Indonesia's One Data Law: What It Means for Data and Systems

What does Indonesia's One Data law require? On 6 October 2026 the House of Representatives (DPR) passed the One Data Indonesia bill, UU Satu Data Indonesia, into law. It sets one set of standards for government data, creates a new body under the President to run it, and says how ministries, regional governments and villages should connect their systems without moving their data into one place. For anyone who builds, runs or connects to government systems, the law changes the technical ground rules, even though many details are still to come.

What was passed, and when

The law was approved at the DPR's 9th plenary session of the first sitting period of 2026 to 2027, chaired by Speaker Puan Maharani, with 326 of 576 members present, CNN Indonesia reported. All eight parliamentary factions supported it. The bill was a DPR initiative. During deliberations the government submitted 1,338 items on the main text and 829 on the explanatory notes, according to CNN Indonesia and the government's One Data portal. The law has 20 chapters and 141 articles.

Rachmat Pambudy, Minister of National Development Planning and Head of Bappenas, called it a new milestone for the Republic, according to the One Data portal run by Bappenas. The portal says the law replaces the legal framework of Presidential Regulation 39/2019 on One Data Indonesia. Sturman Panjaitan, who chaired the parliamentary working committee on the bill, presented its contents to the plenary.

The core idea: one standard, not one database

The law defines national basic data, Data Dasar Nasional, which the state controls and which becomes the main reference for development planning, fiscal policy and budgeting, the distribution of social assistance and other strategic needs. Both Bappenas and the working committee stress that this does not mean all government data is centralised in one agency. Data producers, from ministries down to village governments, keep ownership, control and responsibility for their data.

What changes is the standard. Kompas reported Sturman Panjaitan's summary that there is to be one standard, one metadata, one set of reference codes and one master data. The law also provides for a national data catalogue, a master plan, a One Data architecture, data management rules and a data lifecycle. Systems must be able to connect and share data as needed, without merging physical databases.

Classification, security and oversight

• Data is divided into three types, open, restricted and closed, and Kompas reported six data groups. Ledia Hanifa Amalia, a member of the working committee, said in an Antara report on 15 October that integration does not make all data freely accessible; exchange must follow the rules for each class.
• Security standards are set by the agency responsible for cyber security and cryptography, and cover data security systems, digital certificates and security checks. Kompas reported that security incidents must be reported within 24 hours.
• Kompas reported that every data process must be traceable and remain under human oversight. The Bappenas portal says data use, including AI, must not create algorithmic bias or new discrimination.
• CNBC Indonesia reported that the law also covers access control, security and data sovereignty audits, the use of AI and blockchain, and administrative and criminal sanctions.
• Disputes over data management go first to mediation outside court, for up to 14 working days, extendable by another 14, according to Kompas.

Who runs it: a new body, Bappenas and Komdigi

The law creates a One Data organiser that reports to the President, replacing the earlier idea of a separate One Data agency, Kompas and CNBC Indonesia reported. CNN Indonesia reported that the body must be established within one year. According to InvestorTrust, Bappenas will lead the orchestration, while the Ministry of Communication and Digital Affairs (Komdigi) supports interoperability and infrastructure, as Deputy Minister Nezar Patria told the outlet.

Minister Meutya Hafid said on 7 October that data will not be moved to one place but will stay with each sector, InvestorTrust reported. Komdigi's role is to act as the connector, with the government service linking system, Sistem Penghubung Layanan Pemerintah (SPLP), as the bridge for data exchange between ministries and agencies. InvestorTrust reported that digital social protection is targeted to run in 2026, with wider coverage after a trial in Banyuwangi. Antara reported a concrete example from Ledia Hanifa Amalia: welfare decile data should be integrated with the data behind the PKH, KIP and PIP assistance programmes.

What is still unknown

None of the sources we read published the official text, a law number or an effective date, and none listed the implementing regulations or their deadlines. Reports also differ in detail: some say the law covers 15 substantive points, others list eight. Obligations for private organisations were not described in the reports we read. Until the text is published, specific requirements should be treated as reported, not final.

What organisations should prepare

This section is our analysis. The law mainly binds government data producers, but it will reach the organisations that build their systems and those that exchange data with them.

• Agencies and regional governments: inventory the datasets you produce, who owns each one, and how they map to shared metadata, reference codes and master data. That inventory will be needed for the national catalogue.
• Technology suppliers to government: expect new systems to be specified around shared standards and exchange through SPLP rather than point-to-point links, with access control, audit logs and incident reporting built in.
• Organisations that receive or supply government data: identify which data you exchange with public bodies and how it is likely to be classified, so access rules do not come as a surprise.
• Everyone: watch the security standard from the cyber security and cryptography agency, and test whether you could detect and report an incident within 24 hours if that requirement applies to you.

What to watch next

Three things will decide how the law works in practice: the publication of the official text and its number, the implementing regulations on standards, classification and security, and the formation of the One Data organiser within the reported one-year window. The roll-out of digital social protection will be the first visible test of connected data. In our view, how consistently agencies apply the shared standards, and how quickly SPLP connects them, will matter more than the text itself.