Indonesia’s personal data protection law was new, and many organisations met it as a list of obligations. This talk put the data at the centre instead. Start with what you hold and where it is. Sort it by how sensitive it is. Protect it in each of its states. Control who may reach it. Each step is small enough to begin this quarter, and together they answer most of what the law asks.
I gave this talk at the Indonesia Data Security Symposium in Jakarta in November 2023. It is the approach behind my data protection and PDPA work.