DPR Highlights Gaps in Cybersecurity and Resilience Bill
The House of Representatives’ Commission I commenced discussions on the Cybersecurity and Resilience Bill with the government on Monday, 29 June 2026. All eight factions agreed to bring the draft to the working committee stage. However, from the outset, several members cautioned against rushing the deliberation, noting that the bill still contains many substantive gaps.
Commission I Chairman Utut Adianto stressed that the bill would serve as a new foundation for national cybersecurity governance. He said its deliberation must be carried out carefully and involve parties who understand best practices in the digital security field. “This is new. A new law like this must be taken seriously,” Utut said during a working meeting with the government today.
The PDIP politician highlighted a crucial section concerning cybercrime offences that currently have no equivalent in other regulations. According to Utut, the bill will be a cornerstone for Indonesia in facing future digital security challenges. “This is to welcome Indonesia’s future. Because the future is about cyber security, the internet, and so on,” he said.
During the meeting, Deputy Minister of Law Edward Omar Sharif Hiariej read out the president’s explanation. The government stated that the bill was drafted as a basis for implementing national cybersecurity and resilience, while also protecting information infrastructure—particularly critical infrastructure—which is often the target of cyberattacks.
The deliberation of this legislation comes amid a rise in data breach incidents and cyberattacks in recent years. A number of cases targeting public services and government electronic systems have increased pressure for Indonesia to have a specific legal umbrella governing cybersecurity management.
The government proposed at least ten key points of regulation in the bill. These include obligations for information infrastructure operators to protect their managed systems, enhancement of human resources and technology capacity, international cooperation, strengthening the government’s role in setting cybersecurity standards, technical incident audits, public participation, funding, investigations, administrative sanctions, and criminal provisions for cybercrimes not yet regulated in other laws.
Despite agreeing to proceed with the discussion, several factions raised critical notes. The National Awakening Party (PKB) faction assessed that the government’s explanation was insufficient in addressing inter-ministerial and institutional coordination issues, which have been a weak point in cybersecurity management. The PKB also highlighted the use of the term “critical information infrastructure” in the bill, comparing it with the term “vital information infrastructure” used in Presidential Regulation Number 82 of 2022. They argued that this discrepancy needs clarification to avoid multiple interpretations.
The Golkar Party faction corrected wording differences in the government’s explanatory text, particularly regarding the terms “national stability” and “economic stability”. Golkar also reminded that provisions for rewarding operators of critical information infrastructure should not become the main focus of the law’s implementation.
Meanwhile, the Democratic Party faction expressed hope that strengthening the government’s role through this bill would end the practice of shifting responsibility among institutions when cyber incidents occur.
The meeting ultimately agreed to form a working committee to discuss the bill with the government. Utut requested that the government prepare a team with adequate technical capacity, given that the discussions will touch on complex aspects, including criminal provisions and other technical details.