The privacy law has no watchdog, and a new bill would pool the data anyway

Indonesia's Personal Data Protection Law took effect in 2024, but the detailed rules that make a law usable are still incomplete, and the PDP Agency the law requires has never been set up. That was the position in July 2026, when the government pushed ahead with a One Data Bill to pull records held by different ministries into one shared system. The privacy law still has no regulator, and the plan is to pool everyone's data anyway.

Yanuar Nugroho, a visiting senior fellow at the ISEAS-Yusof Ishak Institute in Singapore, argues in Fulcrum that this is not a one-off. He sets four changes side by side. The revised P2SK financial law, passed in June, tells Bank Indonesia to support growth and employment and gives parliament wider power to judge the central bank's performance. The 2026 budget cut money sent to regions and villages from IDR848.52 trillion to about IDR693 trillion, close to a fifth less and the deepest such cut in 25 years. Danantara, the sovereign wealth fund started in February 2025, now sits on state assets worth more than USD900 billion, and Indonesia Corruption Watch found that 24 of its 31 officials are "politically exposed persons", meaning they hold political office or are close to people who do.

The argument is not that decisions moved to Jakarta. Plenty of countries centralise. It is that the checks did not move with them. Parliament gained a say over the central bank, the fund holding the country's largest assets is staffed mostly by political figures, and a national data system is being built before the office meant to guard it exists. Civil society groups set up their own monitoring platform for Danantara because there was no official one to use. Nugroho's warning is that the state stops being answerable to institutions and citizens and ends up "answerable only to itself."

Why it matters

The part likely to reach you first is the data. The records ministries hold on you, from your ID to health and school files, are exactly what a One Data system joins up, and if that data leaks or gets misused there is currently no regulator to complain to. Watch which comes first: the PDP Agency being formed, or the One Data Bill passing. If you deal with a local clinic, school or road repair, the regional budget cut is the other thread to follow, because that is the money that pays for them.