INDONESIA Trends and Developments Contributed by: Agus Ahadi Deradjat, Mahiswara Timur, Nina Cornelia Santoso and Dhan Partap Kaur, ABNR Counsellors at Law
ent and explicable, and robust and secure principles. In the banking sector, the OJK has issued Artificial Intelligence Governance for Indonesian Banking, which provides guidance for Indonesian banks on the responsible development and deployment of AI and reiterates the application of these principles in banking activities. In response to the increasing demand for AI-related regulations and infrastructures, the MOCD recently issued its Whitepaper Roadmap for AI (“AI Roadmap”), which includes the MOCD’s intention to support the development of AI and ways to optimise AI as part of Indonesia’s digital ecosystem development. The AI Roadmap includes the MOCD’s five-year programmes and goals related to the development of AI, including the intention to conduct research on AI, create regu - lations and policies regarding the use of AI, building AI infrastructures, and conducting harmonisation and standardisation on the interoperability of AI systems used in ministries and institutions. The AI Roadmap also addresses personal data protection aspects in the development, uses, and operation of AI. Update on cyber resilience Pursuant to the Indonesian Cyber Security Landscape published by the National Cyber and Crypto Agency in 2024, there were 56,128,160 data exposures that affected 461 stakeholders in Indonesia. As of August 2025, the National Cyber and Crypto Agency (BSSN) recorded a total of 3.64 billion cyber-attacks. Recur - ring data breaches in Indonesia highlight vulnerabilities in the country’s cybersecurity policies and systems, along with insufficient supervision and enforcement against perpetrators. The current legal framework requires reporting data breaches to the MOCD and notifying data subjects, while cybersecurity incidents without a data breach must be reported to regulators and law enforcement. Below are the regulatory regimes for data breach and cybersecurity incident notification: • PDP Law: Upon “failure to protect personal data”, the data controller must notify both the affected data subject and the Data Protection Authority within 72 hours. This includes breaches that impact confidentiality, integrity, or availability of personal
data, resulting in destruction, loss, alteration, or unauthorised access. • Electronic System Operation Regulations (GR 71/2019): An ESO must: (i) report to relevant authorities and law enforcement if there is a serious system failure due to third-party interference, and (ii) notify data subjects if personal data protection fails within its system. The BSSN has issued BSSN Regulation No 1 of 2024 on Cyber Incident Management (“BSSN Reg. 1/2024”) in an effort to combat the high number of cyber inci - dents, establishing Cyber Incident Response Teams (CIRTs) at a national, sectoral, and organisational level. CIRTs are expected to manage cyber incidents • mitigation and recovery from cyber incidents; and • reporting and dissemination of cyber incident infor - mation. The membership of the national CIRT consists of rep - resentatives from: • the BSSN; • ministries or institutions; • state-run institutions owning and/or operating vital information infrastructure (IIV); and • ESOs other than state-run institutions owning and/ or operating IIV. through the following steps: • handling of cyber incidents; Ministries and institutions are also required to create their own sectoral CIRT, while stare-run institutions owning and/or operating IIV and ESOs other than state-run institutions owning and/or operating IIV are required to form an organisational CIRT. The government is also preparing the Draft Regula - tion for Cyber Security and Resilience (“Cybersecurity Bill”), which is intended to strengthen national cyber - security protection. This Bill will regulate information infrastructure providers, critical information infrastruc - ture, and digital product/service providers to imple - ment stricter cybersecurity standards by combining upstream (requirements), midstream (monitoring, eval - uation, and assessment/reporting), and downstream (sanctions) approaches.
174 CHAMBERS.COM
Powered by FlippingBook