In early October 2026, the illegal trade in personal data was back in the Indonesian headlines. On Friday, 2 October 2026, Alexander Sabar, Director General of Digital Space Supervision at the Ministry of Communication and Digital Affairs (Komdigi), said the ministry was working with the National Police to act against websites selling personal data, including by blocking access. Komdigi also coordinated with the National Cyber and Crypto Agency (BSSN), whose initial analysis found that the circulating data was old data being pushed around again.
If you run a shop, a clinic, a training centre, or a food business, news like this can feel distant. Big leaks involve big databases, not the customer list on your admin's phone. That is exactly the lesson, though. This article covers what happened, what the law says, and a checklist you can run through in your own business this week.
What actually happened
According to BSSN, the data in circulation was a compilation of publicly available information and earlier leaks, gathered again and redistributed by unnamed parties. BSSN still treats it as serious and is tracing its source and spread. Komdigi asked the public not to share other people's personal data, and BSSN asked people not to pass around screenshots or fragments of it, including data belonging to public officials.
Two takeaways matter for businesses:
- Data that has leaked once never really disappears. It can be compiled and sold again years later. A list of customer numbers scattered across WhatsApp groups today can end up in a collection like this.
- "Already leaked" does not make data free to use. Komdigi was clear that personal data remains its owner's privacy even after it has been exposed.
What Indonesia's data protection law says, in plain terms
The legal basis is Law Number 27 of 2022 on Personal Data Protection (UU PDP), promulgated on 17 October 2022. Article 74 gave organisations at most two years to adjust. That adjustment period ended in October 2024, so the obligations now apply to anyone who collects and uses personal data, small businesses included.
The obligations closest to the cashier's desk:
- Have a lawful basis for processing data, such as the customer's consent for a stated purpose, or because it is needed to carry out the transaction (Article 20).
- Protect the data and prevent unauthorised access to it (Articles 35 and 39), including supervising anyone who processes data on your behalf (Article 37).
- Delete data that is no longer needed for its purpose (Article 43).
- Notify in writing within 3 x 24 hours both the people affected and the supervisory body if personal data protection fails, stating at minimum what was exposed, when and how, and what is being done about it (Article 46).
Breaching these obligations can lead to administrative sanctions: a written warning, suspension of processing, deletion of data, and administrative fines of up to 2 percent of annual revenue (Article 57). Separately, unlawfully obtaining, disclosing, or using someone else's personal data carries up to 4 to 5 years in prison and/or fines of up to Rp4 billion to Rp5 billion, depending on the act (Articles 65 and 67). That covers the "ready-made WhatsApp number database" offers that sometimes reach small businesses. Buying and using one is not a shortcut. It is a new problem.
Start with a map, not an app
The first step is the one most often skipped: knowing exactly where your customer data lives. In a small business, the answer is almost always longer than expected.
Take a sheet of paper or a spreadsheet and write down each place along with who holds it. ID photos customers sent over chat, order recaps shared with an "anyone with the link" setting, address lists sent to couriers. All of it goes on the list.
A five step checklist
Once the map exists, tidy up in stages. The order runs from easiest to hardest, so you can start this week without waiting for a new system.
- Map it. Finish the list. Flag anything sensitive, such as ID photos, patient health information, or data about children at a training centre.
- Check reasons. For each type of data, ask why you keep it and whether the customer knows. If WhatsApp numbers are used for promotions, make sure customers actually agreed to be contacted for that.
- Limit access. This step has the biggest impact. One account per person, not one password passed around. Spreadsheet links restricted to named people. When an employee leaves, their access goes the same day.
- Clear old data. Old exports on a laptop, chat groups for finished projects, copies on a flash drive. If they no longer serve a purpose, clear them out regularly.
- Plan a response. Write one page: if data leaks, who decides, who contacts customers, and who drafts the written notice. A 3 x 24 hour deadline feels very short if you only start thinking after the fact.
Protection comes in layers
Many owners assume data security is the app's job. A good app helps, but leaks often take simpler routes: an admin phone with no screen lock, a password taped to the cashier's desk, or a former employee still sitting in the group chat.
The people and process layers cost very little, mostly agreements and habits. The device layer takes some discipline, such as a locked phone dedicated to the business rather than a borrowed personal one. The system layer is where technology helps most: individual accounts, a record of who opened which data, and backups that not just anyone can open.
Closing
The data trading case in early October is a reminder that scattered data can outlive the transaction it came from by years. The good news is that most of the steps above can start without buying anything.
If it is the system layer you want to sort out, XETUP builds applications around the way your business actually works, with separate accounts per employee and access records you can trace, including the XETPOS point of sale app so transaction data is not spread across receipts and spreadsheets. Want to talk through the state of your customer data first? Chat with our team on WhatsApp +62 823 1499 5005.