NIK to Become a Single Identity, Who Will Safeguard Our Data?

On Tuesday, 8 September 2026, the Plenary Session of the House of Representatives of the Republic of Indonesia (DPR RI) approved the Draft Law (RUU) on the Second Amendment to Law No. 23 of 2006 on Population Administration (RUU Adminduk) as a Draft Law Proposed on the Initiative of the DPR RI.

The RUU, initially proposed as an initiative of Commission II of the DPR RI, had previously undergone the harmonization process at the Legislative Body (Baleg) of the DPR RI before being approved by the Plenary Session as a Draft Law proposed on the initiative of the DPR RI.

Why Does the Population Administration Law Need to Be Amended?

One of the main reasons is the increasingly extensive use and exchange of population data.

At a working meeting of Commission II on 20 April 2026, Deputy Chairperson of Commission II of the DPR RI Aria Bima stated that the population database is currently used by more than 7,550 institutions, with approximately 10 million accesses per day. The broader the use of data, the greater the risk of data leakages and misuse.

Similar concerns were reflected in a telesurvey conducted by Commission II involving 740 respondents. As many as 89.3% of respondents supported the use of the NIK as a single identity, but at the same time, the public also expressed concerns regarding the security of personal data.

This means that as the NIK is to be used more extensively for various public services, the state must also ensure that such data is secure and that it is clear who bears responsibility when problems occur.

NIK Will Play an Increasingly Important Role as a Single Identity

One of the important changes in this RUU is the strengthening of the function of the Population Identification Number (NIK) as a Single Identity Number (SIN), or single identity.

To date, the NIK has already been used in various services. Through the SIN concept, its use will become broader and more integrated for accessing public services.

The objective is to make an individual's identity simpler and reduce the need to use multiple identities or different data across various services.

However, there are consequences. The more services that depend on a single identity, the greater the impact if such data is leaked or misused. Therefore, strengthening data security is an important component of the amendment to this Law.

Population Administration Will Become Increasingly Digital and Integrated

This RUU also introduces the paradigm of an “integrated digital active system” (stelsel aktif digital terintegrasi).

Simply put, the government seeks to transform population administration services from a system that still relies heavily on processes and initiatives undertaken by the public into more interconnected digital services across institutions.

At the Working Committee meeting on 7 September 2026, Chairperson of the Working Committee for the RUU Adminduk Martin Manurung stated that this system would subsequently become an obligation of the central government, provincial governments, and regency/municipal governments.

With a more integrated system, population data is expected to be used more quickly and efficiently for various public service needs.

However, integration also means that security responsibilities must become increasingly clear. When data is connected to numerous institutions, there must be clear security standards, oversight, and allocation of responsibilities.

Organizers That Fail to Protect Data May Be Fined

This RUU does not only address persons who unlawfully obtain or disseminate Population Data, but also parties that have an obligation to protect such data.

In the Working Committee discussions on 7 September 2026, the formulation of the amendment to Article 131 paragraph (2) provides that an organizer that has an obligation to protect Population Data but fails to fulfill that obligation may be subject to an administrative sanction in the form of a fine. The amount of the fine will be further regulated by Government Regulation.

This constitutes an important change because responsibility for data protection does not end with the perpetrator of the misuse. Parties that are legally responsible for managing and protecting the data are also required to ensure that their systems and security measures are adequate.

Sanctions for Disseminating Data Will Also Be Increased

This RUU also increases the criminal sanctions applicable to parties who unlawfully disseminate Population Data. In the Working Committee discussions, the sanction under Article 138 was directed to be imprisonment for a maximum term of 6 years.

By comparison, the current regulation under Article 95A of Law No. 24 of 2013 stipulates a maximum criminal sanction of 2 years' imprisonment and/or a maximum fine of Rp25 million for any party who unlawfully disseminates Population Data or Personal Data.

The Challenge Is Not Merely a Matter of Sanctions

The most significant impact of the amendment to the Population Administration Law may not necessarily lie in the increased severity of the sanctions, but rather in the state's ability to build public trust in an increasingly digitized population administration system.

When the NIK is to become a Single Identity Number (SIN) and population data is connected to an increasing number of public services, a single data breach has the potential to affect multiple services. Therefore, data protection cannot rely solely on fines or criminal sanctions, but also requires strong security standards, effective oversight, and a clear allocation of responsibilities among all parties that access and manage the data.

The broader the integration of data, the greater the need to ensure clarity as to who is responsible when a failure to protect the data occurs. Ultimately, the success of the RUU Adminduk will not be determined solely by how severe the sanctions for violations are, but by whether the state is able to establish a system that makes public services more accessible and integrated without compromising security or the public's rights over their personal data.