Cybersecurity regulation in Indonesia (2026)

By October 2025 the draft Government Regulation implementing the PDP Law completed harmonization and was sent for presidential approval, while the Presidential Regulation establishing the long-awaited Personal Data Protection Agency entered its harmonization stage, with the agency targeted to become operational in 2026. This will finally provide a dedicated enforcement authority and detailed compliance rules for Indonesia's data-protection regime.

After being first proposed in 2019 and stalling for over five years, the Cyber Security and Resilience Bill (RUU KKS) was included among parliament's 2025 priority legislation; it would designate BSSN as central cyber authority but has drawn criticism over proposed military (TNI) roles and civil-liberties risks.

The two-year transition period under Law No. 27 of 2022 expired, so all data controllers and processors must now fully comply with Indonesia's comprehensive personal data protection obligations, including security and breach-notification duties, even though the dedicated supervisory agency was not yet operational.

A LockBit 3.0-derived ransomware attack on the Temporary National Data Center in Surabaya disrupted 282 public services including immigration and passports, with attackers demanding USD 8 million; the government refused to pay and BSSN's forensics found Windows Defender had been disabled, exposing severe weaknesses in government cyber governance.

The President signed the second amendment to the 2008 Electronic Information and Transactions Law, revising contested criminal provisions, raising fines, and requiring electronic certification service providers to be Indonesian-domiciled legal entities, reshaping rules governing the digital space and electronic trust services.

President Jokowi issued Perpres 82/2022 mandating BSSN to coordinate protection of vital information infrastructure across strategic sectors (government, energy, finance, health, transport, defense, etc.), requiring operators to apply risk management, incident readiness, and coordination with BSSN.

Personal data of over 279 million citizens — ID numbers, addresses, phone numbers, salaries — allegedly from health-insurer BPJS Kesehatan was offered for sale on a hacking forum; the police-investigated incident underscored Indonesia's weak data protection and helped build momentum for the PDP Law.

GR 71/2019 (replacing GR 82/2012) classified operators into public and private ESPs, required public operators to localize systems and data in Indonesia, mandated registration with the Ministry of Communications, and obliged operators to grant government supervisory access and report incidents to the cyber authority.

Presidential Regulation No. 53/2017 created BSSN by merging the National Crypto Agency (Lemsaneg) and the national cyber defense desk (DK2ICN), giving Indonesia a dedicated central agency for cyber defense, threat intelligence, and cryptography; its mandate was reaffirmed by Perpres 28/2021.

The first amendment to the 2008 ITE Law introduced the concept of electronic system providers, the 'right to be forgotten,' powers to terminate access to illegal content, and clarified criminal penalties, expanding the regulatory reach over Indonesia's digital ecosystem.