Indonesia: passenger data record

Personal data law and the missing authority

Law No. 27 of 2022 on Personal Data Protection was enacted in Jakarta on 17 October 2022 and took effect the same day ¹. It is published as State Gazette 2022 No. 196 ¹. The state audit board legal database lists a Constitutional Court ruling, No. 151/PUU-XXII/2024, that changed the reading of the word "and" in Article 53(1)(b) to "and/or" ¹.

As reported by Agus Tri Haryanto of detikInet on 23 July 2026, Deputy Minister of Communication and Digital Affairs Nezar Patria said the personal data protection authority was in its final stage of formation ². He said it had no legal basis yet and would be set up by presidential regulation as an independent body reporting to the President through the ministry ². The regulation was targeted for completion in about two months ². This page could not confirm whether it has been issued.

All Indonesia arrival declaration

The October 2025 issue of BhumiPura, the magazine of the Directorate General of Immigration, describes All Indonesia as one digital platform for arrival declarations ³. It replaces four separate forms for Immigration, Health, Quarantine and Customs ³.

Since 1 October 2025 the declaration is mandatory for all international passengers, Indonesian and foreign ³. Travellers can fill it in from three days before arrival at allindonesia.imigrasi.go.id or in the mobile app ³. The system issues one QR code that Immigration, Quarantine and Customs officers scan on arrival, and data is visible to officers of all four agencies in real time ³.

• Health section: travel history for the previous 21 days ³.
• Customs section: luggage, large sums of cash, dutiable goods and devices that need IMEI registration ³.
• Pilot: from 18 August 2025 at Soekarno-Hatta, Juanda, Ngurah Rai and a Batam port ³.
• The magazine says data is protected by encryption ³.

API, PNR and the Passenger Analysis Unit

BhumiPura describes a Passenger Analysis Unit (PAU) at the Soekarno-Hatta immigration office ³. It analyses passenger data before arrival to find higher-risk travellers ³.

The listed data sources are PNR, API, airline manifests, the Passenger Profile Information System (SIPP) and the immigration crossing application ³. Interpol, Customs and Densus 88 data are listed as supplementary inputs ³. Face recognition checks travellers against Indonesian deterrence and refusal lists and Interpol Red Notices before landing ³. A strong match leads to a secondary check with an interview and forensic document examination ³.

The article cites no regulation for the PAU and gives no retention period or figures for hits ³.

Autogates and the 2024 data centre attack

The Minister of Immigration and Corrections, Agus Andrianto, said passengers who complete All Indonesia can use immigration autogates, and others are checked at the counter ³. The magazine says All Indonesia links to a corridor gate for automated biometric checks of priority Indonesian travellers ³.

Immigration systems were hit by an attack on the Temporary National Data Centre (PDNS) in June 2024 ⁴. In a company statement to the financial regulator dated 26 June 2024, PT Telkom Indonesia said Brain Cipher ransomware hit Data Centre 2 in Surabaya, causing system failure and encrypted data ⁴. Telkom said Immigration reported the disruption at 04:15 on 20 June 2024, that autogate and airport crossing systems were affected, and that 239 tenants faced partial disruption ⁴. Telkom said it was part of the consortium chosen by tender as the 2024 PDNS provider ⁴.

As reported by Rika Anggraeni of Bisnis.com, the ministry's Director General of Applications and Informatics, Semuel Abrijani Pangerapan, said autogates and immigration counters were working again ⁵. The ministry apologised for the fall in service quality ⁵.

Chronology