IndonesiaGovernment Regulation on the Operation of Electronic Systems and Transactions, security-incident reporting duty
Government Regulation No. 71 of 2019 (PP PSTE), Pasal 24(3)
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Security, Reporting
What it requires
- This binds the same Electronic System Operator as this jurisdiction's Article 23/24(1)-(2) security-system duty; it adds an incident-reporting duty rather than reaching a different party.
- On a system failure or disruption with a serious impact resulting from another party's act against your Electronic System, such as an attack or intrusion, secure the affected Electronic Information and/or Electronic Document.NIST CSF 2.0RS.AN-07
- Report the incident immediately, at the first opportunity, to law enforcement officials and the relevant Ministry or Agency; the Government Regulation states no numeric clock for this report, only immediacy.NIST CSF 2.0RS.CO-02
- A violation can draw the same Article 100 administrative sanctions (written warning, an administrative fine of an amount this Government Regulation does not itself fix, temporary suspension, access termination, or removal from the operator registry) as this jurisdiction's security-system duty.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Criminal exposure note
Article 100(5) states that an administrative sanction under this Government Regulation does not extinguish criminal or civil liability, but this Government Regulation does not itself create a criminal offense for failing to report an incident; that exposure, if any, arises under a different statute such as the Electronic Information and Transactions Law's unauthorized-access offense, already this jurisdiction's scraping-topic finding.
Who enforces it
Enforcement body
The Minister who administers government affairs in the field of communications and informatics (Menteri Komunikasi dan Informatika, since renamed the Ministry of Communication and Digital Affairs / Komdigi), who imposes any of Article 100(2)'s five administrative sanctions.
What this law does
Where a system failure or disruption with a serious impact results from another party's act against its Electronic System, such as an attack or intrusion, the Electronic System Operator must secure the affected Electronic Information and/or Electronic Document and report the incident immediately, at the first opportunity, to law enforcement officials and the relevant Ministry or Agency.
The Government Regulation states no numeric clock for that report, only immediacy at the first opportunity, and binds the same general population of government and private Electronic System Operators as this jurisdiction's Article 23/24(1)-(2) security-system duty.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, runs an essential service, provides financial services, handles health records, provides telecom services, provides cloud services, provides a general-purpose AI model, is a frontier developer, is a listed company, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .