Information Technology Risk Management Analysis in the Implementation of Law Number 27 of 2022 Concerning Personal Data Protection at PT XYZ

Ervin Hermawan (Universitas Bina Nusantara)
Nilo Legowo (Universitas Bina Nusantara)

Equivalent: Jurnal Ilmiah Sosial Teknik
Vol. 8 No. 2 (2026): Equivalent: Jurnal Ilmiah Sosial Teknik

Background: Along with the rapid development of information technology and digitalization, organizations increasingly rely on personal data to support business operations. This reliance also increases the potential risk of data leakage, misuse, and complex cyber-attacks, prompting the Indonesian government to enact Law No. 27 of 2022 on Personal Data Protection (PDP Law). PT XYZ, as a consulting company, faces serious challenges in implementing this regulation, ranging from the vulnerability of information technology infrastructure, the absence of appropriate internal policies, to the low understanding of human resources on data protection practices. Objective: This research aims to develop internal policies related to personal data management in accordance with the data protection principles of the PDP Law, as well as identify and analyze information technology security risks to formulate mitigation strategies using the ISO 31000:2018 approach Methods: The methodology used is descriptive qualitative, with data collection techniques through document studies, surveys of employees from various divisions, and direct observation of the current information technology security infrastructure and procedures Results: The results showed that the company did not have a systematic risk management, the security system still had many gaps such as not using layered authentication or a comprehensive encryption system, and more than half of the employees did not understand the basic principles of the PDP Law Conclusion: Based on these findings, a mitigation strategy was developed in the form of internal policies governing personal data governance, strengthening IT security systems through encryption technology and role-based access control, and regular training to increase employee awareness. The implementation of this strategy is expected to improve compliance with the PDP Law, avoid administrative sanctions up to a fine of 2% of revenue, and build public trust through safe and reliable personal data management.