What the personal data law means for your CRM
Sari DewiHead of Data · 5 min read · 9 Oct 2026
The personal data law in Indonesia is now part of everyday operations. If your CRM stores names, phone numbers or purchase history, it applies to you. This is a practical summary, not legal advice.
What your CRM must be able to show
- Why you hold each piece of data, and the consent behind it
- Who in your team opened or changed a record
- How a customer can see, correct or delete their data
- How quickly you can report a breach
Where most companies get stuck
The problem is rarely the CRM. It is the copies: exports in spreadsheets, contact lists in chat groups and old backups. Find the copies first, then decide which ones you really need.
Find the copies first.
A sensible first month
Appoint one owner, list what personal data you hold and switch on access logs. Those three steps cost little and cover most of what an auditor asks first. Then ask a lawyer to review your consent wording.
