A law is written for people and organisations. Systems do not read it. The work in between is translation: taking each duty the Indonesian personal data protection law sets and finding the system, the team and the control that answers for it. Where there is an answer, write it down. Where there is none, that is a gap, and the gaps in order of risk are the roadmap.
I gave this talk at SPT Solution Day 2024, an event of Secure Pasifik Teknologi, in May 2024.