Indonesia Passes One Data Law, Strengthening BIG’s Role in Shared Maps and National Data Governance

A common reference for government data

Indonesia’s House of Representatives approved the One Data Indonesia Law on October 6, 2026, establishing a framework of 20 chapters and 141 articles for connecting government data without requiring ministries and local authorities to surrender their databases. For the Geospatial Information Agency (BIG), the change strengthens the legal basis for making maps and location information consistent across government.

The law places National Basic Data, known by the Indonesian abbreviation DDN, at the center of development planning, fiscal policy, budgeting and social assistance distribution. It also introduces requirements for data security, human oversight of artificial intelligence and public participation. One provision agreed during committee deliberations requires data incidents to be reported within 24 hours.

House Speaker Puan Maharani presided over the ninth plenary session of the first sitting period of the 2026–2027 parliamentary year in Jakarta. All eight parliamentary factions agreed to approval. National Development Planning Minister and Bappenas Head Rachmat Pambudy delivered the government’s final position on behalf of the President, also speaking as chair of the One Data Indonesia steering council.

Bappenas’s law approval statement describes the legislation as a stronger legal foundation for a policy previously governed by Presidential Regulation No. 39 of 2019. The intended result is accurate, current, connected and secure data that can support public decisions.

The practical distinction is between agreeing on how information is described and exchanged, and physically moving every government database into one place. The law’s approach is the former. BIG’s role is central because location provides a common way to connect information about land, infrastructure, environmental conditions, disasters and public services.

What changes for BIG?

Acting BIG Head Mohamad Arief Syafii has stressed the need for a common geospatial reference linking information held by ministries, agencies and local governments. A national base map provides the shared geographic foundation on which different institutions can place their own information, reducing discrepancies that can produce conflicting policy decisions.

Arief attended the approval session with BIG Secretary General Belinda Arunarwati Margono and Deputy for Thematic Geospatial Information Antonius Bambang Wijanarto. BIG is advancing data stewardship at national and local levels, developing geospatial information network nodes and providing foundational geographic data.

This responsibility did not begin with the new law. Article 13(3) of the 2019 presidential regulation assigns central geospatial data guidance to the government body responsible for geospatial information. Article 20(3) assigns the corresponding regional role to an agency designated to manage a local government node in the National Geospatial Information Network.

The distinction between roles matters. The regulation uses separate categories for bodies that guide data standards, institutions that produce data and custodians that manage its distribution. BIG’s national guidance function should therefore not be confused with ownership of every thematic map. The new framework strengthens common requirements while preserving the substantive responsibilities of ministries and agencies.

Who produces the maps?

That division of responsibility became a specific issue during deliberations. At a working committee meeting in Senayan, Jakarta, on September 29, Legislative Body member Reni Astuti questioned why BIG appeared as a geospatial data producer in the minister’s presentation but was absent from the draft provision being discussed.

The DPR’s geospatial producer discussion records her request to distinguish foundational national data from thematic or sectoral information. BIG has authority over foundational geospatial data, while other institutions produce maps within their own areas of responsibility.

Reni identified the Agrarian Affairs and Spatial Planning Ministry and National Land Agency as producers of land maps, the environment and forestry ministry as responsible for forest area information, and the Energy and Mineral Resources Ministry as producing geology and mining data. Local governments produce spatial planning information. The armed forces and police also generate geospatial information for defense and security.

Her intervention identifies a concrete implementation issue: a shared map reference does not eliminate the need to specify who creates, checks and maintains each dataset. The public descriptions of approval do not establish exactly how the final wording resolved the omission she identified.

From committee deliberations to approval

The bill originated as a DPR initiative. Working committee chair Sturman Panjaitan, also deputy chair of the Legislative Body, said its drafting was grounded in the constitutional mandate to protect Indonesian citizens. The legislative process included public hearings with experts, associations and civil society groups.

The DPR’s committee agreement statement records 1,338 government discussion items concerning the bill’s main provisions and another 829 concerning its explanatory text. Together, these total 2,167 items. Bappenas’s shorter account cites 1,338 items, without separately listing the explanatory text items.

The sequence shows how the final committee agreement preceded the plenary vote:

• September 23, 24, 28, 29 and 30, 2026: The working committee and government discussed the bill.
• September 29: Reni Astuti sought clearer identification of geospatial data producers.
• October 1 and 5: Further deliberations completed the committee process.
• October 5: The Legislative Body and government reached the Level I agreement on 20 chapters and 141 articles.
• October 6: The plenary session approved the bill.
• October 7: Legislator Rieke Diah Pitaloka described a village approach to data collection using spatial maps.

The committee account also says the draft’s separate prohibitions chapter was removed, with its substance incorporated into criminal provisions. That was a change in the organization of the legislation, not a statement that prohibited conduct would go unpunished.

Connected systems, not one giant database

In its plenary approval account, the government’s One Data Indonesia portal explains that interoperability does not require physical centralization of databases or a transfer of ownership, control and management responsibility away from data producers.

Interoperability means that different systems can exchange and use information consistently. Shared standards define how data is structured. Metadata explains what a dataset contains, where it came from and how it was produced. Reference codes and master data help different agencies identify the same place, organization or other object using matching references.

The law covers a national data catalog as well as a master plan, architecture, management framework and implementation cycle. These are intended to organize how information is planned, maintained, discovered and exchanged, rather than simply connect systems that use incompatible definitions.

Bappenas is also preparing Government Agency Data Exchange Guidelines. Under the proposed mechanism, the National Data Catalog System would support approval, monitoring and auditing of exchanges and connect with the Government Service Hub System, known as SPLP. This remains a proposed implementation arrangement, not evidence that the exchange mechanism is already operating everywhere.

There is an existing legal baseline for simpler access. Article 39 of the 2019 regulation already provides free portal access for central and regional government agencies without requiring memoranda of understanding, cooperation agreements or declaration documents. The new exchange arrangements therefore need to make existing access principles work reliably alongside stronger security and accountability requirements.

Villages become part of the data foundation

The law distributes responsibilities from central government to regions, villages and urban wards. The committee agreement includes village and ward data deliberations as participatory forums for agreeing on local data.

Rieke Diah Pitaloka, a member of DPR Commission XIII, said on October 7 that foundational national data collection should begin in villages and urban wards, with residents acting as participants rather than merely subjects of surveys. She described an approach already applied through collaboration in more than 500 villages.

Rieke identified five types of working maps: orthophotos, population administration, infrastructure, land use and topography. An orthophoto is an aerial image corrected so that its scale and positions can be used as a map. These maps allow residents to connect numerical information with actual locations.

Her account gives a practical local counterpart to BIG’s national role. Shared geographic references can help connect village information to wider government systems, while residents contribute knowledge about conditions and needs. The figure of more than 500 villages describes the collaboration she cited, not a nationwide implementation total.

Why data quality matters for public services

DDN is intended to become the main reference for development planning, fiscal and budgetary policy, social assistance and other strategic national needs. Rachmat linked this foundation to long term and medium term development plans, national strategic projects and annual government work plans.

Sturman Panjaitan, the working committee chair, connected data quality directly to fairness in public spending and assistance during the approval process.

"When data is flawed, it is not merely the figures that are incorrect; justice itself is compromised. Misdirected aid, overlapping programs, and inefficient budget utilization often stem from a single source: poorly managed data," he said.

The legal framework does not itself prove that assistance targeting or budget decisions have improved. Its contribution is to establish shared references and responsibilities that should make contradictory records easier to identify and resolve.

CISSReC expert Pratama Persadha said government datasets remain inconsistent in their definitions, formats, update periods and accuracy. He warned that connecting inaccurate information can spread errors rather than correct them. This makes quality checks a prerequisite for useful integration, not a task that can be left until after systems are linked.

The earlier regulation already specifies four stages: planning, collection, examination and dissemination. It also requires producers to collect information according to agreed standards and update schedules, with accompanying metadata. Stronger technology will still depend on those basic disciplines being followed.

Security requirements extend beyond databases

The law classifies information as open, restricted or closed. According to the committee agreement, it provides for security standards set by the institution responsible for cybersecurity and cryptography, cryptographic infrastructure, digital certificate management, and security and data sovereignty audits.

Sturman identified the National Cyber and Crypto Agency (BSSN) as responsible for securing national exchange channels against hacking and leaks. This points to a broader requirement than protecting stored databases: information must also be protected while moving between institutions.

The committee statement specifies incident reporting within 24 hours. It also says access to and transfer of closed data outside Indonesian jurisdiction require DPR approval. Restricted data access may carry charges treated as non tax state revenue. These rules mean that connecting datasets does not make every record publicly accessible.

Reports of the criminal provisions identify Articles 129–135 as addressing conduct including sabotage, cyberattacks, manipulation and seizure of national data centers. Legislative Body Deputy Chair Martin Manurung described maximum penalties of 15 years in prison or a category eight fine. Article 134 provides for penalties increased by one third for state officials, while Article 135 contains provisions for corporations.

Those maximum penalties should not be read as applying uniformly to every administrative error or data incident. The public descriptions do not explain all offense definitions, conditions or monetary values. The law also includes administrative sanctions.

Personal data and AI need separate safeguards

Bappenas says the law covers personal data protection and keeps the use of artificial intelligence under human supervision. The committee account also includes blockchain and other digital technologies, with requirements for traceability and national data sovereignty.

Pratama called for implementation to align with Law No. 27 of 2022 on Personal Data Protection. Connecting population, health, education, tax, employment and assistance records can produce sensitive profiles. Risks therefore include misuse beyond the original purpose, identity theft and inappropriate profiling, as well as leaks.

His recommended approach includes building security into system design, checking each access request and recording activity. He also advocated Zero Trust, meaning that a user or system should not be trusted automatically merely because it belongs to a government agency. These are his recommendations, not a claim that every technical measure is mandated in the law.

Human oversight is particularly important when automated analysis affects eligibility for assistance or other rights. Incorrect records, biased models and false alerts can produce harmful decisions even when systems are technically connected.

The law provides for public input, reports of suspected misuse, participatory monitoring and voluntary data contributions. Disputes are to prioritize mediation, with a maximum initial period of 14 working days that may be extended by another 14. Sturman also said residents retain the right to seek legal remedies if their personal data is misused or inadequately protected.

The coordinating body and unresolved deadlines

The law provides for a One Data Indonesia administrator accountable to the President. The committee describes its functions as coordination, rule setting and support, without concentrating control of all data in one institution. Bappenas says implementation should not take over ministries’ existing substantive tasks.

Reports differ on the formation deadline. The DPR’s October 5 committee statement says the administrator must be established within one year. A separate account attributes to Sturman a maximum of two years, with six months preferable. That account identifies Article 39 as the institutional mandate and says the President can decide whether Bappenas performs the role or a new body is required. The precise deadline and institutional form need confirmation in the promulgated text and implementing measures.

Deputy Communication and Digital Minister Nezar Patria said his ministry would support digital infrastructure and interoperability, while Bappenas leads national coordination. Reports place those remarks on October 7 and October 10; one also calls him minister rather than deputy minister. They agree on the division of work he described.

Government administration scholars Amalinda Savirani of Gadjah Mada University and Eko Prasojo of the University of Indonesia warned that additional bodies can create overlapping authority and a heavier bureaucracy. They argued for stronger existing institutions and clearer functions, rather than treating a new agency as an automatic solution.

Implementing regulations are the next task. No fixed publication date is identified. For BIG, successful implementation will depend on translating the shared reference principle into usable base maps, compatible thematic data and functioning local network nodes, while maintaining clear responsibility for quality, access and security.

Key Points

• The DPR approved the One Data Indonesia Law on October 6, 2026, with 20 chapters and 141 articles.
• BIG’s geospatial guidance role gains a stronger legal foundation, building on the 2019 presidential regulation.
• Shared standards and references connect government systems without requiring one centralized database.
• National Basic Data will guide planning, budgeting, fiscal policy and social assistance.
• The framework reaches villages and urban wards and includes public participation.
• Committee provisions require incident reporting within 24 hours and DPR approval for access to and transfer of closed data outside Indonesian jurisdiction.
• Reports differ on whether the coordinating administrator must be formed within one or two years.
• Implementing regulations, institutional arrangements and practical quality controls still require further action.