Surveillance cameras in the lobby, warehouse, and parking area are common in offices. A frequent question that arises in HR and legal departments is whether every employee and guest must sign consent before being recorded. The answer is not as simple as "yes" or "no," and it has shifted since the issuance of Government Regulation (PP) 33 of 2026.
Two often-confused articles
Law 27 of 2022 on Personal Data Protection (UU PDP) mentions visual data processing devices in two different contexts.
Article 17 regulates the installation of such devices in public places and/or public service facilities. There are three requirements: the purpose must be security, disaster prevention, and/or traffic; there must be information displayed in the area where the device is installed; and the device must not be used to identify individuals. Paragraph (2) exempts the information requirement and identification prohibition for the prevention of criminal acts and law enforcement.
Note the scope: the wording of the article refers to public places and public service facilities. Whether a lobby or an office workspace falls under this scope remains open to interpretation, as the text of the article does not explicitly address it.
Article 20 applies to the processing of any personal data, including faces captured by cameras. This is where the question of consent is addressed.
Consent is just one of six bases
Article 20 paragraph (1) requires data controllers to have a basis for processing. Paragraph (2) states that this basis includes six elements, and letter e ends with "and/or," meaning this list is not a cumulative requirement.
| Letter | Processing basis |
|---|---|
| a | Explicitly valid consent |
| b | Fulfillment of contractual obligations |
| c | Fulfillment of legal obligations of the controller |
| d | Protection of vital interests of the data subject |
| e | Tasks in the public interest, public service, or authority based on regulations |
| f | Fulfillment of other legitimate interests |
Therefore, obtaining individual signatures is not the only way. Companies installing cameras to protect assets and access may consider letter f. However, letter f is not a blank check: its wording requires consideration of the purpose, necessity, and balance between the interests of the controller and the rights of the data subject. Cameras directed at entrances and server rooms are easier to justify than cameras aimed at each person's workspace.
If choosing consent
Choosing letter a brings additional obligations. Article 21 paragraph (1) requires the controller to provide seven pieces of information: the legality of processing, purpose, type and relevance of data, document retention period, details of the information collected, processing duration, and rights of the data subject. Paragraph (2) mandates notification before any changes to this information. For guests and contractors who visit briefly, maintaining valid and documented consent is much more challenging than relying on legitimate interest grounds.
What changes with PP 33/2026
According to regulatory data published by Meridian Hukum and Paralegal.id, PP 33 of 2026 was established and enacted on July 16, 2026 (State Gazette 2026 Number 88), consisting of 225 articles, and will take effect from January 16, 2027. Two legal reviews opened, Kres.id and Veritask, both mention that a data protection impact assessment must be conducted before high-risk processing, in Articles 120 to 122. Kres.id's review cites cameras with smart analytics or systematic monitoring as examples that need to be examined. Other article numbers in those reviews are not uniform, so this writing does not quote them.
Five questions before installing or adding cameras
- What is the written purpose: asset protection, access control, or safety?
- Which basis from Article 20 paragraph (2) is being used, and is the reasoning documented?
- Are the cameras directed at assets and doors, not at people working?
- How long are recordings stored, and who is allowed to access them? The articles referenced in this writing do not specify a retention period for CCTV, so the duration needs to be determined and documented independently.
- Do the cameras have facial recognition or analytics capabilities? If so, consider an early impact assessment.
Note of honesty: the PDF text of PP 33/2026 could not be fully accessed while this writing was being prepared, so its content was taken from third-party summaries. Check the official text at JDIH before using it as a basis for policy, and consult specific cases with legal advisors. If you prefer to see the explanation directly, there is a short clip.
Sources
- Article 20 of Law 27/2022 on Personal Data Protection, pasal.id
- Article 17 of Law 27/2022, pasal.id
- Article 21 of Law 27/2022, pasal.id
- Regulations on Visual Data Processing According to UU PDP, Hukumonline Clinic (October 1, 2026)
- PP No. 33 of 2026, Meridian Hukum
- Government Regulation Number 33 of 2026, Paralegal.id
- PP 33/2026: Implementing Regulations of UU PDP, Kres.id
- Technical Regulations on Personal Data Protection through PP 33/2026, Veritask