Government data reveals compliance gaps, rising incidents, and urgent need for stronger safeguards
Indonesia’s digital expansion continues at pace, but new government data shows that personal data protection remains a fragile pillar of the country’s digital ecosystem.
Rising Complaints and Consultations Signal Growing Awareness
Between October 2024 and November 2025, Indonesia’s Ministry of Communication and Digital Affairs through the Directorate General of Digital Space Supervision recorded hundreds of potential violations related to personal data protection. According to the 2025 Directorate General Data Report, the PDP service received 342 public complaints, with 41 percent directly related to personal data protection issues. During the same period, 483 public consultations were logged, with 89 percent focusing specifically on PDP governance.
Literacy Gaps Still Affect Effective Reporting
Director General Alexander Sabar noted that the high number of consultations suggests growing caution among data controllers. However, the dominance of non-PDP complaints highlights persistent gaps in public understanding. He emphasized that stronger digital literacy is needed to ensure reports are accurate and that enforcement efforts can be more effective, according to an official statement released on Dec 28, 2025.
Web-Based Platforms Show Higher Vulnerability
As part of compliance monitoring, Komdigi reviewed 350 digital platforms, consisting of 280 websites and 70 mobile applications. The findings revealed 115 potential violations on websites and 24 on digital applications. The violation ratio for websites reached 41 percent, compared to 34 percent for applications, indicating that web-based services currently remain more vulnerable to personal data breaches.
Audit Bottlenecks Raise Ongoing Risk Concerns
The report also highlighted a backlog in follow-up actions and clarifications, particularly for websites between September and November 2025. This reflects the high intensity of audits and underscores the need to accelerate remediation and follow-up processes. Delays in resolving compliance issues could prolong exposure to data leakage risks, especially for platforms handling sensitive user information.
Spike in Data Breach Incidents Mid-2025
Komdigi recorded 56 suspected PDP violation cases during the monitoring period, with a significant surge in June and July 2025. June alone saw 20 cases, followed by 15 in July. Most incidents were self-reported by Electronic System Operators, signaling both increased transparency and ongoing weaknesses in internal security systems.
Regulatory Framework Nears Completion
On the policy front, Komdigi confirmed that the Draft Government Regulation on Personal Data Protection has reached its final stage and has been submitted to the president. Meanwhile, the Draft Presidential Regulation on the Personal Data Protection Authority remains under inter-ministerial harmonization. Both regulations are seen as critical foundations for a coordinated and effective PDP oversight regime.
Shift Toward Preventive Digital Supervision
Looking ahead, Komdigi is pushing a transition from reactive enforcement to preventive supervision. This includes regular audits, strengthened service level agreements, and the use of artificial intelligence technologies for early detection and risks mitigation. Alexander emphasized that personal data protection is fundamental to maintaining public trust in Indonesia’s digital transformation.
As digital services become deeply embedded in daily life across Southeast Asia, Indonesia’s experience underscores the shared challenge of balancing innovation with accountability. Stronger oversight, clearer regulations, and improved literacy are essential not only for protecting citizens’ rights, but also for reinforcing cross-border digital trust with regional partners, including Singapore.
Sources: Tech in Asia (2025) , Detik (2025)
Keywords: Personal Data Protection, Digital Platforms Indonesia, Data Security Risks, Komdigi Oversight, Cyber Governance
