Indonesia's One Data Act: Unauthorised Data Sharing with NGOs and Media Faces 4-Year Prison Sentence

The One Data Indonesia (SDI) Law regulates the prohibition of unauthorised data sharing with several parties, carrying the threat of criminal penalties of up to four years.

This provision is stipulated in Article 130, which states, “Any person who misuses data obtained through access or sharing, or distributes data without authorisation to other parties, shall be punished with imprisonment for a maximum of 4 (four) years or a fine of up to Category IV.”

The “other parties” referred to in the SDI Law include state apparatus, public legal entities, community organisations (ormas), international organisations, universities, mass media, and development partners.

The law also stipulates criminal threats for those who access restricted and closed data without permission and disseminate it, with penalties of up to seven years.

Closed data refers to data whose access and use are strictly limited because it contains confidential information. Meanwhile, restricted data is data that cannot be freely opened and whose use is limited due to the potential for moderate risk to government functions or privacy.

“Any person who without permission: a. accesses Data classified as Restricted Data and Closed Data; b. obtains, uses, or discloses data as referred to in letter a; or c. transfers data as referred to in letter a outside the legal jurisdiction of the Unitary State of the Republic of Indonesia, shall be punished with imprisonment for a maximum of 7 (seven) years or a fine of up to Category V.”