Jakarta. Data leak fears have plagued Indonesia's policy of requiring companies to submit their annual reports to a ministry-run electronic system.

A 2025 Law Ministry regulation requires limited liability companies (PT), including private firms, to submit their annual reports to the ministry-run system locally known as Sistem Administrasi Badan Hukum (SABH). The law also requires companies to submit information on how much directors and commissioners earn, as well as the company’s activity reports.

According to the Indonesian Employers Association (Apindo), the business lobby understands that the government wants to improve governance. However, the government needs to make sure its implementation does not add more bureaucratic red tape and will not lead to leaks of highly valuable data.

“Businesses believe that [Indonesia] needs to iron out several aspects first, so it does not excessively increase the compliance burden,” Apindo chair Shinta Kamdani said in Jakarta on Friday.

She went on to say the government has yet to address several issues, including the security guarantees against data leaks as well as the restricted access to the reports. There are also worries that this will only overlap with other administrative obligations. Apindo hopes the government will integrate the SABH with existing reporting systems in other ministries. 

It’d also be better for the government to implement the rules proportionally. Ideally, small and medium-sized businesses have a simpler reporting mechanism and a longer transition period. The government should also take on a “coaching approach” before imposing administrative sanctions on the small firms that fail to comply, according to Shinta.

Trubus Rahadiansyah, a public policy analyst from Trisakti University, also expressed similar concerns.

“What if a data leak occurs? That’s the problem,” Trubus said.

Questions over the compensation when that happens also remain unanswered. The one-size-fits-all approach for both publicly listed and private companies sparks another challenge. “Publicly listed companies have the shares that are traded, so people have the right to know the information. But private companies don’t have to. This is only making things complicated,” he said.

This system entered into force on June 1, but administrative sanctions will begin to apply this November.