Substance Without Formality: Personal Data Protection Governance in Yogyakarta City, Indonesia

Abstract

Indonesia's Personal Data Protection Law (Law No. 27/2022) obligates local governments to act as accountable Data Controllers, yet its two-year transition period expired in October 2024 without the mandated national supervisory authority (Data Protection Agency, or Badan PDP) being established, and without any of the nine implementing government regulations the Law requires. This single-case study examines how personal data protection (PDP) governance is constructed in Yogyakarta City, a municipality embedded in Indonesia's only constitutionally privileged regional autonomy regime, the Special Region of Yogyakarta (Daerah Istimewa Yogyakarta, DIY). Primary data were drawn from one multi-stakeholder focus group discussion with fourteen informants spanning government, academia, the press, industry, and citizens, analyzed through thematic analysis and interpreted through four complementary lenses: institutional theory, street-level bureaucracy, collaborative governance, and the political economy of bureaucracy. To strengthen a single-case design, the primary findings are triangulated against two forms of secondary comparative analysis: an international benchmarking of five data-protection regimes (the European Union, Singapore, Malaysia, China, and Thailand) and a domestic comparison with three other Indonesian local governments (Surakarta, Pekalongan, and Bantul Regency). Findings reveal a consistent pattern across all levels of analysis: substantive-partial compliance without complete formal structure, an inversion of the ceremonial-without-substance pattern that dominates institutional compliance literature. A twelve-indicator maturity assessment shows the gap is concentrated in four specific structural indicators (a formally designated Data Protection Officer, a data-breach notification procedure, a dedicated PDP budget line, and formal coordination with the DIY provincial government) rather than distributed evenly across the governance system. The study proposes a six-component Adaptive PDP Governance Model with an indicative quarterly roadmap and offers practical implications for Indonesia's Ministry of Home Affairs and local governments sharing similar institutional characteristics.