Understanding the One Data Indonesia Act
Read Time: 5 minutes
The One Data Indonesia Act (Satu Data Indonesia or SDI), passed on 6 October 2026, sets one national framework for how data is produced, managed, shared, and protected, so that data from different sources follows common standards. It raises the framework under Presidential Regulation No. 39 of 2019 to statutory level and extends it to corporations and other non-government parties. The Act introduces data sovereignty, cross-border transfer, and security obligations, with criminal penalties of four to fifteen years’ imprisonment depending on the offense.
Data Classifications
The Act classifies data into three types. The Act and its implementing regulations set the access and exchange conditions for each.
1. Open data: accessible to the public under applicable rules.
2. Restricted data: Access is subject to conditions. Non-government parties are charged fees, with levels to be set in implementing regulations.
3. Closed data: access is restricted by law and requires access control and security measures. Cross-border access and transfer require DPR approval.
Key Operational and Data Sovereignty Obligations
|
Area |
Key requirement |
|
Corporate Data Custodian |
Corporations must designate a party or unit as a Corporate Data Custodian. |
|
Data Standards |
Producers must apply national data and security standards and ensure data validity and quality. |
|
Data Sovereignty |
Data managed within the SDI ecosystem is subject to national data sovereignty and Indonesian jurisdiction. |
|
Cross-Border Transfers |
Cross-border data access and transfers must preserve national data sovereignty, data security, and national interests, and comply with personal data protection laws where personal data is involved. |
|
Security |
Producers and Custodians must apply security by design and by default. |
|
Security Audits |
Producers, Custodians, and Users must conduct periodic data security and data sovereignty audits. |
|
Incident Reporting |
Data security incidents must be reported within 24 hours. |
|
Purpose Limitation |
Data may only be used for the purpose declared at the time of access, subject to specified exceptions. |
|
Restricted DDN Access |
Non-government parties must pay fees for access to restricted National Basic Data (DDN). Access generating economic value is recorded as non-tax state revenue. |
What Business Should Do?
-
Data Mapping: Map data storage locations and cross-border transfers against the proposed sovereignty requirements.
-
Custodian Setup: Prepare to designate a Corporate Data Custodian unit.
-
Procedure Review: Review security audit and incident-response procedures against the 24-hour reporting requirement.
-
Regulatory Monitoring: Monitor the issuance of implementing regulations, due within one year of enactment.