Personal Data Protection in Indonesia’s Digital Public Services: Implementation and Accountability
DOI:
https://doi.org/10.65310/8grxvt91Keywords:
Accountability, Digital Public Services, Indonesia, Personal Data Protection, Public Sector.Abstract
Indonesia's integrated digital public services create legal accountability challenges concerning the collection, exchange, and subsequent use of personal data across government institutions. This study examines whether Indonesia's personal-data protection framework establishes coherent legal responsibilities and safeguards for public-sector processing. A normative-doctrinal research design applies statutory, conceptual, and comparative legal analysis to Law No. 27 of 2022, digital-government regulations, Constitutional Court Decision No. 151/PUU-XXII/2024, and Government Regulation No. 33 of 2026. Public-sector cybersecurity incidents serve as documentary illustrations rather than empirical proof of statutory violations. The findings establish that governmental processing must satisfy recognized lawful bases, purpose-related limitations, security obligations, and identifiable controller responsibilities. However, statutory completeness does not itself demonstrate consistent institutional compliance, particularly across interconnected processing activities and supervisory arrangements. Government Regulation No. 33 of 2026, promulgated in July 2026, provides additional implementing provisions but does not enter into force until January 2027. The analysis identifies a need for documented processing responsibilities, risk assessment, verifiable audit records, and effective institutional supervision. These mechanisms constitute operational recommendations grounded in statutory and comparative analysis. The study concludes that Indonesia's principal normative challenge concerns translating established legal obligations into demonstrable, traceable, and independently reviewable accountability across digital public services.
Downloads
References
Chick, R. C., Clifton, G. T., Peace, K. M., Propper, B. W., Hale, D. F., Alseidi, A. A., & Vreeland, T. J. (2020). Using technology to maintain the education of residents during the COVID-19 pandemic. Journal of surgical education, 77(4), 729-732. https://doi.org/10.1016/j.jsurg.2020.03.01
Abdurrahman, M., Suherman, D., Bhimasena, A., & Carlos, F. M. (2025). Indonesia’s digital transformation: How e-government is revolutionizing public services. Indonesia Discourse, 2(1), 107–134. https://doi.org/10.15294/indi.v2i1.23037
Alatas, H. H. R. A., & Djajaputra, G. (2025). Examining Indonesian government accountability and mitigation measures in the 2024 taxpayer identification number data breach. Jurnal Ilmu Hukum Kyadiren, 7(2). https://doi.org/10.46924/jihk.v7i2.385
Alsarraf, H. A., Aljazzaf, S., & Ashkanani, A. M. (2023). Do you see my effort? An investigation of the relationship between e-government service quality and trust in government. Transforming Government: People, Process and Policy, 17(1), 116–133. https://doi.org/10.1108/TG-05-2022-0066
Bowen, C. M. (2024). Government data of the people, by the people, for the people: Navigating citizen privacy concerns. Journal of Economic Perspectives, 38(2), 181–200. https://doi.org/10.1257/jep.38.2.181
Distel, B., Koelmann, H., Plattfaut, R., & Becker, J. (2022). Watch who you trust! A structured literature review to build a typology of e-government risks. Information Systems and e-Business Management, 20, 789–818. https://doi.org/10.1007/s10257-022-00573-4
Eom, S.-J., & Lee, J. (2022). Digital government transformation in turbulent times: Responses, challenges, and future direction. Government Information Quarterly, 39(2), 101690. https://doi.org/10.1016/j.giq.2022.101690
European Union. (2016). Regulation (EU) 2016/679 (General Data Protection Regulation). https://eur-lex.europa.eu/eli/reg/2016/679/oj
Figueroa, V., Sánchez Crespo, L. E., Santos-Olmo, A., Rosado, D. G., & Fernández-Medina, E. (2025). Building a holistic cybersecurity framework for e-government based on a systematic analysis of proposals. International Journal of Information Security, 24, 121. https://doi.org/10.1007/s10207-025-01024-0
Gerunov, A. A. (2022). A privacy-by-design implementation methodology for e-government. International Journal of Electronic Government Research, 18(1), 1–20. https://doi.org/10.4018/IJEGR.288067
General Elections Commission of the Republic of Indonesia. (2023). National final voter list for the 2024 election: 204,807,222 voters. https://www.kpu.go.id/
Gray, J. W. Y. (2023). What do data portals do? Tracing the politics of online devices for making data public. Data & Policy, 5, e10. https://doi.org/10.1017/dap.2023.7
Gupta, P., Hooda, A., Jeyaraj, A., Seddon, J. J. M., & Dwivedi, Y. K. (2025). Trust, risk, privacy and security in e-government use: Insights from a MASEM analysis. Information Systems Frontiers, 27, 1089–1105. https://doi.org/10.1007/s10796-024-10497-8
Huang, Z.-X., & Huang, T.-Y. (2023). Privacy calculus theory in the digital government context: The case of Taiwan’s new eID policy. Social Science Computer Review, 41(5), 1745–1766. https://doi.org/10.1177/08944393221117500
Jansen, B., Kadenko, N., Broeders, D., van Eeten, M., Borgolte, K., & Fiebig, T. (2023). Pushing boundaries: An empirical view on the digital sovereignty of six governments in the midst of geopolitical tensions. Government Information Quarterly, 40(4), 101862. https://doi.org/10.1016/j.giq.2023.101862
Kanaan, A., Al-Hawamleh, A., Abulfaraj, A., Al-Kaseasbeh, H. M., & Alorfi, A. (2023). The effect of quality, security and privacy factors on trust and intention to use e-government services. International Journal of Data and Network Science, 7(1), 185–198. https://doi.org/10.5267/j.ijdns.2022.11.004
Kementerian Komunikasi dan Digital Republik Indonesia. (2026, 22 Juli). Indonesia menyiapkan otoritas perlindungan data pribadi yang independen.
Kementerian Komunikasi dan Informatika Republik Indonesia. (2024, 24 Juni). BSSN identifikasi serangan ransomware pada Pusat Data Nasional Sementara.
Lestari, Y., & Mujib, M. M. (2022). Optimizing personal data protection legal framework in Indonesia: A comparative law study. Supremasi Hukum, 11(2). https://doi.org/10.14421/sh.v11i2.2729
Li, Y., & Shang, H. (2023). How does e-government use affect citizens’ trust in government? Empirical evidence from China. Information & Management, 60(7), 103844. https://doi.org/10.1016/j.im.2023.103844
Li, Y., Yang, R., & Lu, Y. (2024). A privacy risk identification framework of open government data: A mixed-method study in China. Government Information Quarterly, 41(1), 101916. https://doi.org/10.1016/j.giq.2024.101916
Mahkamah Konstitusi Republik Indonesia. (2025). Putusan Nomor 151/PUU-XXII/2024.
Pham, L., Limbu, Y. B., Le, M. T. T., & Nguyen, N. L. (2023). E-government service quality, perceived value, satisfaction, and loyalty: Evidence from a newly emerging country. Journal of Public Policy, 43(4), 812–833. https://doi.org/10.1017/S0143814X23000296
Rahman, F. (2025). Safeguarding personal data in the public sector: Unveiling the impact of the new Personal Data Protection Act in Indonesia. UUM Journal of Legal Studies, 16(1), 1–18. https://doi.org/10.32890/uumjls2025.16.1.1
Rahman, F., & Mulyani, C. K. (2025). Minimising unnecessary restrictions on cross-border data flows? Indonesia’s position and challenges post personal data protection act enactment. International Review of Law, Computers & Technology, 39(2), 281–300. https://doi.org/10.1080/13600869.2024.2359901
Razi, F., Tuasikal, H., & Markus, D. P. (2024). Implementation and challenges of the Personal Data Protection Law in Indonesia. Jurnal Indonesia Sosial Teknologi, 5(12), 6559–6565. https://doi.org/10.59141/jist.v5i12.1285
Republik Indonesia. (2018). Peraturan Presiden Nomor 95 Tahun 2018 tentang Sistem Pemerintahan Berbasis Elektronik.
Republik Indonesia. (2022). Undang-Undang Nomor 27 Tahun 2022 tentang Perlindungan Data Pribadi.
Republik Indonesia. (2023). Peraturan Presiden Nomor 82 Tahun 2023 tentang Percepatan Transformasi Digital dan Keterpaduan Layanan Digital Nasional.
Republik Indonesia. (2024). Peraturan Presiden Nomor 174 Tahun 2024 tentang Kementerian Komunikasi dan Digital.
Republik Indonesia. (2026a). Peraturan Pemerintah Nomor 33 Tahun 2026 tentang Pelaksanaan Undang-Undang Nomor 27 Tahun 2022 tentang Perlindungan Data Pribadi.
Riemann, L. T., Hähner, F. P. S., Schmitz, A.-K., Ataian, M., Jaster, M., & Ückert, F. (2023). An open-source software tool to facilitate data protection impact assessments. Applied Sciences, 13(20), 11230. https://doi.org/10.3390/app132011230
Roselin, S., & Syailendra, M. R. (2025). Personal data subject rights protection: A comparative study between Indonesian PDP Law and the UK Data Protection Act. Jurnal USM Law Review, 8(2), 825–835. https://doi.org/10.26623/julr.v8i2.12076
Rukanova, B., van Engelenburg, S., Ubacht, J., Tan, Y.-H., Geurts, M., Sies, M., Molenhuis, M., Slegt, M., & van Dijk, D. (2023). Public value creation through voluntary business-to-government information sharing enabled by digital infrastructure innovations: A framework for analysis. Government Information Quarterly, 40(2), 101786. https://doi.org/10.1016/j.giq.2022.101786
Safitri, M. Y., & Mahfud, M. (2023). The ASEAN cross-border personal data transfer instrument: Has Indonesia’s Personal Data Protection Law followed it? Jurnal Magister Hukum Udayana, 12(3). https://doi.org/10.24843/JMHU.2023.v12.i03.p06
Spinelli, M., & Terzidou, K. (2022). Quis custodiet ipsos custodes? Data protection in the judiciary in EU and EEA Member States. International Data Privacy Law, 12(2), 93–112. https://doi.org/10.1093/idpl/ipac002
Syailendra, M. R., Lie, G., & Sudiro, A. (2024). Personal data protection law in Indonesia: Challenges and opportunities. Indonesia Law Review, 14(2), Article 4. https://doi.org/10.15742/ilrev.v14n2.4
Syifa, S. N., Abdillah, M. T., & Fadil, S. J. (2025). The legal responsibility of the General Elections Commission in the 2024 election data leak: Integration of personal data protection laws and the principle of Sadd al-Dharī‘at. Justicia Islamica, 22(1). https://doi.org/10.21154/justicia.v22i1.10390
Tan, W., Karo Karo, R. P. P., Situmeang, A., Rusdiana, S., & Abd Razak, S. S. (2025). Protection of public services personal data in the delivery of public services: Comparative study in Indonesia and Malaysia. SASI, 31(1), 33–43. https://doi.org/10.47268/sasi.v31i1.2415
Taufiq, M., & Kenyo, A. S. (2025). The legal protection of personal data in the digital era: A comparative study of Indonesian law and the GDPR. International Journal of Business, Law, and Education, 6(2). https://doi.org/10.56442/ijble.v6i2.1178
Virnandes, S. R., Shen, J., & Vlahu-Gjorgievska, E. (2024). Building public trust through digital government transformation: A qualitative study of Indonesian civil service agency. Procedia Computer Science, 234, 1183–1191. https://doi.org/10.1016/j.procs.2024.03.114
Widiatedja, I. G. N. P., & Mishra, N. (2023). Establishing an independent data protection authority in Indonesia: A future-forward perspective. International Review of Law, Computers & Technology, 37(3), 252–273. https://doi.org/10.1080/13600869.2022.2155793
Yusliwidaka, A., Abqa, M. A. R., & Wardana, K. A. (2024). A discourse of personal data protection: How Indonesia responsible under domestic and international law? Pandecta Research Law Journal, 19(2), 453–482. https://doi.org/10.15294/pandecta.v19i2.13279
Zhao, Y., Liang, Y., Yao, C., & Han, X. (2022). Key factors and generation mechanisms of open government data performance: A mixed methods study in the case of China. Government Information Quarterly, 39(4), 101717. https://doi.org/10.1016/j.giq.2022.101717
