By I Gede Putu Rahman “Gede Anta” Desyanta (CEO of Baliola)

Recently, public attention has turned to the trade agreement between Indonesia and the United States, which facilitates cross-border data transfer. The government has stated that the data transfer is limited to commercial data—such as data related to high-risk trade of goods—and does not include the personal data of all citizens. This statement has been reiterated by officials such as Presidential Communications Office Head Hasan Nasbi, Coordinating Ministry for Economic Affairs Spokesperson Haryo Limanseto, and Minister of Communication and Information Technology Meutya Hafid.

However, despite these clarifications, the public and digital observers continue to express concern over the implications of the agreement. What exactly constitutes “commercial data”? In practice, commercial data often includes elements of sensitive personal information, such as names, addresses, and phone numbers within sales transaction records. Without a clear definition and strict oversight, such personal data could be transferred without the consent of the data subjects, posing serious privacy risks.

Indonesia is still in the process of building a strong regulatory and infrastructural foundation for data protection. While the Personal Data Protection Law (UU PDP) has been enacted, its implementing regulations and the establishment of an independent supervisory authority are not yet fully operational. The national technological infrastructure for data security remains unevenly distributed, and the level of digital literacy among the public is far from ideal. This raises a fundamental question: Are we truly prepared to open access to data—including personal data—to foreign countries, particularly to the United States, which does not yet have a federal data protection law as robust as ours?

This regulatory imbalance has implications for law enforcement. If a violation occurs in the United States, through what mechanisms can Indonesia assert or enforce its rights? Is there an effective international cyber law enforcement framework in place? This ambiguity reinforces concerns about the fragility of Indonesia’s data sovereignty in practice.

Moreover, we must not overlook the strategic role of QRIS (Quick Response Code Indonesian Standard) and GPN (National Payment Gateway). These systems have become the backbone of Indonesia’s digital payment infrastructure, serving tens of millions of users and merchants, most of whom are micro, small, and medium enterprises (MSMEs). In the first quarter of 2025, QRIS recorded over 56 million users, 38 million merchants, and transaction values reaching IDR 262 trillion within just three months【goodstats.id】.

If QRIS adoption reaches 90% or more of the Indonesian population, the volume of digital transactions will skyrocket, becoming the mainstay of our national digital economy. The development of QRIS and GPN is aimed at enhancing financial inclusion and empowering MSMEs, thereby strengthening and sustaining Indonesia’s digital economy.

However, granting external parties access to digital transaction data without strict safeguards could pose a serious threat to our digital economic sovereignty. The risks of data leaks and misuse could undermine MSME growth and destabilize the national digital ecosystem.

From the perspective of national vision, we must ask: Does this policy align with the Nawacita (Nine Priorities) of the President of the Republic of Indonesia, which underscores the importance of safeguarding national sovereignty, including in the digital domain? Citizens’ personal data and digital assets are integral parts of this sovereignty. Opening access to data without adequate control and protection could weaken Indonesia’s position within the global digital ecosystem.

As a practitioner actively involved in blockchain technology and cyber trust development, I emphasize the importance of the following strategic steps should this agreement be implemented:

• Establish stringent technical protocols and regulatory frameworks for data transfer management, including encryption standards and transparent audits.
• Develop blockchain-based digital identity systems, such as IDCHAIN, which allow citizens to control their personal data through Verifiable Credentials.
• Activate and strengthen independent supervisory bodies and international cooperation for cross-border data law enforcement.
• Enhance digital literacy and public awareness to ensure citizens become active controllers of their personal data.
• Involve local digital industry stakeholders in policymaking to ensure the growth and sovereignty of the national digital ecosystem.

If there is an opportunity to delay implementation, in-depth evaluations and open dialogue must be prioritized to ensure this significant step aligns with the protection of citizens’ rights and the nation’s digital sovereignty.

We must reflect together: To what extent do we truly control our own data? Are we ready to safeguard our digital home amid the tides of globalization? Because Indonesia’s digital future is not merely about technology and the economy—it is also about the fundamental rights inherent to every citizen.

From the ideological standpoint of Pancasila, the right to personal data is a concrete manifestation of the second principle: A Just and Civilized Humanity, which demands respect and protection for individual dignity. It also reflects the fourth principle: Democracy Guided by the Inner Wisdom in the Unanimity Arising Out of Deliberations Amongst Representatives, reminding us of the importance of public participation and control in managing their data. Equally vital is the fifth principle: Social Justice for All the People of Indonesia, which affirms that data protection must ensure fairness and welfare for all citizens without discrimination.

Therefore, safeguarding data sovereignty is not merely a technical issue or an economic policy matter—it is a fundamental national duty to realize Pancasila’s values in our digital life. Herein lies the key to Indonesia’s true justice and progress in the digital era.