Cybersecurity law & regulation in Indonesia (2026)

Legal framework

No single overarching cybersecurity statute; obligations arise from a mosaic of laws and regulations: Law No. 11/2008 as amended (Electronic Information and Transactions / ITE Law), Government Regulation 71/2019 on Electronic Systems and Transactions, Law No. 27/2022 on Personal Data Protection (breach-notification obligations), Presidential Regulation 82/2022 on Vital Information Infrastructure Protection, BSSN Regulation 1/2024 (cyber incident management) and 2/2024 (cyber crisis management), and sector rules such as OJK regulations for financial services. The National Cyber and Crypto Agency (Badan Siber dan Sandi Negara — BSSN) is the lead cyber authority. A draft Cybersecurity and Cyber Resilience Bill (RUU KKS) remains pending in the DPR (2025/2026 Prolegnas).

Key points: cybersecurity in Indonesia

1. 01Lead authority: BSSN

   The National Cyber and Crypto Agency (BSSN), established under Presidential Regulations 53/2017 and 133/2017, is Indonesia's central cybersecurity authority, responsible for national cyber policy, CIRT coordination, and incident and crisis management. The pending RUU KKS would upgrade BSSN to ministry-equivalent status with expanded enforcement powers.

   bssn.go.id ssek.com

2. 02Electronic Systems regime (GR 71/2019 + ITE Law)

   Electronic System Providers (ESPs) must operate reliable and secure systems, protect personal data, and safeguard against unauthorised access; the ITE Law (Law 11/2008 as amended by Law 19/2016 and Law 1/2024) criminalises unlawful access, interception and interference with electronic systems and data.

   peraturan.bpk.go.id jdih.kominfo.go.id

3. 03Vital Information Infrastructure (Perpres 82/2022)

   Presidential Regulation 82/2022 designates strategic sectors — government, energy, transport, finance, health, ICT, food and defence — as Vital Information Infrastructure (IIV) and requires operators to implement risk management, incident handling and BSSN coordination.

   peraturan.bpk.go.id ssek.com

4. 04Incident & crisis management (BSSN Reg. 1/2024 and 2/2024)

   BSSN Regulation 1/2024 establishes a three-tier Computer Security Incident Response Team (CSIRT) structure — National, Sectoral and Organisational — with escalation duties. BSSN Regulation 2/2024 sets out national cyber crisis management, including declaration criteria, response phases and inter-agency coordination.

   peraturan.bpk.go.id ssek.com

5. 05Data-breach notification under the PDP Law

   Under Law 27/2022 (PDP Law) art. 46, data controllers must notify the affected data subjects and the supervisory authority in writing within 3×24 hours (72 hours) of becoming aware of a personal-data protection failure. Implementing rules were issued as Government Regulation 33/2026 on 16 July 2026, taking effect 16 January 2027.

   peraturan.bpk.go.id nusantaradfdl.com

6. 06Pending Cybersecurity and Cyber Resilience Bill (RUU KKS)

   A comprehensive Cybersecurity and Cyber Resilience Bill has been on the agenda since 2019; the Law Ministry finalised a redraft in October 2025 and it sits in the 2025/2026 Prolegnas priority list. It would create an integrated framework centred on BSSN, cover critical infrastructure, digital-product providers and AI ethics, but civil-society groups (Lokataru, SAFEnet) have flagged militarisation and dissent-related concerns; the bill has not been enacted.

   en.tempo.co ap-lawsolution.com

7. 07Sectoral rules — financial services (OJK)

   The Financial Services Authority (OJK) imposes bespoke cyber-resilience and incident-reporting duties on regulated entities, notably POJK 11/POJK.03/2022 on Information Technology Implementation by Commercial Banks and its cyber-resilience circular letters, and equivalent rules for capital markets and insurance.

   ojk.go.id

Timeline of decisions

1. 1 Nov 2024Law
   Cybersecurity and Cyber Resilience Bill placed on 2025 priority legislation list

   After being first proposed in 2019 and stalling for over five years, the Cyber Security and Resilience Bill (RUU KKS) was included among parliament's 2025 priority legislation; it would designate BSSN as central cyber authority but has drawn criticism over proposed military (TNI) roles and civil-liberties risks.

   Kompas

2. 20 Jun 2024Incident · official
   Brain Cipher ransomware cripples National Data Center (PDNS 2)

   A LockBit 3.0-derived ransomware attack on the Temporary National Data Center in Surabaya disrupted 282 public services including immigration and passports, with attackers demanding USD 8 million; the government refused to pay and BSSN's forensics found Windows Defender had been disabled, exposing severe weaknesses in government cyber governance.

   ANTARA News

3. 20 Jun 2024Incident
   Brain Cipher ransomware cripples National Data Center (PDNS 2)

   A LockBit 3.0-variant ransomware attack on Indonesia's temporary National Data Centre disrupted 282 public services including immigration, with attackers demanding US$8 million; the government refused to pay and the breach exposed that only ~2% of hosted data was backed up.

   GovInsider

4. 24 May 2022Law · official
   Presidential Regulation 82/2022 on Protection of Vital Information Infrastructure

   President Jokowi issued Perpres 82/2022 mandating BSSN to coordinate protection of vital information infrastructure across strategic sectors (government, energy, finance, health, transport, defense, etc.), requiring operators to apply risk management, incident readiness, and coordination with BSSN.

   Cabinet Secretariat (Setkab)

5. 20 May 2021Incident · official
   BPJS Kesehatan breach exposes data of 279 million people

   Personal data of over 279 million citizens, ID numbers, addresses, phone numbers, salaries, allegedly from health-insurer BPJS Kesehatan was offered for sale on a hacking forum; the police-investigated incident underscored Indonesia's weak data protection and helped build momentum for the PDP Law.

   Indonesian National Police

6. 10 Oct 2019Law
   Government Regulation 71/2019 on Electronic Systems and Transactions

   GR 71/2019 (replacing GR 82/2012) classified operators into public and private ESPs, required public operators to localize systems and data in Indonesia, mandated registration with the Ministry of Communications, and obliged operators to grant government supervisory access and report incidents to the cyber authority.

   Global Compliance News

7. 19 May 2017Law · official
   National Cyber and Crypto Agency (BSSN) established

   Presidential Regulation No. 53/2017 created BSSN by merging the National Crypto Agency (Lemsaneg) and the national cyber defense desk (DK2ICN), giving Indonesia a dedicated central agency for cyber defense, threat intelligence, and cryptography; its mandate was reaffirmed by Perpres 28/2021.

   UNIDIR Cyber Policy Portal

8. 25 Nov 2016Law
   First Amendment to the ITE Law (Law No. 19 of 2016)

   The first amendment to the 2008 ITE Law introduced the concept of electronic system providers, the 'right to be forgotten,' powers to terminate access to illegal content, and clarified criminal penalties, expanding the regulatory reach over Indonesia's digital ecosystem.

   ICLG

Sources

1. 1.bssn.go.id/
2. 2.peraturan.bpk.go.id/Details/122030/pp-no-71-tahun-2019
3. 3.peraturan.bpk.go.id/Details/229798/uu-no-27-tahun-2022
4. 4.peraturan.bpk.go.id/Details/214917/perpres-no-82-tahun-2022
5. 5.peraturan.bpk.go.id/Details/288030/peraturan-bssn-no-1-tahun-2024
6. 6.nusantaradfdl.com/insights/indonesia-personal-data-protection-law-gr-33-2026/
7. 7.ssek.com/blog/indonesia-cybersecurity-laws-and-regulations/
8. 8.ssek.com/blog/fortifying-indonesias-cyber-defenses-new-regulations-for-nationa
9. 9.ap-lawsolution.com/actio/regulatory-update-indonesias-draft-law-on-cybersecurity-and-cyb
10. 10.en.tempo.co/amp/2087753/why-lokataru-finds-indonesias-cybersecurity-bill-concerni
11. 11.ojk.go.id/id/regulasi/Pages/Penyelenggaraan-Teknologi-Informasi-oleh-Bank-Umum.
12. 12.jdih.kominfo.go.id/