Data Protection In Indonesia – Security Requirements

An electronic system provider (ESP) in Indonesia must maintain the correctness, validity, confidentiality, accuracy, relevance and compatibility with the purpose of the acquisition, collection, processing, analysis, retention, display, publication, transmission, dissemination and destruction of personal data. Additionally, an ESP must also carry out certification of its electronic system to ensure it is in accordance with the applicable laws and regulations.

An ESP engaged in public services must have a data center and disaster recovery center that are used to protect personal data, which must be located within the jurisdiction of the Republic of Indonesia. This data center is a physical facility for the electronic system and its related components for the purpose of the placement, storage, and processing of data. The disaster recovery center must be used to recover data or information and important functions of the electronic system that are interrupted or