One Data Bill mandates reporting of security incidents within 24 hours
Jakarta (ANTARA) - The Deputy Chairman of the Indonesian House of Representatives (DPR RI) Legislative Body, Sturman Panjebaitan, stated that the Draft Law (RUU) on One Data Indonesia (SDI) contains eight strategic points, ranging from the establishment of managing institutions to the regulation of data security.
Speaking at the DPR RI Plenary Session in the Parliament Complex, Jakarta, on Tuesday, Sturman noted that the Bill regulates data security standards, including the obligation to report incidents no later than 24 hours after occurrence.
According to him, the SDI Bill is built upon two balanced constitutional rights: the right of citizens to access information and the right to personal data protection. Furthermore, data regulation is closely linked to the dimension of national resilience.
“The sovereignty of a nation-state today is also measured by its sovereignty over data. A nation that does not recognise its own data will be easily identified, mapped, and even controlled by other parties,” he said.
The SDI Bill, resulting from discussions by the DPR RI Legislative Body, consists of 20 chapters and 141 articles, featuring eight main regulatory points.
First, the Bill regulates the National Basic Data (DDN) controlled by the state, which serves as the primary reference for development planning, fiscal policy and budgeting, social assistance distribution, and other strategic national needs. This regulation also includes criteria for establishing six clusters and classifying data into open, limited, and closed categories.
Second, the Bill regulates the formation of SDI managing institutions that are accountable to the President and function in a coordinative, normative, and facilitative capacity to coordinate data supervisors, data producers, and data custodians.
Fourth, SDI infrastructure and risk management regarding the use of digital technology in SDI implementation are directed towards maintaining national data sovereignty, traceability, and human oversight.
Fifth, data interoperability shall be implemented without centralising physical databases and without transferring ownership, control, or management responsibility away from the original data producers.
Sixth, data security standards shall be set by the agency responsible for cyber security and cryptography, accompanied by cryptographic infrastructure, management systems, digital certificates, security audits, data sovereignty audits, and the obligation to report incidents within a maximum of 24 hours.
Seventh, the public may participate by providing input, reporting suspected data misuse, engaging in participatory oversight, and contributing data voluntarily.
“These formulations ensure a clear division of roles so that there is no overlap and no vacuum of responsibility,” said Sturman.
He added that the implementation of the One Data Indonesia regulation requires officials with integrity who understand both technology and data. According to him, regulation will not be effective without human resources capable of understanding and executing it.
“Knowledge is only realised when put into practice. Literacy and data are not enough to be memorised; they must be present every day at every public service desk,” he said.
“Can the One Data Indonesia Bill be approved for enactment into law?” asked the Speaker of the DPR RI, Puan Maharani, during the plenary session, to which the meeting participants responded with approval.
Previously, the Level I decision on the One Data Indonesia Bill was reached during a meeting of the DPR RI Legislative Body with the government on Monday (5/10).