahead of PP 33/2026 taking effect on 16 January 2027. Organizations need to understand how privacy responsibilities extend across departments, third-party processors, new technologies, and the decisions made throughout the personal data lifecycle.

Key takeaways

• Privacy compliance requires continuous oversight as processing activities and business environments change

• Third-party processing creates accountability gaps that must be managed throughout vendor relationships

• Control effectiveness should be evaluated through monitoring, audits, and operational evidence

• Companies should prioritize five areas of data protection readiness before January 2027

• Privacy findings need accountable remediation and verification before they can be considered resolved

Third-party processing: Why accountability does not transfer with the data

Businesses increasingly depend on cloud providers, SaaS platforms, outsourced business services, and external technology partners to support their operations. These arrangements often involve sharing access to personal data or allowing external parties to process information on the organization's behalf.

For Ilafi, third-party processing represents one of the most significant accountability gaps in data protection governance.

"For me, the key is having visibility and control over the personal data throughout the entire vendor relationship, not just at the point when the contract is signed."

This distinction becomes particularly important when evaluating the responsibilities of data controllers and processors.

Under Articles 13–16 of PP 33/2026, controller-processor relationships must be governed through agreements addressing relevant processing requirements, responsibilities, oversight arrangements, and the engagement of subprocessors.

Although processors have their own applicable obligations, controllers remain responsible for personal data processing performed on their behalf. The practical challenge is maintaining sufficient oversight of activities taking place outside the organization's direct operational environment.

Consider an organization that uses a third-party customer management platform. At the beginning of the relationship, the organization completes a vendor assessment and signs a processing agreement. Six months later, the provider introduces a new subprocessor or changes its hosting infrastructure.

Would the company know about that change? More importantly, would its existing privacy assessment, processing records, and contractual safeguards still accurately reflect the arrangement?

According to Ilafi, businesses need to maintain visibility into several aspects of third-party processing:

• What personal data the vendor processes and for what purpose

• Where the data is stored and which parties can access it

• How privacy and security requirements are implemented

• How incidents are reported, investigated, and managed

• Whether changes to processing activities introduce additional risks

These questions need to remain relevant throughout the vendor relationship, including onboarding, ongoing operations, material changes, and eventual termination.

For example, a processing agreement may establish requirements for incident notification or personal data deletion. However, organizations also need mechanisms for assessing whether those requirements can be fulfilled, particularly when multiple processors or subprocessors are involved.

A vendor assessment completed during onboarding provides a baseline. Ongoing monitoring helps determine whether the processing arrangement continues to operate within that baseline.

For organizations preparing for PP 33/2026, third-party governance should therefore be incorporated into regular risk reviews, change management, and relevant business decisions. This helps maintain accountability as the external processing environment evolves.

How can management determine whether privacy controls are working?

Once privacy requirements have been translated into operational controls, management needs a reliable way to evaluate their effectiveness over time.

Ilafi recommends regular monitoring, internal audits, employee training, and reviewing actual operational records. These activities help organizations determine whether established procedures are consistently followed and whether implementation gaps remain unresolved.

The distinction between control design effectiveness and control operating effectiveness is particularly useful here. A control may be designed appropriately to address a privacy risk, but its effectiveness also depends on how reliably it operates within the systems and workflows it governs.

For example, an organization that has established a procedure for handling data subject requests. The process includes request intake, identity verification, internal processing, and communication with the requester. When management reviews its effectiveness, simply confirming that the procedure exists provides limited insight into how requests are actually handled.

A more thorough assessment would examine completed request records to determine whether verification was performed, relevant systems were consulted, processing decisions were documented, and responses were delivered within the applicable requirements.

The same approach can be applied to incident management. An organization may have documented escalation procedures for personal data protection failures, but management also needs to understand whether the relevant security, privacy, and legal functions can coordinate effectively during an actual incident.

This is especially relevant under the 3 × 24-hour notification requirement established in Article 114 of PP 33/2026. Organizations need to be able to investigate potential failures, establish when the failure became known under the conditions specified by the regulation, assess the consequences, and manage applicable notifications.

Also read: From Policy to Proof: What PP No. 33 of 2026 Really Changes for Organizations

Regular reviews and testing can help determine whether these dependencies are functioning as intended.

What should management monitor?

A practical monitoring approach can examine indicators related to the organization's most significant processing activities and privacy risks.

For example, management may review the time required to resolve data subject requests, outstanding findings from DPIAs, overdue remediation actions, changes in third-party processing arrangements, and exceptions identified during internal audits.

These indicators can reveal issues that may not be apparent from policy reviews alone. A growing number of unresolved privacy findings, for instance, may indicate insufficient remediation ownership or weaknesses in the process for implementing corrective actions.

However, monitoring is only useful when findings lead to decisions. Organizations need clear control owners, escalation criteria, and processes for tracking remediation through completion.

This creates a continuous feedback mechanism in which operational findings inform improvements to procedures, technical controls, and governance responsibilities.

Five areas businesses should review before January 2027

With PP 33/2026 scheduled to take effect on 16 January 2027, companies should evaluate their existing data protection practices against the regulation's implementation requirements.

Ilafi identifies five priority areas for an initial readiness assessment. Together, they provide a practical starting point for identifying gaps that could affect compliance across business operations:

1. Records of Processing Activities and data flow mapping

Organizations should review whether their RoPA and data flow maps accurately reflect current processing activities, including the systems involved, processing purposes, data recipients, and relevant third-party arrangements.

Particular attention should be given to changes introduced through application deployments, system integrations, cloud migrations, and new business processes. Processing inventories that are not maintained as the environment changes can affect data subject rights management, retention decisions, and incident investigations.

2. Policies, procedures, and operational controls

Existing privacy policies should be evaluated against the processes and technical controls responsible for implementing them.

This includes determining whether responsibilities are assigned, procedures are consistently followed, and the organization can identify implementation failures that require corrective action.

Where discrepancies exist, organizations should distinguish between gaps in control design and failures in operational execution, as each may require a different remediation approach.

3. Data subject rights management

Organizations should examine how requests are received, verified, processed, and resolved across the systems and departments involved.

A sample review of completed requests can help determine whether the organization has sufficient records to substantiate processing decisions and demonstrate fulfillment within applicable requirements.

This assessment becomes particularly important when personal data is distributed across multiple applications or managed by external processors.

4. Privacy risk and incident management

Organizations need to identify processing activities that require DPIAs and establish whether the resulting assessments influence implementation decisions and risk mitigation measures.

Incident response readiness should also be evaluated, including how potential personal data protection failures are investigated, classified, escalated, and documented.

These processes depend on coordination between privacy, security, IT, legal, and relevant business functions, making clearly assigned responsibilities essential.

5. Third-party assessments

Vendor assessments should reflect the processing activities and risks associated with current third-party relationships.

Organizations should examine whether processing agreements, subprocessor arrangements, access permissions, and data transfer mechanisms remain appropriate, particularly following significant changes to the vendor's services or infrastructure.

The review should also establish whether identified findings are monitored and whether corrective actions have been implemented.

The value of these five assessments depends on what organizations do with their findings. Each identified gap should lead to an accountable action, an appropriate remediation priority, and a mechanism for verifying whether the issue has been resolved.

For management, this provides a way to connect regulatory readiness with the effectiveness of existing governance and operational processes.

Why privacy needs to be considered before business decisions are finalized

Many privacy implementation challenges originate from decisions made before the privacy team becomes involved.

A business unit may introduce a new application, a product team may expand the use of customer information, or procurement may engage a technology provider without fully assessing the associated processing activities.

These decisions can introduce additional data flows, processing purposes, third-party dependencies, and privacy risks.

Ilafi identifies late involvement of privacy professionals as a recurring issue.

"Sometimes, the privacy team is also involved too late, for example when launching a new product or working with a third party."

Once a system has been deployed or a vendor relationship established, addressing privacy risks may require changes to existing architecture, contractual arrangements, and operational workflows.

An earlier review allows organizations to identify those considerations while technical and business alternatives remain available.

Integrating privacy into existing business workflows

For organizations developing new applications or introducing new processing activities, privacy assessment can become part of established technology and business approval processes.

This may involve reviewing processing purposes and lawful bases during project planning, assessing data flows during architecture reviews, and determining whether high-risk activities require a DPIA before processing begins.

Article 120 of PP 33/2026 addresses DPIAs for high-risk processing, including certain forms of automated decision-making, systematic monitoring, large-scale processing, and the use of new technologies.

For example, an organization introducing an automated customer profiling system should evaluate the associated processing activities and privacy risks before deployment. Where a DPIA is required, its findings can inform decisions concerning data minimization, access restrictions, processing arrangements, and other appropriate safeguards.

A similar approach applies to vendor onboarding. Procurement and business owners can coordinate with privacy and security teams to evaluate data processing arrangements before agreements are finalized.

These practices also need to continue after implementation. Changes to processing purposes, technology architecture, or third-party relationships may introduce risks that require reassessment.

When a privacy control fails: From audit findings to verified remediation

Identifying a privacy compliance gap is only the beginning of addressing it. An organization also needs to determine the risk associated with the finding, assign responsibility for corrective action, and verify that the implemented measures have resolved the underlying issue.

This becomes particularly important when findings involve technical controls, multiple departments, or processes that affect large volumes of personal data.

Consider a hypothetical internal access review that identifies an inactive third-party account retaining access to a database containing customer information. The account should have been deactivated following the end of the vendor's engagement, but its permissions remain active.

Revoking the account's access is an immediate corrective measure. However, several questions still need to be investigated. How long did the access remain available? Was the account used after the engagement ended? Did the issue result from an incomplete offboarding procedure, a failure in identity provisioning, or insufficient access reviews?

The answers influence both the assessment of the finding and the corrective measures required to prevent recurrence.

A practical remediation process should address several stages:

1. Assess the finding and its associated risk

The company should evaluate the nature of the control failure, the personal data potentially affected, and the consequences that could arise from the exposure.

Where relevant, the assessment should consider the sensitivity of the data, the duration of the weakness, available activity records, and whether the finding requires further incident investigation.

This helps establish an appropriate remediation priority based on risk rather than treating every compliance finding as equally urgent.

2. Assign remediation ownership and corrective actions

Each finding needs an accountable owner, a defined corrective action, and an appropriate target for resolution.

In the access control example, the IT or identity management team may be responsible for removing permissions, while the security team investigates relevant access activity. The privacy function can assess the implications for personal data protection and coordinate any additional requirements.

The root cause may also require changes to the company’s offboarding workflow or the integration between vendor management and identity administration.

3. Verify that the corrective measures are effective

Completing a remediation task does not automatically establish that the underlying weakness has been resolved.

The business should verify whether the account's access was successfully revoked, whether related access paths remain available, and whether the revised procedure would prevent similar failures.

Supporting evidence might include updated permission records, relevant system logs, completed access reviews, and test results demonstrating that the corrective measures operate as intended.

Only after the appropriate verification should the finding be considered resolved.

4. Incorporate findings into future control reviews

A recurring finding may indicate a broader weakness in the control framework. For example, repeated failures to deactivate accounts following vendor offboarding could suggest that the company lacks a reliable mechanism for connecting contractual changes with access management.

In such cases, resolving individual accounts may address the immediate exposure without correcting the process responsible for creating it.

Companies should therefore use recurring findings to evaluate whether control design, ownership, monitoring frequency, or supporting workflows need to change.

This approach introduces an important distinction between closing a compliance finding administratively and establishing that the associated risk has been appropriately addressed.

For management, a privacy remediation program should provide visibility into outstanding findings, their risk levels, responsible owners, remediation progress, and the evidence supporting closure.

These practices provide a structured way to strengthen control effectiveness over time, particularly as the organization's processing environment becomes more complex.

Sustaining data protection accountability with Cisometric

As PP 33/2026 approaches its effective date, businesses need to consider how their privacy responsibilities will be maintained beyond an initial compliance assessment. Changes to technology, processing activities, and third-party relationships can introduce risks that existing controls were not originally designed to address.

Managing these changes requires coordination across the company. Technology teams influence system architecture and access controls, procurement and business owners oversee third-party arrangements, and management determines how identified risks are prioritized and addressed. As Ilafi emphasizes, privacy needs to be considered early in business decisions and managed continuously throughout operations.

At Cisometric, Ilafi and our data privacy consulting team support organizations in strengthening these practices through privacy compliance assessments, RoPA and data flow mapping, DPIA support, third-party risk evaluations, and privacy governance implementation. These activities help organizations identify gaps, establish appropriate controls, and improve the processes used to monitor and address privacy risks.

Explore Cisometric's Data Privacy and Compliance Consulting services to evaluate your organization's readiness for PP 33/2026 and strengthen its data protection practices as business operations evolve.

Stay connected with Cisometric for insights on cybersecurity, data privacy, regulatory compliance, and digital trust.

LinkedIn: Cisometric

Instagram: @cisometric

YouTube: @Cisometric

FAQ

How can companies determine whether their privacy controls remain effective?

Organizations can evaluate control effectiveness through periodic monitoring, internal audits, reviews of operational records, and testing of relevant processes. These activities help identify whether controls continue to operate as intended and whether implementation gaps require remediation. Cisometric supports businesses through privacy compliance assessments and governance reviews that help identify weaknesses in existing processes and controls.

What should organizations review when assessing third-party data processing risks?

Companies should evaluate the personal data processed by vendors, the purposes of processing, access arrangements, storage locations, contractual requirements, subprocessor relationships, and incident management procedures. They should also reassess relevant risks when vendor arrangements change. Cisometric's Data Privacy Management consulting can help businesses review third-party processing arrangements, identify accountability gaps, and strengthen vendor governance.

When should companies involve their Data Protection Officer in new projects?

Privacy professionals should be involved early enough to evaluate processing purposes, lawful bases, data flows, and potential risks before key implementation decisions are finalized. This is particularly important for high-risk processing activities and new third-party arrangements. Cisometric's DPO and privacy consulting team can support businesses in incorporating privacy assessments into technology reviews, business planning, and relevant approval processes.

What are the most important areas to assess before PP 33/2026 takes effect?

Companies should prioritize RoPA and data flow mapping, policies and procedures, data subject rights management, privacy risk and incident management, and third-party assessments. The review should evaluate how these areas operate and identify gaps requiring corrective action. Cisometric can help organizations conduct readiness assessments, prioritize remediation, and strengthen the governance processes supporting PP 33/2026 compliance.