Law Requirements on Personal Data Protection and its Impact in Records Management

The landscape of records management in Indonesia is undergoing a pivotal transformation driven by the integration of personal data protection within the broader scope of record-keeping. This shift is significantly amplified by the recent enactment of Indonesia’s Personal Data Protection Law (PDP Law), formally known as Law No. 27 of 2022, which came into effect on October 17, 2022. According to Nugroho, Winanti, and Surahmad (2020), while previous Indonesian legislation, such as Ministerial Regulation No. 20 of 2016 on Personal Data Protection in Electronic Systems, provided some guidelines, explicit legal protection of personal data was lacking. The enactment of the PDP Law represents a significant advancement, aiming to strengthen personal data protection across various platforms and services (Rizky, 2022). This legislation mirrors global movements towards stringent data privacy mandates, exemplified by the European Union’s General Data Protection Regulation (GDPR), and is set to alter the operational landscape for Indonesian institutions. The advent of the PDP Law heralds heightened accountability and emphasizes safeguarding personal data in an era characterized by vast information flows and numerous vulnerabilities. Other countries that have similar initiative is Ireland. According to Reeves (2020) Ireland has taken significant actions toward GDPR compliance. These actions include adopting the GDPR into National Law; increased powers for the Data Protection Commission; raising the age of digital consent; and focusing on compliance enforcement. These actions reflect Ireland’s commitment to enforcing GDPR and protecting personal data within the framework of EU regulations. Reeves also describes several anticipations for records management within Irish organizations in relation to GDPR like around retention periods. As GDPR does not specify retention periods for personal data, sector-specific guidelines are given for records management, particularly in industries like health and hospitality. Secondly, the direction towards the use of tracking systems to ensure compliance and proper data protection in specific to help in better tracking and securing sensitive information Like Ireland, German organizations are required to adopt rigorous records management practices, especially regarding retention periods, and must ensure both electronic and paper-based data are handled securely. German businesses are proactive in moving towards electronic record management to avoid penalties for non-compliance. This goes the same in France, France's data protection authority, the CNIL (Commission Nationale de l'Informatique et des Libertés), is known for its strong enforcement of GDPR, including record management requirements. Organizations are required to maintain accurate records of their data processing activities and implement electronic tracking systems. CNIL has levied fines against companies for failing to comply with record management requirements, like Ireland's approach under GDPR. France also puts a strong focus on ensuring that personal data is managed in compliance with sector-specific retention guidelines. Personal data, as defined by the GDPR, includes any information relating to an individual who can be directly or indirectly identified. This encompasses names, email addresses, location information, ethnicity, gender, biometric data, religious beliefs, web cookies, and political opinions. Pseudonymous data also falls under this definition if it allows for easy identification (Wolford, 2024). GDPR principles cover lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability. Similarly, the Indonesian PDP Law defines personal data as information about individuals who can be identified either separately or in combination with other information, directly or indirectly, through electronic or non-electronic systems. It categorizes personal data into specific personal data, such as health and biometric data, genetic information, crime records, child data, and financial data, and general personal data, including full name, gender, citizenship, religion, and marital status (Christian, 2022). The law stipulates principles of limited and specific data collection, data processing that ensures the rights of data subjects, data destruction after retention periods, and accountable verification of the data processing cycle (Arti, 2023). ARMA International defines records as any recorded information, regardless of medium or characteristics, made or received and retained by an organization to fulfill legal obligations or conduct business transactions. Records management, or Records and Information Management (RIM), involves establishing and implementing policies, systems, and procedures for capturing, creating, accessing, distributing, using, storing, securing, retrieving, and disposing of an organization’s records and information (ARMA International, 2016). The United Nations emphasizes records management for accountability, describing it as the efficient and systematic control of the creation, receipt, maintenance, use, and disposition of records, ensuring evidence and information about business activities and transactions are maintained (United Nations, 2024). Considering the above, records management transcends mere archival functions to become a critical tool for ensuring transparency and legal compliance. It acts as a defense against unauthorized access, alteration, or destruction of records, crucial for protecting sensitive information. In an era where information equates to both power and liability, meticulous records management, particularly of personal data, is essential for organizational integrity. The enforcement of the PDP Law in Indonesia underscores the need for compliance and brings significant repercussions for non-compliance. A thorough re-examination of records management practices is thus not only a response to new regulations but a strategic imperative. The International Organization for Standardization’s ISO 154891:2016 provides a benchmark for records management principles in the digital age, marked by privacy concerns (ISO, 2018). As Indonesia adopts this standard, it serves as both a template and a catalyst for evolving records management practices to meet contemporary demands. The PDP Law’s implementation represents a critical juncture, offering an opportunity for Indonesian institutions to align with international norms and bolster their global credibility. This study aims to dissect these complexities and propose a pathway that fortifies the synergy between efficient records management and robust data protection. The research questions this study seeks to answer is: How do data privacy laws affect records management practices, and how do organizations amend their records management practices to comply with data protection rules?

This exploratory case study examines Indonesia’s emerging personal data protection landscape, focusing on the perspectives of records management professionals. A purposive sampling method was used to select participants from key sectors that the Personal Data Protection (PDP) Law significantly impacts. These sectors include Indonesian government entities and private companies in finance, construction, oil and gas, news broadcasting, education, and international organizations, ensuring a broad and representative range of insights. Participants were chosen based on their direct involvement in records management and their organizations’ preparation for the PDP Law. The selection criteria emphasized the participants’ diverse experiences and their ability to discuss the challenges and strategies related to personal data protection. Each participant was asked to respond to a set of prepared questions, equipped with hints where applicable, to ensure the discussion remains on topic: 1. Please state your name and briefly describe your current role in your organization. 2. Are you aware of any Personal Data Protection (PDP) laws and regulations in Indonesia or other countries? For example, laws and legislation, government decrees, or international standards. 3. Are there any organization-wide programs or initiatives specifically related to PDP requirements? For instance, adjustments related to consumer or client data management by other departments. 4. In your daily records management activities, do you handle records that contain personal data? Examples include home addresses, bank details, health data, among others. 5. In the records management department, are there any programs or initiatives specifically related to PDP requirements? For example, storage and access restrictions, data encryption. 6. In the records management department, have there been any changes in existing records management activities specifically related to PDP? Examples include additional storage protection, access restrictions, and data encryption implementation. 7. What is your opinion on how PDP laws and requirements should change your daily records management activities? For example, implementing new policies and procedures related to PDP laws that impact multiple departments, stricter monitoring, among other measures. Table 1. Participants’ Roles and Responsibilities: Initials Role Name Main responsibilities ID-1 Head of Library and Document Management Implement the company’s documentation practices and policies. ID-2 Head of Archivist Oversee corporate archives and advise on internal records management procedures. ID-3 Media Librarian and Program Content Organize the distribution, retrieval, and archiving of media materials for news programs. ID-4 Document Control and Records Management Officer Manage corporate records, document control tasks, and set standards for records management. ID-5 Document Controller and Archivist Manage senior staff records and overall company archives. ID-6 Senior Information Analyst Act as regional liaison for Asia in information management activities. Semi-structured interviews were conducted between March and April 2024, each lasting approximately 60 minutes. The interviews followed a guide designed to elicit detailed discussions around three central themes: awareness of personal data protection regulations, adjustments to existing records management practices, and strategic planning for future compliance. All interviews were audiorecorded with participant consent. The data collected from the interviews were analyzed thematically. Responses were coded and categorized to identify patterns and draw substantive conclusions. This analysis aimed to uncover the impact of the PDP Law on records management practices and the strategic adjustments organizations have made. Ethical considerations were integral to the study. Informed consent was obtained from all participants, and their confidentiality was ensured. The study’s scope and intentions were transparently communicated to participants. This study acknowledges its limitations, particularly the potential biases inherent in purposive sampling and the subjective interpretation of qualitative data. To mitigate these limitations, data triangulation was employed by contextualizing interview findings within broader literature. References were meticulously documented to enable verification and follow-up by peers, enhancing the research’s overall quality.

Awareness of Personal Data Protection Regulations The second question assessed whether records managers were aware of any personal data protection regulations, whether national, regional, international, or industry-specific standards. Half of the interviewees reported a thorough understanding of the legal requirements. They noted that their knowledge was primarily due to their organizations prioritizing data protection, with one interviewee having attended and obtained certification on the subject. The remaining interviewees acknowledged general awareness of personal data protection principles but could not specify the exact laws. One interviewee admitted to having very limited knowledge on the subject. Detailed responses are summarized below:  ID-1: Aware of specific data protection laws referenced in the educational field, mentioning the Family Educational Rights and Privacy Act (FERPA) from the US.  ID-2: Provided generic references to Indonesian government and national archive laws but failed to specify personal data protection regulations.  ID-3: Aware of the general concepts of Indonesian data protection laws but not the specific requirements. Highlighted the Journalistic Code of Ethics for addressing personal data security.  ID-4: Confident in her knowledge of data protection requirements, identified specific legislation numbers, and referenced other international data protection laws. Mentioned attending a relevant conference less than two years ago.  ID-5: Unaware of specific personal data protection requirements in Indonesia or elsewhere, recalled a company document on the topic distributed one or two years ago.  ID-6: Fully aware of personal data protection requirements and able to cite specific examples from Indonesia and Europe, such as the GDPR. Programs and Initiatives Related to Personal Data Protection The third question aimed to determine the existence of organization-wide personal data protection initiatives. This aspect is crucial as personal data protection should be the responsibility of the entire organization, not just specialized functions. One interviewee noted that their organization’s efforts to obtain governmental certification necessitated compliance with all legal requirements, including personal data protection, with strong support from top management. While all other interviewees acknowledged such initiatives within their organizations, the comprehensiveness varied. One noted that existing initiatives focused more on electronic information protection, led by the IT department. Detailed responses are as follows:  ID-1: Yes. Mentioned several personal data protection policies and practices in place as part of their organization’s certification program from the United States government, adhering to FERPA rules. These practices are endorsed by top management and implemented across various functions.  ID-2: Yes. Stated that all practices within his firm must comply with government laws and regulations, including those from the national archive institution.  ID-3: Yes. Described initiatives limited to email messages from senior management emphasizing the importance of securing personal data, without specific reference to personal data protection laws.  ID-4: Yes. Highlighted initiatives mainly in the field of human resources and employee medical data, with an ongoing effort to develop a comprehensive company-wide personal data protection policy.  ID-5: No. Indicated that current programs, led by the IT department, focus on general information protection in the cyber domain.  ID-6: Yes. Mentioned longstanding programs, including mandatory e-training and offline awareness sessions for all employees, predating the GDPR era. Management of Records Containing Personal Data The fourth question sought to understand whether personal data is included in the daily records management activities within their departments. All interviewees confirmed that personal data is part of their daily activities, except for one interviewee who manages inactive records; active records containing personal data remain within the department that owns and manages the data (e.g., Human Resources). Another interviewee acknowledged the presence of personal data in his records but noted a lack of specific declarations from content owners, making it difficult to quantify and categorize the personal data.  ID-1: Yes. Listed examples such as student personal data and academic performance records.  ID-2: Yes. Mentioned examples like insurance policy details and customer data.  ID-3: Yes. Stated that there is significant potential for personal data within the news coverage materials stored.  ID-4: No. Explained that all active records, including employee data, are managed by the respective departments, such as Human Resources.  ID-5: Yes. Limited to the personal data of top management members.  ID-6: Yes. Indicated that personal data could exist in various records such as project reports. Initiatives in Records Management for Personal Data Protection Question 5 examined whether specific initiatives on personal data protection are implemented within the records management function. Most interviewees confirmed they are implementing various measures to comply with personal data protection requirements. Those who answered affirmatively detailed shared approaches for record classification, storage, and access procedures. One interviewee highlighted that these measures were in place before the specific legislation in Indonesia due to the organization’s long-standing emphasis on personal data protection. Detailed responses are as follows:  ID-1: Yes. The department is implementing more stringent controls on the flow and distribution of personal data.  ID-2: Yes. There should be specific classification for personal data.  ID-3: Yes. A specific checklist is in place before content dissemination, especially to external parties.  ID-4: No. Waiting for new comprehensive policies and practices to serve as implementation guidelines.  ID-5: Yes. Stores records containing personal data of top management separately with additional protection against unauthorized access.  ID-6: Yes. Implemented more stringent processes and controls for record access, noting this has been a long-standing practice. Changes in Regular Records Management Activities Question 6 explored whether regular records management activities have changed due to personal data protection requirements. The responses indicate that not all organizations have fully integrated these changes. While some interviewees noted that personal data protection requirements have altered the management of personal data, others are still awaiting detailed instructions from the government or higher management. Detailed responses are summarized below:  ID-1: Yes. Existing principles and practices are implemented more carefully, and personal data flow monitoring measures are proposed.  ID-2: No.  ID-3: No.  ID-4: No.  ID-5: Yes. Mentioned a storage separation mechanism for better protection of personal data.  ID-6: Yes. Ensures new staff members attend personal data protection awareness training. Impact of Personal Data Protection Law on Daily Work Question 7 investigated the anticipated impact of personal data protection law on the daily work of records managers. All interviewees agreed that these requirements would significantly affect their regular records management activities and must be prioritized due to potential tangible and intangible risks to their organizations. One interviewee highlighted that these obligations necessitate a high level of employee understanding, emphasizing that the responsibility lies with all members of the organization, not just record managers. The responses varied, indicating the need for more stringent record access, distribution controls, and comprehensive policies and procedures to ensure compliance. Detailed responses are as follows:  ID-1: Recommended better control of data flow both within and outside the organization.  ID-2: Suggested the need for systematic practices for personal data protection, especially during transmission to third parties.  ID-3: Mentioned that the company and its top management should provide clear guidance on personal data protection.  ID-4: Proposed that companies should have clear guidance on personal data management, focusing on classification and protection mechanisms.  ID-5: Emphasized the need for clear guidance on personal data management, considering the risk of data breaches.  ID-6: Stated that employee awareness programs on personal data protection should be regularly maintained and improved due to potential risks. Ensuring Compliance in the Evolving Landscape of Personal Data Protection in Records Management This study revealed varied levels of awareness and implementation of personal data protection measures among records managers in Indonesia. While some managers demonstrated a thorough understanding and proactive approach, others exhibited only a general awareness, lacking specific knowledge of relevant laws. This disparity highlights a need for more comprehensive education and consistent dissemination of information regarding personal data protection regulations. Most organizations have initiated programs to comply with personal data protection requirements, implementing stringent controls on data flow, classification, and employee training. However, some organizations are still in the process of developing comprehensive policies, indicating an ongoing adaptation to new regulatory demands. These findings suggest a transitional phase in records management practices, with some organizations (media and international organization) more advanced in their compliance efforts than others. This is theoretically due to its greater involvement and volume of personal data they are managing and importance if the organization is international in scope. Interviewees acknowledged that personal data protection laws significantly impact their daily work, emphasizing the need for stringent access controls, data distribution measures, and comprehensive policies. Despite this recognition, the degree of implementation varies, with some organizations awaiting detailed guidelines from regulatory authorities or higher management. Comparing these findings with existing literature, such as the studies by Dessler and Kearns (2023) and Valpy (2019), reveals common challenges in the field of records management. Dessler and Kearns noted variability in privacy practices among American archivists, similar to the variability observed in this study. Valpy emphasized the importance of records management in documenting accountability, governed by law and standard practices, which aligns with the proactive measures identified in some organizations here. However, unlike Henttonen (2017), who stressed the importance of anonymization and data destruction, interviewees in this study did not mention these aspects, indicating potential gaps in current practices regarding personal data disposal and anonymization. The study underscores the critical need for comprehensive education and the development of detailed guidelines to ensure consistent implementation of personal data protection measures. Organizations must prioritize these initiatives to safeguard personal data effectively, enhancing their operational integrity and compliance with legal requirements. In conclusion, while progress is evident in some organizations, there is a clear need for enhanced educational efforts and detailed policy frameworks to ensure consistent and effective implementation of personal data protection measures. This is crucial for mitigating risks and enhancing compliance and operational integrity in the rapidly evolving landscape of data protection. As global emphasis on data privacy intensifies, the findings highlight the importance of aligning organizational practices with evolving legal standards, mirroring broader trends in data protection and necessitating continuous adaptation and improvement in records management practices.

The law on personal data protection significantly impacts how organizations manage their records, affecting various types of institutions. It requires top management's commitment across the organization, increased awareness of personal data protection principles among all members, and the implementation of stringent measures to protect existing personal data, such as enhanced access restrictions and secure storage. The law encompasses aspects like purpose limitation, privacy self-management, right to be forgotten, destruction, anonymization, and secure information storage, necessitating that records management activities develop strategies for data anonymization and disposal. Records manager if not being (just) an active contributor has the potential to become one of the initiators in the organization-wide initiatives on improving readiness and compliance towards data protection requirement. Records manager can focus on specific record management tools like updating its records retention schedule (to better reflect data life cycle management process) or also adopt recent approaches on records disposal e.g. anonymization. Records manager also can make himself heard on the existing policy and procedure revamp focusing not only on how personal records should be stored but also emphasize the importance of securing personal data within organization as its strategic and valuable asset. Records management now goes beyond archival functions, becoming a crucial tool for ensuring transparency and legal compliance. It serves as a disciplinary barrier against unauthorized access, alteration, or destruction of records, protecting sensitive information. Comprehensive record management must integrate existing legislation into its policies, procedures, and standards, requiring active involvement from all organizational elements. Effective implementation demands collaboration between the records management department and other departments such as legal, compliance, human resources, and information technology. Strategic plans for future compliance with the law include organizations defining specific personal data protection measures and ensuring the consistent implementation of current practices. This involves mandatory e-learning programs and automated solutions for approval processes before transferring personal data to third parties. The study found that internationally oriented organizations have implemented robust personal data protection practices as a standard requirement, while local organizations often rely on general data protection principles derived from other legal requirements. This new law requirements also brought many challenges and opportunities for record managers which is to learn new techniques and technologies that can be used to protect personal records such as encryption and data anonymization and can be used as well as solid foundation for getting top management commitment towards organization-wide and comprehensive records management programs. These challenges and opportunities should also encourage records managers to improve their soft competencies focusing on improving familiarity on business processes within the organization to improve the alignment of the records management initiatives with organizational priorities.