Government Regulation on the Operation of Electronic Systems and Transactions, security-incident reporting duty
Government Regulation No. 71 of 2019 (PP PSTE), Pasal 24(3)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 10 October 2019.
A vulnerability and incident reporting rule binding public and private bodies.
As of 16 September 2026.
What it requires
- This binds the same Electronic System Operator as this jurisdiction's Article 23/24(1)-(2) security-system duty; it adds an incident-reporting duty rather than reaching a different party.
- On a system failure or disruption with a serious impact resulting from another party's act against your Electronic System, such as an attack or intrusion, secure the affected Electronic Information and/or Electronic Document.
- Report the incident immediately, at the first opportunity, to law enforcement officials and the relevant Ministry or Agency; the Government Regulation states no numeric clock for this report, only immediacy.
- A violation can draw the same Article 100 administrative sanctions (written warning, an administrative fine of an amount this Government Regulation does not itself fix, temporary suspension, access termination, or removal from the operator registry) as this jurisdiction's security-system duty.
If you get it wrong
Criminal exposureNo
Criminal exposure note
Article 100(5) states that an administrative sanction under this Government Regulation does not extinguish criminal or civil liability, but this Government Regulation does not itself create a criminal offense for failing to report an incident; that exposure, if any, arises under a different statute such as the Electronic Information and Transactions Law's unauthorized-access offense, already this jurisdiction's scraping-topic finding.
Who enforces it
Enforcement body
The Minister who administers government affairs in the field of communications and informatics (Menteri Komunikasi dan Informatika, since renamed the Ministry of Communication and Digital Affairs / Komdigi), who imposes any of Article 100(2)'s five administrative sanctions.
What it reaches
Obligation class
Security, Reporting
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Where a system failure or disruption with a serious impact results from another party's act against its Electronic System, such as an attack or intrusion, the Electronic System Operator must secure the affected Electronic Information and/or Electronic Document and report the incident immediately, at the first opportunity, to law enforcement officials and the relevant Ministry or Agency.
The Government Regulation states no numeric clock for that report, only immediacy at the first opportunity, and binds the same general population of government and private Electronic System Operators as this jurisdiction's Article 23/24(1)-(2) security-system duty.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreachhigh_risk_decisionsprocesses_voiceprocesses_biometricsserves_minorsoperates_social_platformships_mobile_appdistributes_software_product