The enforcement of Indonesia's Personal Data Protection Law No. 27 of 2022 as of October 17, 2024, marks a significant milestone in safeguarding personal data. One of the key obligations outlined in Article 36 of the law is that "Dalam melakukan pemrosesan Data Pribadi, Pengendali Data Pribadi wajib menjaga kerahasiaan Data Pribadi". This mandate comes at a time when the digital era is increasingly threatened by cyberattacks, data breaches, and unauthorized access, making robust data protection strategies essential for businesses.

Two critical techniques for enhancing data privacy are pseudonymization and encryption. These methods are fundamental not only to comply with laws and regulations but also to mitigate risks associated with data breaches.

WHAT IS PSEUDONYMIZATION? 

Pseudonymization replaces identifiable data with unique placeholders, making it harder to trace the data back to an individual. For example, imagine a bank that replaces a user’s name, such as "Rio," with a pseudonym like "Bajahitam007". This pseudonymized data is stored in one database (Database 1), while the mapping of names to pseudonyms is kept in a separate database (Database 2).

Database 1:

Name = Bajahitam007

Account Type = Emerald

Database 2: 

Name = Rio

Pseudonym = Bajahitam007

If an unauthorized party gains access to Database 1 alone, they cannot identify individual users. This layered approach reduces the risk of identity exposure and ensures compliance with data privacy laws.

However, pseudonymization is not foolproof. If both databases are compromised or external data is correlated with the pseudonymized data, the protection can be bypassed. This highlights the need for combining pseudonymization with other safeguards, such as encryption.

THE POWER OF ENCRYPTION 

Encryption scrambles data into an unreadable format that can only be deciphered using a decryption key. This method is crucial for protecting sensitive information during storage and transmission.

Consider the example of a text message exchange. Rio wants to send a secret note to Cola, but Dedi, sitting between them, might intercept it. Rio encrypts his message by shifting each letter backward (e.g., "A" becomes "Z"). The encrypted message, SZOOL XLO, appears meaningless to Dedi. Cola, knowing the decryption key, decodes it back to the original message, HALLO Col. read further Encrypt All Sensitive Data!!

Modern encryption uses advanced algorithms and dual-key systems, like public-key encryption, to ensure intercepted data remains undecipherable without the correct key. When applied to pseudonymized datasets, encrypting both the data and mapping databases adds a critical layer of security, keeping information inaccessible even in the event of a breach.

PRACICAL APPLICATION: COMBINING PSEUDONYMIZAION AND ENCRYTION     

Imagine Dedi, a disgruntled bank employee, gains access to Database 1. Without Database 2, which links pseudonyms to real identities, the stolen data is largely meaningless. This highlights the security benefits of pseudonymization.

However, risks remain if identifying data is poorly segregated. If Dedi also accesses Database 2, he could easily link pseudonyms to users like Rio. Additionally, pseudonymized data can be cross-referenced with external sources, potentially exposing identities—such as if Rio shares details on social media that align with the pseudonymized data.

To ensure data privacy, pseudonymization must be paired with additional protective measures and technologies. Consider, for instance, a scenario where the Bank encrypts both Database 1 and Database 2 alongside pseudonymization. If Dedi obtains both databases, all he would see is encrypted, unintelligible data, such as:

Database 1:

Name = TypeP0kOFAw20PHbOnT7oXXvlm4nm

Account Type = nauwi7eePi7ZKJH0sIeVLbxBJgixIdL1sOXvsUnw=w

Database 2:

Name = lenaV3sVToJ8FdDHNwLIMedP0kOFAw20

Pseudonym = PHbOnT7oXXvlm4srS9OH6GK4qa33jgZx

This dual approach ensures that even if both databases are breached, the data remains meaningless without the decryption keys.

PSEUDONYMIZATION VS ANONYMIZATION 

While pseudonymization retains the ability to re-identify individuals under controlled circumstances, anonymization removes all identifiable information permanently. For example, in anonymization, all identifiers, such as Rio's name or her pseudonym, would be completely removed, making it impossible to trace the data back to her.

Anonymization is ideal for scenarios where re-identification is unnecessary, such as aggregating data for medical research. However, its irreversibility can limit practical applications, particularly in services requiring individual user identification, such as subscription-based platforms.

LEGAL AND PRACTICAL IMPLICATIONS   

Pseudonymization and encryption align with global data privacy best practices and meet the requirements of the Personal Data Protection Law No. 27 of 2022, demonstrating proactive risk management against data breaches.

Organizations should adopt a layered security approach by combining these techniques with access controls, firewalls, IDS/IPS, Data Loss Prevention, and regular audits. This ensures robust personal data protection, fosters user trust, and mitigates legal risks.

CONCLUSION

The enforcement of the Personal Data Protection Law places greater responsibility on businesses to safeguard personal data effectively. Techniques like pseudonymization and encryption provide powerful tools to address these challenges, offering both legal compliance and enhanced security. As the digital landscape evolves, integrating these methods with broader cybersecurity strategies will be essential for sustainable data protection and privacy preservation.

As we transition to stricter regulations under the PDP Law (UU PDP), now is the time for businesses to act. For tailored solutions and further guidance, contact our team at RSM Indonesia. We’re here to help you navigate the evolving data protection landscape.

By Satrio Bayu Pandowo, Technology Risk Consulting Practice