PDP Law Not Completed, Indonesia's Cyber Security Level Becomes Investors Spotlight

Pratama Persadha cybersecurity expert (Doc. Antara)

JAKARTA - Cyber security expert Pratama Persadha said the data theft that is still happening in Indonesia could affect investor interest. Moreover, the Law on Personal Data Protection has not yet been realized, which is still being discussed by the DPR.

"The discussion of the Bill on Personal Data Protection (RUU PDP) has not yet been completed. Even if it is finished, it is necessary to read carefully whether its contents are strong enough to protect the public or vice versa," said Pratama Persadha, quoted from Antara, Sunday, 6 June.

The Chairperson of the CISSReC Cybersecurity and Communication Research Institute assessed that without this law all personal data controllers (platform providers) have no clue as to how far security should be and what standards they should use.

Therefore, said Pratama, the discussion of the Draft Law on Personal Data Protection is one that must be accelerated until it becomes a law.

"With the current conditions, the protection of people's personal data in the country is very low," said Pratama, who was once an official of the National Crypto Agency (Lemsaneg) which is now the BSSN.

This kind of situation, said Pratama, is actually not healthy, especially if the government wants a lot of investors to come in. The problem is, they will see how the state protects its population data.

This, he continued, made Indonesia's ranking low in the NCSI (National Cyber Security Index) made by Estonia. Based on NCSI data, Indonesia is ranked 77th or down from previously which was ranked 72nd.

He mentioned that one of the reasons for such a low rating was the absence of regulations on personal data protection and regulations for strengthening national cyber defenses.

Responding to issues related to the increasing number of applications during the COVID-19 pandemic in the midst of low awareness of cybersecurity, Pratama emphasized that the homework (PR) that must be completed first is the Personal Data Protection Law.

Inevitably, he said, there were many incidents of personal data leaks, but it was not clear what form of legal responsibility and technical steps taken from the state and the private sector.

Moreover, so far there is no regulation that strongly protects personal data. As a result, there can be a lot of data leaks, both in state and private institutions, but no one is responsible, no evaluation, and no compensation for the community.

Pratama then reminded citizens when choosing an application or internet site to be selective, first looking at the reviews on the application. If it's suspicious, it's better not to install it.

"When you enter an application and a site is asked to enter various irrelevant data, you should avoid it because it is feared that it is a phishing application and site," he concluded.