A Juridical Review of the Formulation of a Data Sharing Agreement in the Digital Service Ecosystem of the Indonesian National Police Based on the Personal Data Protection Law
DOI:
https://doi.org/10.38035/snlpr.v3i1.1282Keywords:
Data Sharing Agreement, Polri Digital Services, Personal Data Protection, Police 4.0, Personal Data Protection LawAbstract
The acceleration of digital transformation toward realizing Police 4.0 requires the
Indonesian National Police (Polri) to integrate public services and engage in massive data
sharing with third parties, including government ministries/agencies and private partners.
However, this system interconnectivity triggers cyber risks and serious threats of personal
data breaches, as confirmed by various nationwide data breach incidents. Unlike prior studies
that generally focus on general compliance review of the Personal Data Protection Law (UU
PDP) or macro-level government data governance, this research specifically fills a research
gap concerning the contractual instruments governing the legal relationship between Polri
and third parties in technology-based public data sharing. This research analyzes the legal gap
resulting from the absence of internal technical regulations adopting the Data Protection by
Design principle in the development of police service applications, as well as the inadequacy
of conventional Cooperation Agreements (Perjanjian Kerja Sama/PKS) and Non-Disclosure
Agreements (NDA). Based on interviews with three vendors and an analysis of the contract
documents they provided, these existing instruments are limited to confidentiality provisions
and fail to accommodate compliance clauses in accordance with Law Number 27 of 2022
concerning Personal Data Protection (UU PDP), such as purpose limitation, mandatory
notification of personal data protection failures, cyber compliance audit rights, and
indemnification clauses. This research aims to address two main issues: first, how aligned the
application development and data exchange mechanisms in Polri's digital service ecosystem
are with the UU PDP, and what this implies for the allocation of legal liability between Polri
as the Personal Data Controller and private vendors as Personal Data Processors within the
police data-sharing scheme; and second, how an ideal Data Sharing Agreement (DSA) clause
formulation should be structured to ensure compliance with the UU PDP. Employing a
normative juridical research method through statutory and conceptual approaches, both issues
are analyzed comprehensively. The results of this research formulate a standardized and
binding Data Sharing Agreement (DSA) to ensure legal certainty, mitigate legal liability and
reputational risks for Polri as an institution, and provide optimal protection of the privacy
rights of the public as data subjects.
References
Cavoukian, Ann. (2009). Privacy by Design: The 7 Foundational Principles. Toronto:
Information and Privacy Commissioner of Ontario.
Fuller, Lon L. (1969). The Morality of Law. New Haven: Yale University Press.
Kelsen, Hans. (2006). Teori Umum tentang Hukum dan Negara [General Theory of Law and
State], translated by Raisul Muttaqien. Bandung: Nusa Media.
37 | Page
https://research.e-siber.org/SNLPR Vol. 3, No. 1, October 2026– March 2027
Marzuki, Peter Mahmud. (2011). Penelitian Hukum [Legal Research]: Revised Edition.
Jakarta: Kencana Prenada Media Group.
Makarim, Edmon. (2010). Tanggung Jawab Hukum Penyelenggara Sistem Elektronik [Legal
Liability of Electronic System Operators]. Jakarta: Rajawali Pers.
Mertokusumo, Sudikno. (2007). Mengenal Hukum: Suatu Pengantar [Getting to Know Law:
An Introduction]. Yogyakarta: Liberty.
Otto, Jan Michiel. (2006). Kepastian Hukum di Negara Berkembang [Legal Certainty in
Developing Countries]. Jakarta: Proyek Pembinaan Badan Pembinaan Hukum
Nasional.
Rosadi, Sinta Dewi. (2015). Hukum Privasi dan Pelindungan Data Pribadi di Indonesia
[Privacy Law and Personal Data Protection in Indonesia]. Bandung: PT Citra Aditya
Bakti.
Abdurrahman, A., & Herawati. (2023). “Urgensi Pelindungan Data Pribadi dalam
Implementasi Sistem Pemerintahan Berbasis Elektronik (SPBE)” [The Urgency of
Personal Data Protection in the Implementation of the Electronic-Based Government
System (SPBE)]. Jurnal Hukum Tata Negara, 10(2), 145-160.
Pramono, B., & Setiawan, R. (2022). “Tanggung Jawab Hukum Pihak Ketiga atas
Kebocoran Data dalam Perjanjian Cloud Computing” [Legal Liability of Third Parties
for Data Breaches in Cloud Computing Agreements]. Jurnal Hukum Siber dan
Teknologi, 5(1), 33-48.
Yuniarti, S. (2020). “Pembatasan Pertanggungjawaban (Limitation of Liability) dalam
Kontrak Elektronik B2B” [Limitation of Liability in B2B Electronic Contracts]. Jurnal
Hukum Bisnis Digital, 3(2), 77-92.
Law Number 27 of 2022 on Personal Data Protection (State Gazette of the Republic of
Indonesia of 2022 Number 196, Supplement to the State Gazette Number 6820).
Law Number 1 of 2024 on the Second Amendment to Law Number 11 of 2008 on Electronic
Information and Transactions (State Gazette of the Republic of Indonesia of 2024
Number 1, Supplement to the State Gazette Number 6905).
Indonesian Civil Code (Kitab Undang-Undang Hukum Perdata/Burgerlijk Wetboek).
Presidential Regulation Number 95 of 2018 on the Electronic-Based Government System
(State Gazette of the Republic of Indonesia of 2018 Number 182).
Presidential Regulation Number 39 of 2019 on One Data Indonesia (State Gazette of the
Republic of Indonesia of 2019 Number 112).
Presidential Regulation Number 82 of 2023 on the Acceleration of Digital Transformation
and the Integration of National Digital Services (State Gazette of the Republic of
Indonesia of 2023 Number 159).
Regulation of the Indonesian National Police Number 4 of 2022 on One Data of the
Indonesian National Police (State Bulletin/Berita Negara of the Republic of Indonesia
of 2022 Number 310).
General Data Protection Regulation (GDPR)– Regulation (EU) 2016/679 of the European
Parliament and of the Council of 27 April 2016 on the protection of natural persons
with regard to the processing of personal data and on the free movement of such data.
Badan Siber dan Sandi Negara (BSSN) [National Cyber and Crypto Agency]. (2022).
Laporan Tahunan Monitoring Keamanan Siber 2022 [2022 Annual Cybersecurity
Monitoring Report]. Jakarta: Direktorat Operasi Keamanan Siber BSSN.
CNN Indonesia. (2022). “Dugaan 1,3 Miliar Data SIM Card Bocor dan Saling Lempar
Tanggung Jawab” [Alleged Leak of 1.3 Billion SIM Card Records and Mutual Blame
Over Responsibility], accessed from
https://www.cnnindonesia.com/teknologi/20220909190301-192-845818/kasus-
kebocoran-13-miliar-data-di-ri-disebut-terbesar-di-asia on 26 September 2026.
38 | Page
https://research.e-siber.org/SNLPR Vol. 3, No. 1, October 2026– March 2027
Kompas. (2021). “Kasus Kebocoran Data 279 Juta Penduduk di BPJS Kesehatan” [The
Case of the Leak of 279 Million Residents' Data at BPJS Kesehatan], accessed from
https://www.kompas.com/tren/read/2021/05/21/201500565/bahaya-kebocoran-data-
yang-diduga-dari-laman-bpjs-ini-kata-ahli-it?page=all on 26 September 2026.
Reuters. (2021). “Vulnerability in Indonesia's e-HAC Application Exposes Personal Data of
Millions,” accessed from https://www.thejakartapost.com/news/2021/08/31/authorities-
probe-suspected-ehac-data-breach-of-1-million-users on 26 September 2026.
Interviews with Interviewees from Vendor A, Vendor B, and Vendor C (providers of Polri
service application development services; identities anonymized), conducted on 26
September and 15 October 2026.
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Enjang Priambodo, Edi Saputra Hasibuan, Diana Fitriana
This work is licensed under a Creative Commons Attribution 4.0 International License.
