12 OCT 2026 — Indonesia's parliament passed a law on 6 October to end the habit of ministries keeping their own, conflicting numbers. The One Data Indonesia law, approved unanimously, creates a single set of national base data for planning, budgets and welfare payments, and a new agency reporting to the President to run it.
It also adds rules with reach beyond government. They include a 24-hour deadline for reporting security incidents, audits of "data sovereignty", fees for access to restricted data, and a requirement that parliament approve any transfer of classified government data out of Indonesia.
What parliament passed
The House of Representatives approved the bill at its plenary session in Jakarta, chaired by Speaker Puan Maharani, detikcom reported, and every faction agreed. It was parliament's own initiative, while the government submitted 1,338 points on the main text and 829 on the explanatory notes during the debate.
The law runs to 20 chapters and 141 articles. "One data is the spirit of Bhinneka Tunggal Ika in the language of governance," said Sturman Panjaitan, who chaired the working committee, invoking the national motto, unity in diversity. "Data producers are diverse, from ministries to village governments, but there is one standard, one metadata, one reference code, one master data."
One reference, many producers
National base data sits at the centre. Controlled by the state, it is meant to be the main reference for development planning, fiscal policy, budgeting and the distribution of social assistance. It is sorted into six clusters and classified as open, limited or closed, according to the summary of the bill presented to parliament.
The law does not move everything into one database. Every ministry, region and village must use the same data standards, metadata, reference codes and a national data catalogue. But interoperability is to work "without centralising the physical database" and without transferring ownership of data from the agencies that produce it. Villages get formal data forums to agree their own figures.
Why its sponsors wanted it
Sturman's case was blunt. "When data is wrong, it is not only the numbers that are wrong; it is justice that is wounded," he said, Antara reported, pointing to aid that goes to the wrong people and programmes that overlap.
Security, sovereignty and fees
The security provisions are most likely to affect companies and agencies handling data. The agency responsible for cybersecurity and encryption will set standards, backed by cryptographic infrastructure and digital certificate management. There are security audits and separate data sovereignty audits, and incidents must be reported within 24 hours.
Access to limited data can carry a fee, collected as non-tax state revenue. Access to closed data from outside Indonesia's jurisdiction, or its transfer abroad, needs the approval of parliament. The law also covers the use of digital technology, blockchain and artificial intelligence in the system, with requirements for traceability and human oversight, and it carries administrative and criminal penalties.
What happens next
The new agency, which reports to the President, must be set up within a year, and systems built under the 2019 presidential regulation that first created One Data Indonesia will be brought into line. Disputes go first to mediation, limited to 14 working days with one extension of the same length, according to the summary reported by detikcom and Suara.com. CNBC Indonesia reported that the law will also govern who may access data and how it may be used.
The final text has not yet been published with a law number, so details such as the penalties and the definition of closed data remain to be seen. Sturman acknowledged the tension: open, shared data has to sit alongside the protection of personal data. "Personal data protection must also be our conviction," he said.
