Data Protection Impact Assessment Framework in the Banking Sector in Indonesia to Implement Law of Personal Data Protection

Abstract

Indonesia’s banking industry is evolving in personal data management due to technological advancements, which present both benefits and challenges. Influenced by global standards like the GDPR, Indonesia’s Law No. 27 of 2022 on Personal Data Protection incorporates these principles to enhance data protection. The Data Protection Impact Assessment (DPIA), a key risk mitigation tool mandated by the GDPR, is required for high-risk data processing under Indonesian law, though implementation regulation is still pending. This research develops and validates a DPIA framework tailored to the Indonesian banking sector, addressing components that can be considered to be the base framework of DPIA in Indonesia. Recommendations include adopting a comprehensive DPIA framework, staff training, instrument validation, integrating DPIAs into business processes, developing IT applications for DPIA, and continuous monitoring. This research offers practical solutions and contributes to the broader data protection literature.