The PDP Law contains a general requirement for a personal data breach to be notified by the controller to both (i) the affected personal data subjects and (ii) the PDP Agency, and for more serious breaches which would disturb public services and / or significantly affect the public interest, to also be notified to the public.

Personal data breach is a wide concept, which under the PDP Law is referred to as a "personal data protection failure" and defined as any "failure in protecting a person’s personal data in terms of confidentiality, integrity, and availability of the personal data, including security breaches, whether intentional or unintentional, which lead to the unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or processed".

The PDP Law stipulates that in the event of such a personal data protection failure, the personal data controller must deliver a written notification within 72 hours.

The PDP Law provides guidelines on the required content of the written notification, which must at least include:

• a description of the personal data that was breached;
• when and how the personal data was breached; and
• the efforts undertaken by the personal data controller to mitigate the effects of the data breach and recover affected personal data.

However, until the PDP Agency is formed and operating, data breach notifications should continue to be submitted to the KOMDIGI and other relevant institution(s) pursuant to General Data Protection Regulations, as follows:

Reporting obligations to relevant authorities

• If there is a serious system interference or failure caused by acts of a third party on its electronic system, a report shall be made immediately and at a first instance to:
  • a law enforcement official (in practice, mostly if the breach is suspected to contain matters related to cybercrimes); and
  • the relevant Ministry or Agency (namely Directorate General for Informatics Application (Direktorat Jenderal Aplikasi Informatika or commonly abbreviated as "DITJEN APTIKA")) , and if required (often also as a matter of custom / courtesy) its specific sector’s authority.

However, there is no specific definition or elucidation provided on what "immediately" or "first instance" shall mean. In practice, typically, such an event would be reportable if there is certain loss, namely where the impact due to failure of the electronic system has legal consequence to the user, operator and other parties, both material and immaterial.

• On the content / coverage of the report, there is no specific minimum information prescribed, except that the electronic system operator / PSE (data controller / processor), shall also take the necessary measures to secure the electronic information / document under its control.

However, in practice and pursuant to the DITJEN APTIKA’s current policy, DITJEN APTIKA has made available a prescribed notification format which shall be completed with, among others, the following information:

• How the notifying party is aware of such breach;
• Description of the event;
• Period of the incident;
• Category of the disclosed personal data (general data and / or specific data);
• Estimation of the total affected individuals;
• The affected person’s status (employee, consumer, student and etc);
• Description of the interfered components of the electronic system;
• Impact to the notifying party;
• Period of recovery (for the notifying party to recover the electronic system);
• Accessibility of data protection trainings for the individuals involved in the processing of personal data of the notifying party;
• Efforts to handle and recover from the disclosure of personal data by the personal data controller;
• Efforts to prevent future issues; and
• Notification to the affected individuals

Notification obligations to relevant data subject

• A notification shall be sent within 14 (calendar) days of discovery / determination of a breach, namely upon failure to protect the secrecy of the personal data in the electronic system.

There is no further description on what would contain a "failure to protect the secrecy of the personal data". The KOMDIGI would, as a general rule, consider such a failure presentif other parties (with no rights to access) may identify the affected person based on the disclosed data.

• On the content / coverage of the notification, it must at the minimum provide the reason or cause of the occurrence of the failure in protecting the secrecy of personal data. No specific format is prescribed.