Data Breach Incidents: 72-Hour Notification Duty under Indonesia’s PDP Law & Response Playbook
Data thieves wait 200 days to sell. The PDP Law gives you 72 hours to report — the better-prepared side wins in court.
Article 46: What Must Be Done within 72 Hours?
A controller experiencing a breach must notify in writing:
- The PDP Authority — as soon as possible, maximum 3x24 hours from awareness (awareness, not completed forensics)
- Data Subjects — where there is high risk to rights (e.g., leaked NIK + financial + address) — in clear Indonesian, not jargon
Notification Contents (checklist)
- Nature of incident, categories & estimated number of affected subjects / records
- DPO / contact point
- Likely consequences (fraud, phishing)
- Mitigation efforts: password reset, monitoring, compensation
Snipeyes 6-Step Playbook (first 72 hours)
- Contain (0-6h): isolate, revoke keys, forensic snapshot
- Assess (6-24h): data categories, volume, risk — decide whether subject notification is required
- Notify Authority (≤72h): initial report (follow-up report allowed)
- Notify Subjects (if high risk): encrypted email + call center info, not phishing-prone links
- Remediate: patch, rotation, harden — prove it in the report
- Post-incident: ROPA & DPIA update + lessons for audit
Fines for Late Notification
Late notification = administrative sanction + aggravated fines / imprisonment if escalated to criminal charges (Article 67). Forensic timeline documentation becomes your defense evidence.
Prepare a “Breach Envelope” — notification template + PDP Authority contacts + processor list — with tabletop exercises every semester.
72-Hour Notification Template — Download → · 24/7 SOC for Early Detection →