Cyber Expert Says Implementation Of PDP Law Is Still Far From Public Expectations

Chairman of the CISSReC Cyber Security Research Institute, Pratama Persadha (photo: Ist)

JAKARTA - A year after the Personal Data Protection Law (UU PDP) took full effect after the two-year transition period, Indonesia began to see how this rule was implemented in the real world.

But unfortunately, security experts as well as the Chairman of the CISSReC Cyber Security Research Institute, Pratama Persadha, assessed that the implementation of the PDP Law is still far from public expectations.

"The PDP Law is actually an important milestone for Indonesia to uphold data sovereignty and protect citizens' rights to personal information. However, without concrete implementation and a strong implementing institution, this regulation will lose its meaning," said Pratama in a statement received by VOI on Tuesday, October 21.

Pratama emphasized that the current implementation of the PDP Law could no longer be postponed. Because, in the past year, Indonesians have continued to be targeted by various forms of digital crime ranging from data leakage, online fraud, rampant online gambling, to various scam modes.

He also mentioned the Personal Data Protection Agency (PDP Agency) mandated by the PDP Law, which should have been at the forefront of ensuring the compliance of institutions and companies with data protection principles.

Pratama added that the PDP Law has not been effectively realized because the Government Regulation (PP) as the technical basis for implementation has not yet been published.

"Without the PDP and PP PDP, law enforcement mechanisms, data governance, and compliance standards do not have operational clarity. As a result, regulations that should provide a sense of security are still a symbol without execution," he said.

Nevertheless, Pratama argues, PDP institutions should not be merely based on political appointments, but must be based on technical competence and deep experience in the field of cybersecurity, data governance, and digital privacy.

"The figure who leads the PDP Agency must understand not only the legal side, but also the technical dynamics of cyberattacks, cross-sectoral data structures, as well as an adaptive risk mitigation strategy against the development of global technology," he concluded.