IndonesiaGovernment Regulation on the Operation of Electronic Systems and Transactions, electronic-system security duty
Government Regulation No. 71 of 2019 (PP PSTE), Pasal 3, 23, 24(1)-(2), 31, 32, 39, 40
In force since .
A security baseline statutes rule binding public and private bodies.
- Obligation class
- Security
What it requires
- This binds every Electronic System Operator under Indonesian law, whether a government body (Penyelenggara Sistem Elektronik Lingkup Publik) or a private business (Penyelenggara Sistem Elektronik Lingkup Privat), with no sector or size gate.
- Operate your Electronic System reliably and securely, and take legal responsibility for it operating as it should.NIST CSF 2.0PR.IR-03NIST CSF 2.0GV.RR-01
- Secure your Electronic System's components, and have and run procedures and means to protect the system against disruption, failure, and loss.NIST CSF 2.0PR.IR-03
- Provide a security system covering procedures and technical measures, such as antivirus, anti-spam, a firewall, intrusion detection or prevention, or an information security management system, to prevent and counter a threat or attack against your Electronic System.NIST CSF 2.0PR.IR-01
- Protect your users and the wider public from harm caused by the Electronic System you operate, and provide, train, and equip personnel tasked with and responsible for securing the system's facilities and infrastructure.NIST CSF 2.0PR.AT-02
- Where you operate an Electronic Agent, an automated device that carries out an action on Electronic Information for a user without that user's direct intervention, such as an automated transaction or e-commerce system, additionally run a standard operating procedure meeting six security-control principles for user data and Electronic Transactions: confidentiality, integrity, availability, authenticity, authorization, and non-repudiation, and test a transacting user's identity and authorization before completing the transaction.NIST CSF 2.0PR.AA-03NIST CSF 2.0GV.PO-01
- A violation of Articles 23, 24, 31, 32, 39(2), or 40 can draw an administrative sanction from the Minister, a written warning, an administrative fine of an amount this Government Regulation does not itself fix, temporary suspension, access termination, or removal from the Electronic System Operator registry; the Article 100 sanction list does not name Article 3 itself.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.AC-P6Individuals and devices are proofed and bound to credentials, and authenticated commensurate with the risk of the transaction (e.g., individuals’ security and privacy risks and other organizational risks).
- PR.PT-P4Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations.
- NIST CSF 2.0
- GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- PR.AA-03Users, services, and hardware are authenticated
- PR.AT-02Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
- PR.IR-01Networks and environments are protected from unauthorized logical access and usage
- PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Criminal exposure note
Article 100(5) states that an administrative sanction under this Government Regulation does not extinguish criminal or civil liability, but this Government Regulation does not itself create a criminal offense for failing to secure an Electronic System; that exposure, if any, arises under a different statute such as the Electronic Information and Transactions Law's unauthorized-access offense, already this jurisdiction's scraping-topic finding.
Who enforces it
Enforcement body
The Minister who administers government affairs in the field of communications and informatics (Menteri Komunikasi dan Informatika, since renamed the Ministry of Communication and Digital Affairs / Komdigi), who imposes any of Article 100(2)'s five administrative sanctions.
What this law does
Every Electronic System Operator, government or private, must operate its Electronic System reliably and securely and is legally responsible for its proper operation. It must secure the system's components and have and run procedures and means to protect the system against disruption, failure, and loss. It must also provide a security system with prevention and countermeasure procedures against a threat or attack that causes such disruption, failure, or loss.
It must protect its users and the public from harm the system causes, and provide, train, and equip personnel responsible for securing the system's facilities and infrastructure. An operator running an Electronic Agent, an automated device carrying out actions on Electronic Information for a user, must additionally run a standard operating procedure meeting six security-control principles for user data and transactions. That operator must also test a transacting user's identity and authorization before completing a transaction.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .