In a world increasingly shaped by data, trust has become both our greatest asset and our most fragile resource. 

The recent polemic around the transfer of citizens' personal data to the United States under a trade arrangement has triggered a wave of questions. It was not just about compliance. At its core, it reopens a deeper conversation about whether we are prepared to protect what truly matters in the digital age.

It is important to acknowledge that the global economy runs on cross-border data flows. For Indonesia to be part of global trade, investment and innovation, data mobility is inevitable. Hence the question is not whether data should move, but rather under what terms, with what protections and guided by whose values. In the absence of clear answers, the public may grow wary.

Over the past decade, Indonesians have witnessed the expansion of digital services into every aspect of life. Often without a clear understanding of how their personal information is collected, stored, processed or monetized. And when breaches occur, the response tends to be procedural rather than principled.

Over time, this uncertainty may breed a kind of quiet resignation or "learned helplessness." After experiencing repeated harm or confusion without adequate recourse, an individual may begin to believe that nothing they do can make a difference. In the context of data privacy, this is more than just a state of mind – it may become a systemic risk.

Consumers may start clicking agree to everything, not out of trust, but out of fatigue. They stop filing complaints because they expect no resolution. They begin to assume that privacy is a luxury for the powerful, not a right for everyone. And that resignation may not stop with the public, but creeps into institutions as well.

Banks are navigating rapid digitalization, market competition and complex regulatory landscapes. In this environment, some may begin to see privacy not as a strategic pillar, but as a compliance burden. When the pressure is overwhelming, they may be tempted to do the minimum: publish a privacy policy, outsource the risk and move on.

This is the latent danger we now face. It is not about whether a data deal with other countries is right or wrong. Rather, the danger is that without clear terms and strong local safeguards, the deal could reinforce a cycle of passive compliance and eroded trust.

To avoid drifting into learned helplessness, we must embrace "learned optimism." It is a deliberate choice to work toward the possibility of a system that serves both innovation and integrity. It starts with acknowledging what is broken, then choosing to repair it.

Several things must happen if we are to move forward on this path. First, we need institutional clarity. The implementation of the personal data protection (PDP) Law must be accompanied by a credible, independent Data Protection Authority. It should carry the mandate, capacity and political support to enforce the law fairly. If the authority remains in transition, it may create uncertainty. Not only among businesses, but also among the consumers who seek a trustworthy recourse.

Second, we need stronger, enforceable standards for cross-border data transfers. Global data cooperation can, in fact, enable innovation and partnerships. But it must be done on the basis of reciprocity, transparency and enforceable protection. Any data transfer agreement with foreign entities should not be a blank check. It should include provisions for meaningful oversight and accountability.

Third, we need cultural change within industry. Financial institutions, financial technology businesses and digital platforms must see data protection not as a legal hurdle, but as a relationship with their users. That relationship, like any other, relies on honesty, respect and consistency. Disclosures should be clear, and data processing should be based on valid ground. When incidents occur, the response should prioritize people, not public relations.

To their credit, many business actors in the financial sector are already leaning in. A good number of banks have deliberately begun to strengthen internal governance. They invest in technology to embed privacy into their digital services. These are not just risk-mitigation moves, they are acts of social responsibility.

Civil society, too, is stepping up. In recent years, associations such as the financial industry data protection and privacy network or FINDANET have emerged. It brings together professionals across the financial sector who share a common concern: how to protect data while advancing digital transformation. These are not headline-grabbing initiatives. They represent something essential: communities that refuse to be passive and who are willing to help design solutions from the ground up.

None of this will succeed without public engagement. For trust to grow, consumers must feel seen, heard and protected. That means empowering them with digital literacy and building a legal culture that upholds privacy as a fundamental right, not a negotiable privilege.

 

The deal with any foreign countries may proceed. But it must be accompanied by a visible effort to anticipate its implications, prepare the safeguards and invite scrutiny. Openness is not a sign of weakness, it is the foundation of credibility. The stakeholders, including the industry, must speak in one voice: that Indonesia values innovation, but not at the expense of its people’s loosened data privacy.

In the end, the question is not whether we share data, but whether we share it responsibly. If we are to be part of the global digital economy, we need to ensure that our participation is grounded in fairness and foresight. Trust cannot be outsourced. Privacy cannot be an afterthought. And helplessness must never be allowed to settle in, not in the public, and not in the institutions meant to serve them.

This is not a time to retreat. It is a time to rise with vigilance, with humility and with the optimism that meaningful change is still possible. If we choose to act with integrity, Indonesia can do more than comply with global standards. We can even help shape them.

---

The writer is a legal and corporate secretary at Bank DBS Indonesia. The views expressed are personal.