Current as at 24 October 2026.
What must an Indonesian business do with customer personal data?
An Indonesian business handling customer personal data should set a lawful basis for using it, which is a reason the law accepts for collecting and keeping a person’s details, explain its purpose, restrict access, protect the information, and prepare to respond to requests and incidents. Indonesia’s Personal Data Protection Law has applied since 2022, so these duties are in force now, and a 2026 implementing regulation adds the operating detail from January 2027. A practical first step is to find where the records are kept and who can use them.
In a tourism booking business, for example, one employee receives identity documents on a WhatsApp message, a second maintains a spreadsheet, and an outside provider handles payments. Each arrangement is convenient on its own, and together they place one customer’s personal data in three separate places at once, outside any single system. The business then has to locate each copy, establish the lawful basis for keeping it, name who can reach it, and set what happens to that access when a staff member leaves or a provider changes.
A manageable review starts with that everyday workflow. The purpose is to give the business control over information it already collects, and to reduce avoidable exposure for the people who trusted it with their details.
What is new under the 2026 implementing regulation?
The Personal Data Protection Law, Law Number 27 of 2022, has applied since October 2022, and its substantive duties are enforceable now. Its implementing regulation, Government Regulation Number 33 of 2026, takes effect on 16 January 2027 and fills in the operating detail, so a business has a defined date to have that detail in place.
A few points shape the work before that date. The regulation confirms six lawful bases and requires a documented assessment where a business relies on legitimate interest. The law itself sets the administrative sanctions, which run from a written warning and a suspension of processing to an order to delete data and a fine of up to 2 per cent of annual revenue assessed against the violation, under Article 57 of the law. The national data protection authority had not yet been formed at the time of writing, so Komdigi applies the rules in the interim, and some steps that depend on the authority are not yet available, so confirm the current position before you rely on it.
Those sanctions are a commercial risk rather than a paperwork point. For a small business, 2 per cent of revenue can be a large share of a year’s profit, and a suspension of processing stops a business whose daily work is taking and fulfilling bookings. Using the runway reduces that exposure: a review completed before January 2027 makes readiness ordinary rather than rushed, though it does not by itself guarantee compliance.
What counts as personal data in everyday operations?
Law Number 27 of 2022 distinguishes general and specific personal data. General personal data is the everyday information that identifies a person, such as a name, a telephone number, an address or an identity-document number. Specific personal data, which includes health, biometric, children’s and personal financial information, needs particular care within the law’s categories.
Walk through a customer journey from the first enquiry to the final follow-up. Identify the information requested, where it goes, who receives it, and why it remains after the transaction. Include chat attachments, spreadsheets, email, paper copies and shared drives, as well as the main customer system, because personal data rarely stays in one place.
Do the same for staff records. A company may have useful controls around its booking platform while leaving recruitment documents and payroll exports in a folder open to everyone. TraceWorthy’s first-hire article addresses the decision to employ someone, and information handling belongs in the operating arrangements that follow that decision.
Do you need consent for everything?
Article 20 of the law recognises several processing bases, which include explicit consent, the performance of a contract, a legal obligation, the protection of vital interests, a public interest or official authority, and a legitimate interest. A legitimate interest is a real business need that does not override the individual’s rights, and where a business relies on it the implementing regulation requires a short documented assessment weighing the need against those rights, which a small business can usually prepare with guidance rather than as a large project. Identify the appropriate basis for each use, rather than assuming that one general consent statement covers every purpose.
In practical terms, separate the information needed to deliver a service from information collected for another activity. If a team plans to reuse a customer list for a new campaign, ask whether that use has been assessed and properly explained. A familiar customer relationship does not answer the question by itself.
Make the explanation readable at the point where information is requested. The customer should be able to understand what is needed, the purpose it serves, and where to raise a concern. An adviser can then assess whether the wording, the actual workflow and the chosen processing basis agree with one another.
How can you check who has access?
Start with a list of systems and the person responsible for each. For each one, identify who can view records, export a list, add another user, or change the recovery details. Separate the person who owns the business process from the provider who operates the software, because the two roles involve different responsibilities.
Use individual accounts where practical, permissions suited to the role, and strong authentication. Limit routine access to the information a role needs, and make the removal of access part of an employee or contractor’s departure, including shared folders and business chat groups.
These are governance controls that make access visible and reviewable, and they are separate from any claim that one setup guarantees legal compliance. The technical security of the systems themselves is a specialist field, so TraceWorthy’s part is the mapping, the access rules and the lawful basis, and a security specialist hardens the systems. A business owner should be able to ask who can download the customer list and receive a current answer, without searching several phones to find it.
What should you ask an outside provider?
Ask what information the provider receives, the instructions it follows, where records are stored, whether another provider is involved, and how information can be returned or deleted when the arrangement ends. Document those responsibilities and an escalation contact in the agreement. Where the provider’s terms are standard and cannot be amended, which is usual for a payment gateway, a channel manager or a messaging service, document an internal risk assessment of the service and how your staff use it, rather than a negotiation you are not in a position to win.
A provider’s security statement is useful evidence, and it still needs to be read against the way your business uses the service. A restricted system can become a much wider exposure when an employee regularly exports its records to a personal account.
Overseas processing deserves a specific check. Article 56 of the law sets conditions for cross-border transfers through a sequence: first a country the authority has assessed as giving adequate protection, then binding safeguards between the parties in a form the authority recognises, and consent where neither route is available. An adequacy determination depends on the authority making it, and a recognised safeguard depends on instruments the authority is to provide, so until the authority is constituted many transfers rest on consent with a risk assessment. Consent is a fragile basis for a transfer, because an individual can withdraw it, so obtain advice on the route that applies before you assume a familiar international service resolves the position, and do not treat consent as a settled answer.
How long should customer records be kept?
Set retention periods by purpose and by the obligations that apply. Some records need to remain for tax, contractual or dispute reasons, and other copies may have no continuing business purpose. A blanket rule to delete everything after a fixed number of days can remove records that those obligations require the business to keep.
Record the agreed approach by category, and assign the review to a named person. Ask how duplicate attachments and exports are handled, because deleting a record in the main system can leave copies elsewhere. Where records must remain, restrict access to them rather than leaving them in everyday working folders.
This is a useful point to simplify the operation. If nobody can explain why a field is requested or a copy is retained, examine whether it is needed before building a more elaborate system to protect it.
What happens if information is exposed?
Prepare an incident contact and a response process before there is a problem. Staff should know how to report a data breach such as a misdirected attachment, a lost device or unexpected access promptly, how to preserve the relevant facts, and how to avoid circulating the exposed material further.
Article 46 of the law sets a written notification requirement within 3 x 24 hours (72 hours) of a personal-data protection failure, which is a data breach, to the affected people and the authority the law specifies. The 72-hour clock runs from when the business establishes, on reasonable grounds, that a failure has occurred, rather than from the moment of exposure, so the response process should record when that point was reached. Because the national authority is still being formed, confirm the current reporting channel as part of taking advice on the incident. This is a general description of the rule and not advice for a particular incident, so obtain advice when one arises.
Do not wait for the next scheduled meeting to begin that assessment. A small business rarely has the right person in-house and the clock runs through nights and weekends, so the response needs someone authorised to coordinate containment, evidence and advice, and a standing relationship with an adviser, before the clock starts.
What records should the review leave behind?
TraceWorthy frames the output as a small data file the next person can use: a map of where personal data is kept, a note of the lawful basis for each main use, a list of outside providers and the terms that govern them, a retention approach by category, and a named incident contact. Keep these together and dated, so a new manager, an adviser or the business owner can see the current position without rebuilding it. The aim is a working record that a small team can maintain, rather than a policy document that is written once and never opened again.
Where should a small business begin?
A first pass over one process answers five questions:
- what personal data the process collects, and where each piece of it is kept;
- who can see, export or change that data, and whether any of that access is no longer needed;
- which outside providers receive the data, and on what terms;
- how long each category is kept, and who reviews that retention; and
- who the incident contact is, and how a problem reaches them inside the 72-hour window.
Choose one process, such as bookings or recruitment, and map it from collection to disposal. Correct the most obvious access and copying problems, document the unresolved legal questions, and assign responsibility for the review. Expand to the next process once the first has a workable record.
Discuss the governance questions with TraceWorthy if you need help deciding who should own the work, and what specialist advice the business requires. An initial discussion should set the scope, rather than assume that every business needs the same system, and it should pace the work against the January 2027 date so the work is ordered rather than rushed.
This article is general information and is current as at 24 October 2026. Data protection rules and their implementing detail are developing, the national authority is still being formed, and the position for any business depends on its own processing and facts, so obtain advice for your own situation before you act. This article does not constitute legal advice, and it creates no advisory relationship.
Frequently asked questions
Yes. Include personal information wherever the business collects, stores or shares it, rather than reviewing only the main software platform. A spreadsheet of customer details and a chat group with identity documents are both within scope.
Article 53 of the law sets the circumstances that require the relevant function, such as large-scale processing or the regular monitoring of individuals. Assess the business against those conditions, because assigning an operational contact does not by itself settle the statutory appointment question.
Consent is not the only lawful basis. Article 20 recognises several bases, which include contract performance, legal obligation and legitimate interest. The business should assess the basis appropriate to each purpose and meet the requirements that attach to it.
Cross-border processing needs an assessment under the applicable transfer rules and the actual service arrangement, and while the national authority is still being formed, many transfers rest on consent, which an individual can withdraw. The provider’s popularity does not establish compliance, so confirm the route that applies with advice before the data leaves Indonesia.