One Data Law Could Conflict with Personal Data Rules, ELSAM Warns of Risks
Jakarta, CNBC Indonesia — The Institute for Policy Research and Advocacy (ELSAM) believes the One Data Indonesia Law (UU SDI) could overlap with the Personal Data Protection Law (UU PDP), potentially creating uncertainty in the processing of personal data.
“UU SDI does not only regulate ‘national data’ in the sense of statistics or aggregated data. Its ecosystem will also manage population, social and other categories of data that can directly or indirectly identify individuals. Most SDI operations will intersect with personal data as defined in UU PDP,” ELSAM said in an official statement on Thursday (29 October 2026).
One example is Article 18, which states that the dissemination, use and utilisation of data under the SDI framework do not require a memorandum of understanding, cooperation agreement or declaration document, provided data security standards are met.
Article 18 of UU PDP, meanwhile, sets out the requirement for an agreement governing the roles, responsibilities and relationships between personal data controllers when two or more controllers are involved in processing personal data.
The two laws also use different data classifications. UU PDP distinguishes between general and specific data, while UU SDI classifies data as open, restricted or closed.
There is also potential overlap in Article 85 of UU SDI, which stipulates that access to and transfer of closed data outside Indonesia’s jurisdiction must receive approval from the House of Representatives. Such transfers must also comply with the law.
“Instead of aligning with UU PDP, criminal provisions have been introduced against people who access and transfer data outside Indonesia’s jurisdiction,” ELSAM said.
The laws also differ in their handling of data security incidents, which is covered by Article 93(3) of UU SDI and Article 46 of UU PDP.
UU SDI requires incidents to be reported to the relevant authority within 1 x 24 hours, with coordination with the National Cyber and Crypto Agency (BSSN). UU PDP requires notification to the data subject or the relevant institution within 3 x 24 hours.
ELSAM says these provisions create inconsistencies in incident response, including in the coordination roles of the data protection authority and BSSN.
“Moreover, as of mid-2026, the government had not established the Personal Data Protection Authority mandated by UU PDP. Third, there is no legal framework for artificial intelligence (AI) and blockchain, even though their use has begun under UU SDI,” the organisation said.