The PDP Law and Your CRM: What Indonesian Businesses Should Prepare
A CRM holds names, phone numbers and customer history, which is personal data. News about PDP law sanctions has put the topic on directors' desks.
What was reported
According to Bisnis.com (1 September 2026), the implementing regulation of the PDP law, Government Regulation No. 33 of 2026, provides administrative sanctions that can include a written warning, temporary suspension of data processing, deletion of data, and fines of up to 2% of annual revenue. We are not legal advisers. Read the official text and consult your legal adviser about your company's obligations.
Why the CRM is the focus
The CRM is usually where most customer data collects. Questions likely to come up: what data do you hold, for what purpose, where is the consent from, who can see it, and how long is it kept.
Practical tidy-up in the CRM
- Map personal data: which fields contain it.
- Limit access by role, rather than giving everyone full access.
- Record source and consent for marketing contacts.
- Set a retention period and a process to delete data no longer needed.
- Keep an audit trail of who changes or exports data.
- Reduce exports to spreadsheets that wander around.
What implementation can help with
Access rights, consent fields, deletion rules and reports of who sees what can be configured in Zoho. Legal interpretation stays with your legal adviser.
First step
Start with an audit of access and fields holding personal data. See Zoho audit and consent for WhatsApp marketing.