Keamanan Siber: Indonesia (2026)
Indonesia does not yet have a single, comprehensive cybersecurity law. Cybersecurity obligations are drawn from the ITE Law, GR 71/2019, the 2022 PDP Law, the 2022 Vital Information Infrastructure Perpres, BSSN's 2024 incident- and crisis-management regulations, and sector-specific supervisory rules (notably OJK for finance). A dedicated Cybersecurity and Cyber Resilience Bill (RUU KKS), first tabled in 2019 and re-finalised by the Law Ministry in October 2025, sits in the 2025/2026 legislative agenda but has not been enacted.
Kerangka kerja utama
No single overarching cybersecurity statute; obligations arise from a mosaic of laws and regulations: Law No. 11/2008 as amended (Electronic Information and Transactions / ITE Law), Government Regulation 71/2019 on Electronic Systems and Transactions, Law No. 27/2022 on Personal Data Protection (breach-notification obligations), Presidential Regulation 82/2022 on Vital Information Infrastructure Protection, BSSN Regulation 1/2024 (cyber incident management) and 2/2024 (cyber crisis management), and sector rules such as OJK regulations for financial services. The National Cyber and Crypto Agency (Badan Siber dan Sandi Negara — BSSN) is the lead cyber authority. A draft Cybersecurity and Cyber Resilience Bill (RUU KKS) remains pending in the DPR (2025/2026 Prolegnas).
Poin utama
Lead authority: BSSN
The National Cyber and Crypto Agency (BSSN), established under Presidential Regulations 53/2017 and 133/2017, is Indonesia's central cybersecurity authority, responsible for national cyber policy, CIRT coordination, and incident and crisis management. The pending RUU KKS would upgrade BSSN to ministry-equivalent status with expanded enforcement powers.
Electronic Systems regime (GR 71/2019 + ITE Law)
Electronic System Providers (ESPs) must operate reliable and secure systems, protect personal data, and safeguard against unauthorised access; the ITE Law (Law 11/2008 as amended by Law 19/2016 and Law 1/2024) criminalises unlawful access, interception and interference with electronic systems and data.
Vital Information Infrastructure (Perpres 82/2022)
Presidential Regulation 82/2022 designates strategic sectors — government, energy, transport, finance, health, ICT, food and defence — as Vital Information Infrastructure (IIV) and requires operators to implement risk management, incident handling and BSSN coordination.
Incident & crisis management (BSSN Reg. 1/2024 and 2/2024)
BSSN Regulation 1/2024 establishes a three-tier Computer Security Incident Response Team (CSIRT) structure — National, Sectoral and Organisational — with escalation duties. BSSN Regulation 2/2024 sets out national cyber crisis management, including declaration criteria, response phases and inter-agency coordination.
Data-breach notification under the PDP Law
Under Law 27/2022 (PDP Law) art. 46, data controllers must notify the affected data subjects and the supervisory authority in writing within 3×24 hours (72 hours) of becoming aware of a personal-data protection failure. Implementing rules were issued as Government Regulation 33/2026 on 16 July 2026, taking effect 16 January 2027.
Pending Cybersecurity and Cyber Resilience Bill (RUU KKS)
A comprehensive Cybersecurity and Cyber Resilience Bill has been on the agenda since 2019; the Law Ministry finalised a redraft in October 2025 and it sits in the 2025/2026 Prolegnas priority list. It would create an integrated framework centred on BSSN, cover critical infrastructure, digital-product providers and AI ethics, but civil-society groups (Lokataru, SAFEnet) have flagged militarisation and dissent-related concerns; the bill has not been enacted.
Sectoral rules — financial services (OJK)
The Financial Services Authority (OJK) imposes bespoke cyber-resilience and incident-reporting duties on regulated entities, notably POJK 11/POJK.03/2022 on Information Technology Implementation by Commercial Banks and its cyber-resilience circular letters, and equivalent rules for capital markets and insurance.
Halaman ini merupakan terjemahan untuk kemudahan pembaca; versi bahasa Inggrisnya yang menjadi acuan resmi dan bukan merupakan nasihat hukum.