The Draft Government Regulation contemplated immediate effectiveness. Government Regulation 33/2026 instead gives organisations until 16 January 2027 to comply with the regulation. 

The Draft Government Regulation did not expressly require consent to be unambiguous. Under Government Regulation 33/2026, consent must be unambiguous, and consent bundled with acceptance of general terms and conditions may be considered ambiguous.

Government Regulation 33/2026 streamlines the minimum information required in privacy notices, while several detailed items remain reflected in the elucidation. It also adds new mandatory disclosures where companies jointly control the same personal data, covering the controllers involved, how their processing purposes relate to one another, the manner of processing, and the jointly appointed contact point.

Government Regulation 33/2026 now prohibits exoneration clauses in personal data protection notices generally, across all legal bases.

Government Regulation 33/2026 expands the minimum content for contracts to be relied on as a legal basis. A contract that fails to fulfil those requirements can no longer be used as a legal basis for processing.

The Draft Government Regulation applied the data protection officer (DPO) conditions cumulatively. Following Constitutional Court Decision No. 151/PUU-XXII/2024, Government Regulation 33/2026 treats the conditions as alternatives, so meeting any one of the conditions will trigger the obligation.

Under the Draft Government Regulation, controllers were permitted, but not required, to conduct internal and external audits of their personal data protection practices. Government Regulation 33/2026 now requires controllers to carry out both internal and external audits. The minimum scope, methodology, and frequency are not specified and may be addressed in future PDP Authority policies.

Companies must still maintain an internal policy on personal data processing, but its detailed content will follow future PDP Authority policies rather than the prescriptive list under the Draft Government Regulation. Separately, Government Regulation 33/2026 requires controllers to establish a documented retention policy along with its minimum content.

Controllers must now maintain their own transfer records and make them available for audit and supervisory purposes, extending a requirement that previously applied only to processors under the Draft Government Regulation.

Government Regulation 33/2026 now captures unauthorised alteration, corruption, destruction, loss, and loss of access as personal data protection failures. Ransomware, accidental deletion and system failures may now be in scope even where no data was disclosed.

Government Regulation 33/2026 allows either a child or the parent or guardian to submit a data subject rights request. Where a child submits directly, the controller must assess the child's capacity to understand the right being exercised. The elucidation nonetheless confirms that exercising rights relating to the processing of a child's personal data still requires parental or guardian consent.

Under Government Regulation 33/2026, in the event of a corporate action involving the transfer of personal data between controllers, controllers must assess the impact on data subject rights and controller obligations, update the data protection impact assessment (DPIA) where required, and implement technical measures for the transfer. Until the corporate action is deemed completed under the prevailing laws, the transferring and receiving controllers are deemed Joint Controllers.