MSMEs and the Growing Need for Data Protection Compliance

RRI.CO.ID, Jakarta - The growing reliance on digital services among micro, small, and medium-sized enterprises (MSMEs) has made managing consumer personal data an integral part of business operations. As a result, implementing Law No. 27/2022 on Personal Data Protection (PDP) has become increasingly important.

Following the issuance of implementing regulations for personal data protection, the Ministry of Communication and Digital (Komdigi) will provide education for MSMEs on how to apply the PDP Law.

Deputy Minister Nezar Patria said education is essential for MSMEs to understand their obligations in managing and protecting consumer data, particularly for businesses operating on digital platforms.

“There will be education regarding the PDP Law. Of course, we will not apply a ‘one-size-fits-all’ approach,” Nezar said in Jakarta on Thursday, September 10, 2026, as quoted by Antara.

Digital-based business activities allow MSME operators to collect various types of user personal data, ranging from addresses to contact numbers.

Under the PDP Law, entities that collect and process personal data--acting as personal data controllers--are required to fulfill several obligations to ensure data is managed in accordance with protection standards.

One provision that requires attention is the appointment of a Data Protection Officer (DPO), an official or staff member responsible for carrying out personal data protection functions in situations mandated by the regulations.

The DPO ensures that an organization’s personal data processing activities comply with applicable rules and helps implement personal data protection principles.

Large businesses with sufficient resources can more easily meet these obligations. However, MSMEs may face challenges due to limited capacity.

MSME operators must understand that managing consumer data is part of their responsibility when conducting business digitally. Data leakage or misuse can cause losses for consumers and legal consequences for data processors.

Therefore, educating MSMEs about the PDP Law is crucial. It ensures compliance efforts go beyond administrative requirements and encourage secure, responsible data management practices.

The government must ensure that awareness of personal data protection reaches MSMEs in a manner appropriate to the scale and characteristics of their businesses. With adequate understanding, MSMEs are expected to handle consumer data in accordance with regulations while strengthening public trust in the digital services they use. ***