Indonesia signed Government Regulation No. 33 of 2026 on 16 July 2026 – the long-awaited implementing rule for the country’s 2022 Personal Data Protection Law. It circulated publicly only in late August. The regulation fills in detail on cross-border data transfers, breach notification and impact assessments that businesses had navigated without since the law took effect in October 2024.

It does not complete the picture. Article 58 of the 2022 law calls for a dedicated authority to oversee personal data protection. As of September 2026, that authority has yet to be formally established.

Deputy Minister of Communication and Digital Affairs Nezar Patria said in July, at a US-ASEAN Business Council dinner in Jakarta, that the agency will “operate independently across all its structures.” The presidential regulation establishing it is still being finalised.

The Capital Is Already Moving

The investment cycle is not waiting. Indonesia currently has around 580 megawatts of operational data-centre capacity. Coordinating Minister for Economic Affairs Airlangga Hartarto said, as reported by the Jakarta Post on 12 July 2026, that investors had expressed interest in another 1.3 gigawatts. That represents an estimated USD 15–20 billion in additional investment.

Some of that is already committed. Firmus Technologies, working with Nvidia, is developing a 360-megawatt AI Factory campus in Batam designed for up to 170,000 Nvidia accelerators. Offtake agreements, Firmus says, could generate USD 25–30 billion over six years. EDGNEX has separately committed USD 2.3 billion to a 144-megawatt facility in Cikarang.

Where Digital Growth Meets Governance

 

Two cybersecurity leaders from Indonesia interviewed for this piece describe the same commercial dynamic playing out across Indonesian enterprises. Ardi Sutedja K., chairman of the Indonesia Cyber Security Forum, frames it as a question of pace at the enterprise level.

“In my experience, one of the most significant gaps lies in the speed at which organisations are investing in AI and cloud technologies versus the pace at which their security governance is maturing. Many Indonesian enterprises are quick to adopt new technologies, driven by the promise of increased efficiency and competitive advantage.

“However, the same urgency is not always applied to developing robust security frameworks. This often results in a reactive rather than proactive approach to cyber security, where measures are only put in place after a breach has occurred,” he explained.

Sugiarto RM, founder of the Indonesia CXO Network, sees it playing out across the wider economy.

“Indonesia already has a growing regulatory framework around personal data, critical information infrastructure and financial-sector cyber resilience, while enterprises are simultaneously increasing spending on cloud, AI and digital infrastructure. The challenge is making sure those two curves converge.”

The National Cyber Security Index provides another indication of the governance challenge. Indonesia scores 47.50, receiving full credit for having personal data protection legislation while scoring zero on the indicator for an empowered personal-data protection authority.

The result highlights the distinction between having a regulatory framework on paper and having the institutional capacity to enforce it.

Banks Already Know What Governance Looks Like

The clearest contrast is financial services. Indonesian banks sit inside a supervisory framework where technology governance and cyber maturity are binding requirements, not aspirations.

OJK Regulation 11/2022 established IT-governance rules for commercial banks. SEOJK 29/2022 added annual cyber-maturity assessments. POJK 1/2026, effective since 1 March 2026, tightened information-technology and third-party risk requirements further.

Philip Lee, head of Orange Cyberdefense APAC, told Bizruption.asia that this is the point at which cybersecurity stops being an IT problem and becomes a board one.

“This shift is increasingly driven by the evolving threat landscape, regulatory compliance and growing pressure from shareholders and local governments. With increased regulatory requirements around data protection, critical infrastructure, incident reporting, and cybersecurity governance, boards have become more engaged with the organisation’s operational environments.

“A major cyber incident or compliance failure can directly affect revenue, business continuity, reputation, customer trust and legal exposure. Translating technical risks into business outcomes helps boards understand their risk appetite and accountability. As cybersecurity becomes integrated into enterprise risk management, it is increasingly recognised as a strategic business resilience issue rather than simply an IT expense,” he said.

Banking has a mechanism for making that translation visible. The question for the rest of Indonesia’s digital economy is how the same discipline can develop as the data centres, cloud platforms and AI ventures now absorbing its investment wave continue to scale.”

What Actually Closes the Gap

Ardi frames the work ahead as cultural before it is technical.

“There must be a cultural shift within organisations where cyber security is viewed as a shared responsibility. This involves continuous education and awareness programs to ensure that every employee understands their role in protecting the organisation’s digital assets.”

Sugiarto describes the practical work still outstanding.

“The corresponding governance layer, who owns the risk, how data is classified, what can be put into an AI model, how third-party and cloud risks are assessed, how identities and access are controlled, and how quickly an organisation can recover from a compromise, is often still catching up.”

The measure that matters, Sugiarto added, is not the size of the security budget. It is whether the board understands the cyber risk it is buying, accepting or transferring. Asked what would close the gap, he ranks the constraints directly.

“Regulation is the catalyst, budget is the enabler, talent is the constraint, but governance and accountability are what will actually close the gap.”

That ranking matters for how capital gets allocated. A regulation can set the obligation and a budget can fund the response, but neither guarantees that someone at the top of the organisation is accountable when the controls fail. That accountability is what boards and investors are now being asked to underwrite.

The USD 15–20 billion now moving into Indonesian data centres is part of a much broader digital transformation. As the country’s infrastructure, AI adoption and digital economy continue to expand, the evolution of governance and accountability will become increasingly important to the companies, boards and investors participating in that growth.

For investors, understanding how governance develops alongside that opportunity will be an increasingly important part of the decision-making process.

When Singapore’s Coordinating Minister for National Security stood before parliament in July 2025 to announce that cyber espionage group UNC3886 had actively targeted the nation’s critical infrastructure, he was methodical. He named the threat group. He detailed their tactics. He confirmed they’d breached systems. But when pressed about which nation-state sponsored the attacks, K. Shanmugam’s response was deliberately measured: he wouldn’t go there.

This wasn’t evasiveness. It was a calculated strategy.

Muhammad Faizal Abdul Rahman, Research Fellow at S. Rajaratnam School of International Studies (RSIS), in an interview with Yahoo Singapore, explained the distinction: “Countries that consider themselves neutral or non-aligned may prefer technical attribution over political attribution.” Technical attribution points to the perpetrator using forensic evidence. Political attribution pins blame on the nation-state believed to be behind them.

Put simply: Singapore knows who’s attacking. It’s sharing that intelligence privately with critical infrastructure operators. But publicly naming state sponsors? That’s a geopolitical tripwire Singapore won’t touch. For now.

Here’s why this matters: the careful balancing act between knowing and saying is getting exponentially harder to sustain. And the boardrooms caught in the middle are about to face governance dilemmas they haven’t prepared for.

The Intelligence-Sharing Paradox

In October 2025, Singapore’s Ministry of Defence established the Digital Defence Hub, announcing it would share classified threat intelligence with organisations operating critical infrastructure across banking, energy, telecoms, water and healthcare. The timing wasn’t coincidental. APT attacks targeting Singapore quadrupled between 2021 and 2024, according to the Cyber Security Agency.

But here’s where it gets complicated for boards. You’re now receiving classified government briefings about state-sponsored threat groups targeting your systems. You know their tactics, their tools, their objectives. The intelligence is specific enough to inform your defence strategy. Yet you can’t publicly acknowledge who’s attacking without contradicting Singapore’s diplomatic positioning.

What happens when your institution gets breached using the exact malware the government warned you about privately? Do you disclose to shareholders that you had advance warning? Do you explain to regulators why certain defences were prioritised without revealing classified briefings? How do you navigate fiduciary duties to investors whilst respecting national security sensitivities?

Most boards haven’t developed frameworks for this. Corporate governance training doesn’t typically cover handling classified intelligence whilst meeting transparency obligations to shareholders. That gap is about to become quite expensive.

When Insurance Meets Geopolitics

The insurance dimension makes this messier. Most cyber insurance policies exclude coverage for war and state-sponsored attacks due to systemic risks, according to analysis from Lloyd’s of London. But here’s the catch: exclusions typically require proving state attribution.

If Singapore shares classified intelligence privately indicating state sponsorship but maintains public diplomatic neutrality, does the war exclusion apply? Insurance companies and policyholders could litigate this ambiguity for years.

The precedent everyone’s watching: Merck’s NotPetya case, where courts ruled a massive state-sponsored attack wasn’t excluded under war clauses because the specific policy language didn’t clearly define cyber warfare. Insurers responded by updating exclusions. But ambiguous attribution still creates grey zones.

For institutional investors assessing Singapore-based portfolio companies, this creates valuation puzzles. Your critical infrastructure holdings might have world-class cyber defences and receive classified threat warnings. But do they have viable insurance coverage if attacks escalate? The answer depends on attribution mechanisms that are deliberately kept ambiguous for diplomatic reasons.

That’s not a risk most investment committees have stress-tested yet.

The Pressure Intensifying

Singapore’s neutrality strategy works brilliantly during relative stability. But the geopolitical environment is becoming increasingly unstable. Taiwan tensions haven’t dissipated. South China Sea disputes continue simmering. US-China technological decoupling is accelerating, not slowing.

Western cybersecurity firms like Mandiant already publicly attribute UNC3886 to China-linked operations. These firms hold significant US government contracts, creating commercial and political incentives for explicit attribution. If Singapore institutions rely on these firms for defence whilst the government maintains public ambiguity, the operational contradiction becomes harder to manage.

What happens when the Five Eyes intelligence partners make intelligence-sharing conditional on public attribution? What happens when China seeks assurances that intelligence-sharing arrangements don’t constitute strategic alignment with Washington?

For regional investors, the implications cascade. If ASEAN’s most sophisticated cyber defence operator faces these attribution dilemmas, how do Indonesia, Malaysia, Thailand and Vietnam navigate similar pressures with even less diplomatic leverage and technical capacity?

The Less Talked-About Mercenary Factor

There’s another layer complicating everything. As Faizal noted to Yahoo Singapore, nation-states increasingly use cybercriminals as “deniable tools of state power” – functioning exactly like physical mercenaries who provide plausible deniability in traditional warfare.

The same malware appears in both state-affiliated espionage operations and purely criminal ransomware attacks. Attribution lines are deliberately blurred. When your institution gets breached, determining whether it’s state-sponsored espionage, criminal extortion or state-contracted criminals masquerading as independents fundamentally changes everything: insurance coverage, regulatory obligations, diplomatic implications, law enforcement jurisdiction.

Yet attackers design operations specifically to make definitive attribution impossible. And governments like Singapore maintain strategic ambiguity that reinforces this uncertainty.

What Boards Need Now

The November 2025 Critical Infrastructure Defence Exercise brought together over 250 participants from all 11 critical infrastructure sectors, demonstrating Singapore’s cross-sector coordination capability. The technical defences are advancing and the intelligence-sharing mechanisms are operational.

But the governance frameworks haven’t caught up. What’s needed now: protocols for boards handling classified intelligence that satisfy both national security requirements and corporate transparency obligations. Insurance products that address the grey zone between technical and political attribution. Regional coordination frameworks so ASEAN institutions aren’t navigating these tensions in isolation.

For investors, the analytical framework becomes clearer: cyber risk assessment, moving forward, requires understanding geopolitical positioning alongside technical capabilities. Portfolio companies in Singapore face fundamentally different risk profiles than those in jurisdictions that publicly attribute attacks or those that avoid intelligence-sharing entirely.

Smart portfolio managers should be stress-testing for scenarios where diplomatic neutrality becomes untenable. What happens to Singapore-based financial institutions if US-China tensions force clearer alignment? How do supply chains absorb disruptions if intelligence-sharing arrangements fracture along geopolitical fault lines?

The Calculation That’s Getting Harder

Singapore has built something sophisticated: technical precision without political escalation. Advanced intelligence capabilities without diplomatic commitments. The strategy has worked remarkably well.

But strategic ambiguity has limits. When cyber-attacks escalate from espionage to infrastructure disruption, neutrality becomes harder to justify. When allied nations demand public solidarity against specific threats, silence becomes conspicuous. When boards need to explain breaches to shareholders, ambiguity creates legal liability.

The question for 2026 isn’t whether Singapore’s approach will face intensifying pressure. It will. The question is whether the institutions receiving classified intelligence – banks, utilities, telecoms, healthcare providers – have developed the governance frameworks needed when diplomatic neutrality collides with operational transparency.

Right now, most likely haven’t. And that gap between sophisticated national strategy and corporate readiness is about to become very expensive for everyone caught in the middle.