Indonesia's One Data Law: What It Means for Agencies

On 6 October 2026, Indonesia’s House of Representatives (DPR) passed the Satu Data Indonesia law, a legal framework for data standards, interoperability, and security across government data. For agencies, public schools, universities, and the vendors that serve them, the message is simple: clean, connectable data is now a matter of national policy, not just good housekeeping.

What was passed on 6 October 2026

According to ANTARA, the bill became law at the DPR’s ninth plenary session of the 2026-2027 session year. It has 20 chapters and 141 articles. Selular.ID reported that all factions and members present approved it.

Until now, Satu Data Indonesia (“One Data Indonesia”) ran on a presidential regulation. Moving it into statute gives it more weight and a wider scope: standardization, interoperability, security, and the use of data for national needs.

One central idea is National Basic Data (Data Dasar Nasional). The state controls this data, and it becomes the main reference for development planning, fiscal and budget policy, and the distribution of social assistance. Picture a regional planning office, a social affairs agency, and a ministry all quoting the same number from the same source.

The key provisions in plain language

Based on the coverage we read, these provisions will matter most in day-to-day technical work.

Shared standards. Agencies that produce or manage data must use the same standards. The law covers data standards, metadata, reference codes, master data, and a national data catalog. If two agencies currently spell the same village differently or use different codes for it, this is exactly the kind of mismatch the law aims to remove.

Interoperability. Data across agencies has to be able to connect and be used when needed. Communications and Digital Minister Meutya Hafid told CNN Indonesia that Satu Data does not move everything into one place. Data stays in each sector, while the ministry builds the connecting pathways through the Government Service Connection System (SPLP), which she compared to a toll road.

Defined roles. JawaPos reported that the law is the basis for dividing roles among data coordinators, data producers, and data custodians. Selular.ID adds that authority is layered, from central government down to villages and urban wards.

Security and sovereignty. The requirements include security standards, access control, security audits, and data sovereignty audits. The national cyber and encryption agency is expected to set the security standards.

Sanctions. The law carries administrative and criminal sanctions for violations. The reports we read do not spell out the penalties, so check the official text before you quote any figures.

Who runs it, and what is still unclear

Deputy Minister Nezar Patria said Bappenas, the national planning agency, will lead coordination, while the communications ministry provides infrastructure and interoperability support. Asked about the implementing body sitting directly under the President, he said only that the arrangement follows the law.

Several things remain open in the press coverage. No implementation deadline, budget, or implementing regulation has been reported. We also found no detail on how the law applies to public schools, regional hospitals, or state-owned regional enterprises specifically. It is reasonable to wait for the implementing rules before making large changes.

One caution came from the legislature itself. Sturman Panjaitan, deputy chair of the DPR’s legislation body, said integration and openness must not come at the cost of personal data: “Pelindungan data pribadi juga harus menjadi keyakinan kita” (roughly, “protecting personal data must remain our conviction”). That fits with Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi (Law No. 27 of 2022 on Personal Data Protection), which continues to apply alongside the new law.

A practical picture: from social aid to school services

To show how this works, Meutya pointed to the digital social protection portal (Perlinsos) as an example of a data bridge. In simple terms, each agency does not re-collect beneficiary data. The authoritative system keeps it, and other agencies reach it through a connecting layer with clear rules.

You can apply the same pattern on a smaller scale. Say a district education office wants to know how many students come from households receiving aid, so scholarships reach the right people. Without tidy data pathways, staff request files from several offices, merge them in a spreadsheet, and match names by hand. With shared reference codes and consistent interfaces, the same job takes minutes and the result is easier to defend.

That is why the quality of your own data decides how smooth integration will be later. Names written three different ways, mixed date formats, and half-filled columns all become expensive once data has to move between systems.

What this means for your organization

You do not need to wait for implementing regulations to start tidying your own house. These steps are useful whatever the final details turn out to be.

Government agencies and regional enterprises. Map the data you produce: who owns it, which system holds it, and in what format. Start with data other agencies ask for often, such as population, aid recipients, or assets. Make sure each system has a documented API rather than relying on Excel exports sent over chat. Our digital government work often begins with exactly this kind of mapping.

Schools and universities. If you manage student, teacher, and grade data, the same habits apply. One student identity should stay consistent across attendance, report cards, and exams. Clean data is far easier to connect later, whatever form the integration takes.

Companies that work with government. Prepare your systems to exchange data through open standards, and record clearly who can access what. Vendors that can show an audit trail are easier to trust.

Everyone. Tie data governance to security. The more systems you connect, the more access control and monitoring matter, because one weak door can expose a lot of data. Cybersecurity and data analytics complement each other here: one guards the door, the other makes sure what is inside can be trusted.

Three mistakes worth avoiding

First, assuming Satu Data means building one giant new database. According to the minister, that is not the idea. What gets built is a set of pathways and rules, while data stays managed in its own sector.

Second, buying a new application before cleaning the data. Even a sophisticated tool produces confusing reports when region codes, names, and identifiers are inconsistent. Start with a simple data dictionary.

Third, postponing security until integration is done. Since the law mentions security and data sovereignty audits, it is wiser to record access trails and data locations from the start.

Frequently asked questions

Is the Satu Data Indonesia law fully in force?

The DPR passed it on 6 October 2026. Media reports have not mentioned an implementation deadline, and implementing rules are still to come. Check the official text on government channels for the latest status.

Will personal data become public?

Not automatically. Lawmakers stressed that integration and openness must still protect personal data. The Personal Data Protection Law remains in force, so the legal basis for processing and securing personal data still has to be met.

Does the law affect private companies and private schools?

Its main scope is government data. Still, private organizations that exchange data with agencies, or supply their systems, will probably be asked to follow the technical standards. Watch for the implementing regulations.

Start with tidy data

The law is a framework for now. Its real impact will arrive through implementing rules, technical standards, and the way each agency prepares its systems. Building a data inventory, a data dictionary, and access controls today costs far less than reworking systems after the rules land.

If you would like to talk through data mapping or integration readiness at your organization, our team is happy to chat through the contact page, with no obligation.

Sources

• Kemkomdigi dukung penerapan kebijakan Satu Data Indonesia, ANTARA, 6 October 2026
• Komdigi ungkap peran di UU Satu Data Indonesia, CNN Indonesia, 7 October 2026
• DPR sahkan UU Satu Data Indonesia, Selular.ID, 7 October 2026
• UU Satu Data Indonesia disahkan, Komdigi siapkan sistem yang saling terhubung, JawaPos, 7 October 2026