PDP Law And Data Breach Notification Requirements In Indonesia

(October 6, 2022) Indonesia has seen a recent rise in data breaches. Recent incidents include 105 million people reportedly having their data compromised in a breach of the General Elections Commission database in September 2022. And the month before that, 26 million customers of Internet service provider IndiHome were reportedly affected in a suspected data breach. These incidents and others underline the need in Indonesia for a regulation that clearly outlines the requirements and procedures for reporting a data breach when it happens.

Cybersecurity and the protection of personal data have been regulated under a set of laws known as the PDP Regulations. These apply to Electronic System Providers (“ESPs”) that: (i) provide services within Indonesian territory; (ii) engage in business in Indonesia, and/or; (iii) whose electronic systems are used and/or offered within Indonesian territory. Now, with the long-awaited Personal Data Protection (PDP) Bill said to have