The ongoing data security crisis, in conjunction with the recent enactment of the Personal Data Protection Law (PDP Law), has presented a substantial challenge to Indonesian civil society organizations as they seek to establish comprehensive and effective data governance frameworks. The objective of this study is to conduct a thorough analysis of the data protection policy formulation process at Muhamamdiyah, employing a qualitative case study methodology to elucidate the underlying dynamics. This study utilizes a multifaceted approach, incorporating document analysis and interviews with a diverse array of key actors, ranging from strategic leaders to operational implementers. This comprehensive methodology enables the study to address the following research question: What is the process by which member data management policies (NBM) are formulated? The results of the study indicate a robust synthesis, wherein Muhammadiyah not only adheres to the regulatory obligations of the PDP Law, but also deliberately incorporates noble Islamic values such as amanah (trust), syura (deliberation), and 'adl (justice) as the ethical foundation of its policies. A rigorous analysis employing Dunn and Anderson's theoretical framework substantiates that this collaborative endeavor is directed towards formulating effective, efficient, and equitable policies. In conclusion, Muhammadiyah offers a data governance model through the concept of "Digital Trust" that uniquely integrates the demands of modernity with its ideological foundations. This model is relevant as a reference for similar organizations.
Copyrights © 2026