Data Protection In Indonesia: Breaches And Marketing

Data Breaches

A data breach involving a financial institution in Indonesia does not trigger an immediate reporting requirement to the relevant authority. Instead, periodical reports on consumer complaints and further services and settlements provided to such consumers must be made to the Financial Services Authority ("OJK") or Bank Indonesia ("BI"), depending on the service rendered by the financial institution. For the OJK, this reporting must be done quarterly, whereas the reporting period to BI depends on the payment system service provided by the financial institution.

On a related note, data owners must be notified of any data breach if such breach resulted from a failure in the electronic system managed by the financial institution. This notification must include the reason the data breach occurred.