KAI assures customer digital data remains safe and protected

Jakarta (ANTARA) - PT Kereta Api Indonesia (Persero) has assured that customers’ digital data remains safe and protected, maintained through system strengthening, the application of international standards, and ongoing data protection governance.

“KAI continues to strengthen the security and confidentiality of customer data as the use of digital travel services grows ever wider,” said KAI Vice President of Corporate Communication Anne Purba in a statement issued in Jakarta on Tuesday.

These measures encompass data protection policies, system security, access controls, cyber incident handling, and clear communication to customers regarding how their data is used.

According to her, digitalisation has made the travel process much easier, from searching schedules and purchasing tickets to payment, journey management, and boarding. This development must be accompanied by responsible data management.

“Customers entrust a considerable amount of information to KAI when using digital services. We safeguard that trust through system strengthening, governance, staff competence, and continuously evaluated data protection mechanisms,” she said.

These steps align with the spirit of the 81st Anniversary of the Independence of the Republic of Indonesia, “Indonesia Sovereign, Just, and Prosperous”. In the development of the economy and digital services, sovereignty is also linked to the nation’s ability to manage technology and safeguard citizens’ information responsibly.

Based on KAI’s internal data, some 5,555,034 long-distance rail customers used the Face Recognition Boarding Gate between January and June 2026. The facility simplifies the boarding process as customers’ identities can be verified through facial data already linked to their travel tickets.

“Registered customers no longer need to show a boarding pass, e-boarding pass, or ID card to officers when passing through the Face Recognition Boarding Gate,” she explained.

The use of Face Recognition is optional. Customers who choose the service must give their consent during registration via Access by KAI, Check-in Counter machines at stations, or Customer Service staff.

“Customer consent is an essential part of the Face Recognition service. Customers can still use other available boarding mechanisms if they do not register their facial data,” Anne added.

Throughout the first semester of 2026, Access by KAI served 17,009,374 ticket transactions for Main and Local train services, equivalent to 76.34 per cent of all transactions through the sales channels for these two services.

In terms of customer volume, 24,544,468 Main and Local train customers obtained their tickets via Access by KAI between January and June 2026, equivalent to 73.68 per cent of the customer volume across all sales channels for the two services.

KAI applies an Information Security Management System based on the international ISO 27001 standard. The standard serves as a reference for managing information security risks, regulating access to data, and maintaining the confidentiality, integrity, and availability of information.

Governance has also been strengthened through the establishment of a Computer Security Incident Response Team (CSIRT), which is tasked with handling, coordinating, and responding to any discovered cybersecurity incidents.

KAI has also appointed a Data Protection Officer (DPO), an official responsible for upholding the implementation of company policies and compliance in data protection. According to its 2025 Sustainability Report, KAI’s information technology governance maturity level stands at approximately 3.8.

Beyond organisational strengthening, KAI conducts regular vulnerability checks and system security testing. These examinations aim to identify potential gaps in applications and digital infrastructure so they can be addressed before disrupting services or posing risks to customer information.

Customer data management is carried out in accordance with Law No. 27 of 2022 on Personal Data Protection as well as internal company policies. KAI also continues to educate its workforce on information security, access management, and responsibility in processing data.

“For KAI, safeguarding customers’ journeys also means safeguarding the information that has been entrusted to the company,” Anne said.