Indonesia recorded 5.5 billion cyberattacks: Is data protection ready?

Two years into the Prabowo–Gibran administration, Indonesia continues to develop its personal data protection framework through regulatory and institutional initiatives.

Jakarta (ANTARA) - Almost every aspect of daily life, particularly digital activities such as shopping through apps, banking, accessing healthcare, and handling administrative tasks online, generates personal data.

While digital services offer convenience, they also pose risks when personal information is collected, stored, or used without adequate safeguards.

The scale of Indonesia’s digital threats is reflected in data from the National Cyber and Crypto Agency (BSSN), which recorded 5.5 billion cyberattacks in 2025. This figure represents a 714 percent increase over the annual average for the 2020–2024 period.

From January 1 to April 15, 2026, a further 1.52 billion cyberattacks were recorded. The threats include attempts to steal personal data, online fraud, and unauthorized access to computer systems.

These figures do not mean that every attack resulted in a data breach. Nevertheless, the sheer volume underscores the need to make data protection a core component of Indonesia’s digital security framework.

Indonesia enacted Law No. 27 of 2022 on Personal Data Protection (PDP Law) to safeguard individuals’ rights over their personal information. The law recognizes personal data protection as a fundamental right.

Under the law, responsibility for protecting personal data rests not only with individuals but also with the entities that collect and process it.

Government agencies and private companies must ensure that personal data is processed for legitimate purposes, kept secure, and protected against misuse.

Clearly defining these responsibilities is increasingly important as digital services become more interconnected and data sharing across sectors expands.

Overseeing PDP Law

The next challenge is ensuring that these legal protections are effectively implemented.

Two years into the administration of President Prabowo Subianto and Vice President Gibran Rakabuming Raka, attention has increasingly turned to regulatory implementation, compliance, and the establishment of a dedicated authority to oversee personal data protection.

Effective enforcement requires detailed implementing regulations that clarify data management obligations for government agencies and businesses. Without clear technical guidance, the law risks being applied inconsistently across sectors.

Deputy Minister of Communication and Digital Affairs Nezar Patria has said that the Ministry of Law is harmonizing the implementing regulations for the PDP Law. The government is carefully drafting the rules to address cybersecurity concerns and emerging technologies.

The process also involves coordination among ministries and government institutions. Participants include the Ministry of Law, the Financial Services Authority (OJK), Bank Indonesia, BSSN, the Ministry of Finance, the Attorney General’s Office, the National Police, and the Ministry of State Secretariat.

While the regulatory process continues, the Ministry of Communication and Digital Affairs remains responsible for overseeing digital platform operators. This interim oversight is important to ensure that data protection efforts continue while the dedicated supervisory authority is being established.

In its 2025 Performance Report, the ministry stated that it had followed up on 130 potential personal data protection violations involving registered platform operators, including 112 websites and 18 mobile applications.

The ministry also assessed the implementation of personal data protection measures by 64 operators, reporting a compliance rate of 78 percent.

Its oversight activities also include responding to incidents, receiving complaints, providing consultations, assessing operators, and investigating websites suspected of illegally trading personal data.

These measures allow the government to follow up on potential violations while encouraging service providers to improve their data management practices.

Establishing a supervisory authority

The ministry’s current oversight role serves as an interim arrangement ahead of the establishment of a dedicated personal data protection authority.

The PDP Law mandates the creation of a supervisory body accountable directly to the president. Its responsibilities include overseeing compliance, imposing administrative sanctions, and facilitating the resolution of personal data protection disputes.

The process of establishing the authority has progressed through several stages. The draft presidential regulation establishing the authority received approval to proceed as a presidential initiative on March 4, 2025.

The draft subsequently underwent interministerial discussions between March and September 2025 before entering the harmonization stage in October 2025.

Deputy Minister Nezar Patria has stated that the government is working to finalize the authority’s establishment. The proposed body is intended to operate independently of individual ministries, with reports submitted to the president through the Ministry of Communication and Digital Affairs.

Ultimately, the effectiveness of personal data protection cannot be measured solely by the number of regulations introduced or the establishment of a supervisory authority. Its real impact lies in whether the public can trust that the personal information they share is handled responsibly.

The government must ensure that implementing regulations and oversight mechanisms are enforced effectively, while service providers must strengthen compliance with their data protection obligations.

The public, meanwhile, needs clear information about its rights and the steps to take when personal data is suspected of being misused.

Amid rapid technological change, data protection should not be viewed as an obstacle to innovation. Clear rules on individuals’ rights, operators’ responsibilities, and the handling of violations are essential to building trust in digital services.

Two years into the Prabowo–Gibran administration, Indonesia continues to develop its personal data protection framework through regulatory and institutional initiatives.

The challenge now is to ensure that these efforts work together so that data protection does not remain merely a legal requirement on paper but becomes a meaningful safeguard in people’s daily lives.

Related news: Indonesia to set up independent personal data protection agency

Related news: Indonesian govt sets up complaint channel for data plan protection

Related news: Indonesia integrates government data to improve social aid targeting