Personal Data Incident Response Requirements in Indonesia
This is breach-response evidence planning, not legal advice or compliance confirmation. Operator and qualified Indonesian legal review are required for incident characterization, applicable obligations, recipients, public-notification decision, and final notice. Source checked 2026-08-13: official BPK JDIH record and PDF for UU No. 27 Tahun 2022.
Statutory text and planning interpretation
Pasal 46 ayat (1) states that where a failure of personal-data protection occurs, Pengendali Data Pribadi must give written notification no later than 3 x 24 (tiga kali dua puluh empat) jam to data subjects and the institution. Pasal 46 ayat (2) huruf a–c states minimum notice content: personal data exposed; when and how it was exposed; and handling and recovery efforts. Pasal 46 ayat (3) states that, in certain circumstances, controller must notify public.
This text does not say clock always starts on discovery or confirmation. It does not name institution, define certain circumstances in that paragraph, mandate a RACI, or prescribe evidence retention. Timeline, RACI, and decision workflow below are implementation interpretation for preserving facts and routing questions. They do not determine legal outcome.
First hour: preserve facts without speculation
Open incident record with unique ID, reporter, time received, systems, containment actions, and access restrictions. Preserve volatile and durable evidence under approved forensic process: alert IDs, relevant logs, cloud audit records, access histories, system time sources, screenshots, hashes, and custody record. Make working copies; protect originals. Do not collect extra personal data, alter logs, or state data was exposed before evidence supports that conclusion.
Example: at 08:40 a storage alert identifies public access on document bucket. Engineer removes public rule at 08:48 and captures policy export, object access log range, and change ID. Incident lead marks exposure scope as unknown, not “no impact.” Legal reviewer receives factual timeline and exact uncertainty.
Timeline and notification-decision record
| Record | Completed example | Evidence | Owner | Pass/fail | Exception or remediation |
|---|---|---|---|---|---|
| Event timeline | 08:40 alert, 08:48 containment, 09:05 log preservation | case record, synchronized timestamps | incident lead | Pass | time source verified |
| Pasal 46 question | possible protection failure escalated to legal review | LEGAL-119, factual brief | legal lead | Open | legal conclusion pending |
| 3 x 24-hour record | statutory wording recorded; start-point not assumed | counsel note, timeline | privacy owner | Pass | confirm trigger with counsel |
| Notice contents | data category, when/how, handling/recovery draft fields prepared | versioned draft | communications owner | Open | facts incomplete |
| Recipient evidence | delivery method and receipt plan recorded | recipient register | incident coordinator | Fail | institution recipient unresolved |
Pass means planning evidence exists and is traceable. It does not mean notification duty is discharged. Open means facts or authorized decision are unresolved. Fail means missing evidence requires named remediation.
RACI for operational routing
| Activity | Responsible | Accountable | Consulted | Informed |
|---|---|---|---|---|
| Preserve evidence and containment facts | incident response lead | incident commander | system owner, security | legal, privacy |
| Scope data and affected systems | system/data owner | incident commander | security, vendor | privacy |
| Determine legal interpretation and notice decision | legal reviewer | authorized management | privacy, incident lead | communications |
| Draft approved factual notice | communications owner | authorized management | legal, privacy | support team |
| Send and retain delivery evidence | incident coordinator | authorized management | legal, communications | incident team |
Names and delegated authority must be filled before incident. No role label substitutes for authority. When responsible or accountable person is unavailable, record escalation path and elapsed time.
Preservation and decision workflow
- Stabilize safety and contain under authorized incident procedures.
- Preserve original evidence and build a timestamped fact ledger.
- Separate confirmed facts, assumptions, and unanswered questions.
- Route factual package to legal and authorized management for Pasal 46 applicability, recipient, timing, and public-notification decisions.
- Draft only minimum factual content supported by evidence; version each draft and approval.
- Record delivery, recipients, transmission time, failures, and post-notification recovery actions.
- Run after-action review, retain decision trail per approved policy, and open remediation items.
Notification-decision closure
Before any notice leaves, coordinator compares approved draft with fact ledger: exact data category, supported event time and mechanism, handling/recovery actions, recipient decision, approval identity, transmission record, and failed-delivery follow-up. Example INC-204 remains Open when bucket logs prove public configuration but cannot prove object access; draft must say only supported facts or wait for authorized decision. Legal reviewer and designated operator retain explicit gate for applicability, timing, recipient, and public statement. Sending a draft or starting a timer does not close this decision record.
Limits
Do not call this workflow legal compliance, an automatic 72-hour-from-discovery rule, or an instruction to notify public for every incident. It helps preserve evidence for authorized decision makers. Consult qualified Indonesian counsel and designated operator before notification or external statements.
Sources
Worked decision record
For suspected exposure from misconfigured object store, preserve discovery time, affected object prefix, access-log availability, containment action, and uncertainty register. Expected behavior: technical team supplies facts while authorized privacy and legal owners decide notification duties from current law and case facts. Edge case: logs incomplete or retention elapsed; document limitation and alternate evidence, never infer affected people. Closure test: validate containment, revocation, evidence custody, decision owner, and follow-up review; do not label legal compliance achieved.
Worked closure check
For suspected object-store exposure, preserve incident ID, discovery and containment times, bucket configuration revision, available log range, privacy owner, and counsel decision reference. Facts in this record support incident handling, not a determination of UU PDP applicability, notification duty, compliance, certification, or legal outcome. New access evidence or altered retention settings require timeline update and authorized reassessment. Independent reviewer follows one notice fact from source log through approved draft and delivery register, while uncertainty and failed delivery remain explicit.