From that day forward, banks and other industries must take into account personal data protection rules in their business decisions and operations. It will align Indonesia with global data protection standards.

As we enter this new regulatory era, banks must ask themselves: How will the PDP Law reshape their approach to data protection and risk management?

At first glance, the PDP Law provides a vital framework for managing growing risks related to data breaches and cyber threats. However, the real challenge for banks is incorporating data protection into their overall risk management strategies.

Indonesian banks, which have long dealt with complex regulations and financial risks, now face the challenge of reassessing their risk appetite. This involves expanding their focus beyond traditional financial risks. Banks must now also address the rising threats associated with personal data protection.

Safeguarding personal data should now be embedded in the bank’s governance framework. It must become central to the bank's overall risk management. Even though incorporating data protection into a bank’s governance framework is essential, it may add complexities, extending beyond conventional focuses.

Hence, it must not be viewed merely as a compliance requirement handled by the bank data protection officer (DPO). Instead, it should permeate every aspect of the bank’s operations. By embedding data protection into daily risk management strategy, banks can proactively address potential threats before they escalate.