<![CDATA[Indonesia's integrated digital public services create legal accountability challenges concerning the collection, exchange, and subsequent use of personal data across government institutions. This study examines whether Indonesia's personal-data protection framework establishes coherent legal responsibilities and safeguards for public-sector processing. A normative-doctrinal research design applies statutory, conceptual, and comparative legal analysis to Law No. 27 of 2022, digital-government regulations, Constitutional Court Decision No. 151/PUU-XXII/2024, and Government Regulation No. 33 of 2026. Public-sector cybersecurity incidents serve as documentary illustrations rather than empirical proof of statutory violations. The findings establish that governmental processing must satisfy recognized lawful bases, purpose-related limitations, security obligations, and identifiable controller responsibilities. However, statutory completeness does not itself demonstrate consistent institutional compliance, particularly across interconnected processing activities and supervisory arrangements. Government Regulation No. 33 of 2026, promulgated in July 2026, provides additional implementing provisions but does not enter into force until January 2027. The analysis identifies a need for documented processing responsibilities, risk assessment, verifiable audit records, and effective institutional supervision. These mechanisms constitute operational recommendations grounded in statutory and comparative analysis. The study concludes that Indonesia's principal normative challenge concerns translating established legal obligations into demonstrable, traceable, and independently reviewable accountability across digital public services. ]]>
Copyrights © 2026
