The PDP Law contains a general requirement for a personal data breach to be notified by the controller to both (i) the affected personal data subjects and (ii) the PDP Agency; and for more serious breaches which would disturb public services and / or significantly affect the public interest, to also be notified to the public.

Personal data breach is a wide concept, which under the PDP Law is referred to as a "personal data protection failure" and defined as any "failure in protecting a person’s personal data in terms of confidentiality, integrity, and availability of the personal data, including security breaches, whether intentional or unintentional, which lead to the unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or processed".

The PDP Law stipulates that in the event of such a personal data protection failure, the personal data controller must deliver a written notification within 72 hours.

The PDP Law provides guidelines on the required content of the written notification, which must at least include:

• a description of the personal data that was breached;
• when and how the personal data was breached; and
• the efforts undertaken by the personal data controller to mitigate the effects of the data breach and recover affected personal data.

For the breach notification to the PDP Agency, in the meantime, the best and common practice would be to submit such a breach notification in accordance to the PDP Law to the KOMDIGI by by completing the prescribed form that is available at here or here, which accordingly is to be sent to the Directorate General for Digital Space Supervision (Direktorat Jenderal Pengawasan Ruang Digital or commonly abbreviated as “DITJEN WASDIGI” within the KOMDIGI (previously known as the Directorate General for Informatics Application (Direktorat Jenderal Aplikasi Informatika or commonly abbreviated as “DITJEN APTIKA”) at [email protected].