BSSN Goes Ministry-Level: What Indonesia’s New Cybersecurity Law Means for Every Business Operating in the Country

Indonesia is elevating BSSN to ministry-level authority with real enforcement powers. Here is what every business operating in Indonesia must do now.

In 2024, the Brain Cipher ransomware group demanded $8 million from Indonesia’s National Data Center after taking it offline. The attack knocked government services offline for weeks and exposed the systemic vulnerability of Indonesia’s national digital infrastructure. It also became the political catalyst for one of the most significant shifts in Indonesian cybersecurity governance in the country’s history.

In 2026, Indonesia’s cybersecurity regulatory environment is changing fundamentally. The BSSN Cybersecurity Bill, part of Indonesia’s 2025 National Legislative Program, is elevating the Badan Siber dan Sandi Negara (BSSN) to ministry-equivalent status with direct presidential authority, sweeping enforcement powers, and the ability to impose administrative sanctions. Simultaneously, the UU PDP (Personal Data Protection Law) is past its transition period and enforcement is ramping up.

For any business operating in Indonesia, whether domestic, ASEAN-regional, or a multinational with Indonesian operations, this combination of new powers and existing legal requirements creates a mandatory compliance environment that cannot be treated as optional.

What Is the BSSN Cybersecurity Law Change and Why Does It Matter?

BSSN Indonesia cybersecurity law reform in 2026 represents the most significant shift in the country’s cyber governance structure since BSSN was created in 2017. Under the new framework, BSSN will:

• Operate at ministry-equivalent status, reporting directly to the President of Indonesia
• Hold policy-making authority over national cybersecurity standards and requirements
• Exercise enforcement and investigative powers, including the authority to conduct investigations and demand remediation
• Impose administrative sanctions on organizations that fail to comply with cybersecurity requirements

This is a categorical change from the advisory role BSSN has historically played. With direct presidential authority and enforcement power, BSSN’s requirements become binding obligations with real consequences for non-compliance.

The UU PDP Enforcement Timeline: Where Things Stand in 2026

Indonesia’s Personal Data Protection Law (Undang-Undang No. 27 Tahun 2022, or UU PDP) was signed on October 17, 2022. The law included a two-year transition period that ended in 2024. In 2026, enforcement is ramping up.

The UU PDP establishes requirements that directly affect how organizations collect, process, store, and protect personal data belonging to Indonesian residents. Non-compliance carries:

• Administrative sanctions including fines up to 2% of annual revenue in Indonesia
• Criminal penalties for severe violations, including fines up to Rp 6 billion
• Mandatory breach notification requirements: organizations must report data breaches within 14 days
• Operational sanctions: potential suspension of data processing activities for serious or repeated violations

For organizations that have not yet conducted a UU PDP compliance assessment, the window for graceful preparation has closed. Enforcement actions are now a realistic consequence of non-compliance.

BSSN Regulation No. 1/2024: What Electronic Service Providers Must Do

Beyond the new Cybersecurity Bill, BSSN Regulation No. 1/2024 is already in effect and imposes specific requirements on Penyelenggara Sistem Elektronik (PSE), meaning Electronic Service Providers. These requirements include:

Mandatory Cyber Incident Response Teams (CIRTs)

ESPs must establish formal Cyber Incident Response Teams capable of detecting, analyzing, containing, and recovering from cybersecurity incidents. As of 2026, 537 CIRTs have been formally registered with BSSN, indicating that formal CIRT registration is now a documented requirement.

Incident Reporting Obligations

ESPs are required to report cybersecurity incidents to BSSN within specified timeframes. Failure to report, or delayed reporting, is itself a compliance violation subject to sanction. This means organizations need both the technical capability to detect incidents and the process infrastructure to report them within the required window.

Security Standards Compliance

Organizations must comply with BSSN-specified security standards relevant to their sector and risk profile. For critical infrastructure sectors including financial services, healthcare, and government-adjacent services, these standards are increasingly specific and comprehensive.

Why Indonesia Is Particularly High-Risk

Indonesia is the hardest-hit country by cyberattacks in Southeast Asia (BankInfoSecurity). This is not a statistical curiosity. It reflects the combination of: rapid digital economy growth creating large attack surfaces, historically underfunded cybersecurity programs across many sectors, significant volumes of sensitive data concentrated in digital payment platforms and e-commerce ecosystems, and a national infrastructure that has been demonstrably targeted by sophisticated ransomware operators.

The regulatory hardening being implemented in 2026 is a direct response to this threat environment. Organizations that treat Indonesian cybersecurity compliance as a lower priority than their compliance obligations in Singapore, the EU, or the US are misjudging both the legal exposure and the actual threat level.

What Businesses Operating in Indonesia Must Do in 2026

Compliance Action	Regulatory Basis	Priority
Conduct a UU PDP data mapping and gap assessment	UU PDP No. 27/2022	Immediate
Appoint a Data Protection Officer (DPO)	UU PDP requirements	Immediate
Establish or register a CIRT with BSSN	BSSN Regulation No. 1/2024	Immediate
Implement 14-day breach notification capability	UU PDP + BSSN Regulation	High
Build an incident response plan and playbook	BSSN requirements	High
Conduct annual security assessments	BSSN standards	Ongoing
Implement data encryption at rest and in transit	UU PDP data security requirements	High
Train employees on data protection and incident reporting	UU PDP compliance requirement	Ongoing

What Happens When Organizations Do Not Comply

The consequences of non-compliance in Indonesia’s 2026 regulatory environment are no longer hypothetical. With BSSN holding enforcement authority and UU PDP sanctions actively applicable, organizations face:

• Administrative fines based on Indonesian revenue: for a company with $10 million in Indonesian annual revenue, a 2% UU PDP fine represents $200,000
• Criminal liability for executives in cases of severe or willful violations
• Mandatory public breach notifications that carry significant reputational damage in a market where digital trust is a competitive differentiator
• Operational suspensions that can halt data processing activities critical to business operations
• Exclusion from government contracting and regulated sector participation for organizations with compliance violations on record

How Peris.ai Helps Indonesian Organizations Achieve Compliance

Peris.ai is officially registered with BSSN, making Peris.ai uniquely positioned to help Indonesian organizations build the technical and process infrastructure required for BSSN compliance. This registration is not just a credential. It means Peris.ai has demonstrated to the Indonesian national cyber authority that its platform meets the security standards the authority enforces.

BrahmaFusion: Incident Response Automation for BSSN Compliance

The most operationally demanding BSSN compliance requirement for most organizations is the combination of CIRT establishment and incident reporting obligations. BrahmaFusion’s agentic AI and hyperautomation platform automates the detection, triage, and response workflows that a functional CIRT requires. A finance company using BrahmaFusion reduced analyst workload by 35% while improving incident documentation quality, directly supporting the kind of incident reporting capability that BSSN Regulation No. 1/2024 requires.

Peris.ai IRP: Unified Case Management for Incident Reporting

Peris.ai IRP provides the unified case management, documentation, and audit trail infrastructure needed to meet BSSN incident reporting obligations. When an incident occurs, IRP creates a documented, timestamped case with MITRE ATT&CK classification, AI-generated summaries, and exportable reports that can directly support BSSN notification filings within the required 14-day window.

INDRA CTI: Threat Intelligence for Indonesian Threat Landscape

INDRA CTI provides real-time threat intelligence covering threat actors actively targeting Indonesian infrastructure, including ransomware groups, state-sponsored actors, and financially motivated cybercrime campaigns. For organizations building compliance programs, threat intelligence that covers the actual Indonesian threat environment is a prerequisite for appropriately calibrated security controls.

Use Case: Building a BSSN-Compliant CIRT with Peris.ai

An Indonesian e-commerce company with 2 million registered users needs to establish a formal CIRT to comply with BSSN Regulation No. 1/2024 and prepare for UU PDP enforcement.

1. BrahmaFusion is deployed as the automation backbone: detection playbooks, triage workflows, and escalation logic are configured for the company’s specific infrastructure
2. Peris.ai IRP is implemented for case management, providing MITRE ATT&CK mapping and documented response timelines
3. INDRA CTI is integrated to provide real-time intelligence on threats relevant to Indonesian e-commerce infrastructure
4. The CIRT is registered with BSSN with documentation of technical capabilities
5. Within three months, the company experiences a credential stuffing attack targeting customer accounts. BrahmaFusion detects and contains the attack within 4 minutes. IRP generates a complete incident report within 2 hours, enabling BSSN notification within the 14-day window with 12 days to spare.

Conclusion

Indonesia’s 2026 cybersecurity regulatory transformation is not a distant policy discussion. It is a current legal reality with enforcement teeth. Organizations operating in Indonesia that have not yet built the compliance infrastructure required by UU PDP and BSSN regulations are now operating with active legal exposure, not just regulatory risk.

Peris.ai’s BSSN registration and platform capabilities position it as the natural partner for Indonesian organizations building compliance programs. With BrahmaFusion, IRP, and INDRA CTI, organizations can build the detection, response, and reporting capabilities that the new regulatory environment requires.

Don’t wait for a breach to take action. Secure your organization today. Stay Secure with Peris.ai and visit peris.ai to learn how Peris.ai supports BSSN compliance for Indonesian organizations.

Frequently Asked Questions

What new powers does BSSN have under the 2026 Cybersecurity Bill?

Under the new framework, BSSN will operate at ministry-equivalent status reporting directly to the President of Indonesia, with policy-making authority, enforcement powers, investigative capabilities, and the authority to impose administrative sanctions on non-compliant organizations.

What are the penalties for non-compliance with UU PDP in Indonesia?

Administrative sanctions include fines up to 2% of annual Indonesian revenue. Criminal penalties for severe violations include fines up to Rp 6 billion. Organizations can also face operational suspensions and mandatory public breach notifications.

What does BSSN Regulation No. 1/2024 require from Electronic Service Providers?

Electronic Service Providers must establish formal Cyber Incident Response Teams (CIRTs), register those CIRTs with BSSN, and report cybersecurity incidents to BSSN within specified timeframes. Failure to report incidents is itself a compliance violation subject to sanction.

Is Peris.ai registered with BSSN?

Yes. Peris.ai is officially registered with BSSN, positioning Peris.ai as a validated security partner for Indonesian organizations building BSSN-compliant cybersecurity programs.

What is the minimum breach notification requirement under UU PDP?

Organizations must report data breaches to the relevant authority within 14 days of discovering the breach. This requires both the technical capability to detect breaches promptly and the process infrastructure to prepare and file formal notifications within the required timeframe.