Tanggung Jawab Hukum Badan Penyelenggara Jaminan Sosial Kesehatan Terhadap Kebocoran Data Pribadi Peserta: Legal Responsibility of Badan Penyelenggara Jaminan Sosial Kesehatan Regarding Personal Data Leaks of Participants

Rifky, M. Rifky Murdani

The Officium Nobile Journal
Vol. 2 No. 2 (2025): December 2025

The 2021 alleged breach involving BPJS Kesehatan participants’ data illustrates that victim redress depends not only on criminal prosecution of hackers but also on the liability of the data manager when a protection failure occurs. This article examines BPJS Kesehatan’s legal accountability before and after the enactment of Indonesia’s Personal Data Protection Law (Law No. 27/2022). The analysis focuses on civil liability construction, breach notification duties, and administrative consequences applicable to data controllers. The findings indicate that, prior to Law No. 27/2022, liability was fragmented across the ITE Law, Government Regulation No. 71/2019, and Ministerial Regulation No. 20/2016, with limited enforcement leverage and remedies largely dependent on proving an unlawful act (tort) in court. After the PDP Law, data subjects’ right to sue and obtain compensation is strengthened, notification obligations become clearer, and more robust administrative sanctions, thereby expanding remedial options and incentivising compliance.