Borobudur Law and Society Journal

Indonesia’s Personal Data Protection Law (Law No 27 of 2022) imposes detailed duties on data controllers, yet breaches continue and the Law’s enforcement structure is still incomplete. This study examines the legal responsibility of an internet service provider, Biznet, for two user-data breaches reported in March 2024: about 380,000 records of its internet customers and 154,091 records of customers of its cloud service, Biznet Gio, reportedly including identity, tax, contact and account data. It asks what the Law requires of a controller before and after a breach, how far those duties were enforceable during the Law’s two-year transition period, and which forms of liability may follow. The research is normative, using statute, conceptual and case approaches; the facts are taken from press reports and the company’s public statements and are treated as allegations. The Law requires a lawful basis, an impact assessment for high-risk processing, security and confidentiality measures, supervision of processors and written notice within three days of a failure. The reports raise doubts about security and notification, but do not establish a breach of duty. Administrative, civil and criminal liability are all possible; their imposition depends on the controller’s documented compliance and on a functioning supervisory agency, which had still not been formed in 2026. Breach notification procedures, security audits and a compensation route for data subjects are recommended.