Indonesia Passes the One Data Indonesia Law
Indonesia's government and House of Representatives officially enacted the One Data Indonesia Bill (RUU SDI) into law on Tuesday (10/6/2026). Passage came at the 9th Plenary Meeting of the 2026-2027 Session's first sitting at the Parliament Complex in Senayan, Jakarta, chaired by House Speaker Puan Maharani after all eight factions declared agreement.
The regulation, spanning 20 chapters and 141 articles, was a House-initiated bill. First-level deliberation was agreed between the House Legislation Body (Baleg) and the government on Monday (10/5/2026), the day before the plenary, with working-committee chair Sturman Panjaitan — also Baleg's deputy chair — reporting the results before the gavel fell.
The law was born to end data fragmentation across ministries and agencies. For years, poverty data from ministry A differed from ministry B's — both claiming to be right. Now every institution, from ministries down to village governments, answers to one data standard.
National Basic Data: One Reference, Not One Database
The law's heart is the National Basic Data (DDN) — state-controlled data serving as the primary reference for development planning, fiscal and budget policy, social-aid distribution, and other strategic national needs. The DDN is divided into six clusters and three classifications: open, restricted, and closed.
The most common misconception: the government will centralize everything in one giant database. It won't. The law instead mandates interoperability without physically centralizing databases, and without transferring ownership or management responsibility from data producers. What gets standardized: data standards, metadata, reference codes and/or master data, and a national data catalog.
The law also removes the requirement for memoranda of understanding or cooperation agreements between agencies for data exchange and dissemination — cutting red tape so cross-agency data use moves faster. One Data Indonesia sits directly under the President, nationally orchestrated by the National Development Planning Ministry (Bappenas), while the Communications and Digital Ministry (Komdigi) provides digital infrastructure and system connectivity.
AI Guardrails, Data Security, and Expert Warnings
The law regulates digital technology including artificial intelligence and blockchain — but with firm guardrails: security, accountability, data protection, and human oversight. Data security incidents must be reported within 24 hours. A new SDI organizing body reporting directly to the President is created, plus a data-sovereignty audit to keep national data from falling under foreign control.
Sturman said flawed data doesn't just produce wrong numbers — it wounds justice, referring to real cases of mistargeted social aid caused by mismatched recipient data across agencies. Administrative Reform Minister Rini Widyantini called the passage a crucial step against data manipulation.
But experts flag risks. Wahyudi Djafar, executive director of Catalyst Policy Works, warns the classification provisions still risk public information openness and personal data protection — without risk matrices and classification time limits, access restrictions could become a backdoor for expanding information secrecy. He also notes the law doesn't fully adopt risk-based AI governance or citizens' rights to data correction. The real homework now lies in the implementing regulations.
