Published November 7, 2020 · Updated October 28, 2026
What happens to board decisions and statutory records when a company’s systems are compromised? A company secretary can help directors prepare for that disruption without taking over their responsibility for oversight.
In this guide, we discuss the company secretary’s role in cyber-risk governance, secure records, third-party oversight and incident readiness in Indonesia in 2026.
Why Does Cyber Risk Matter to Corporate Governance?
Cyber incidents can expose sensitive records and disrupt the information directors need to make decisions.
Indonesia has moved company administration onto digital rails. Incorporation and amendments run through the Ministry of Law's AHU system. The Online Single Submission (OSS) platform issues the Business Identification Number (NIB) and licenses. Tax registration sits with the Directorate General of Taxes (DJP).
Every filing creates a record worth protecting. The National Cyber and Crypto Agency (BSSN) monitors intrusion attempts against Indonesia networks and coordinates national incident response. IBM's 2025 Cost of a Data Breach report puts the global average cost of a single breach at about USD 4.4 million.
Indonesia's Personal Data Protection Law (Law No. 27 of 2022) has applied fully since October 2024. The law applies to processing within Indonesia and to conduct outside Indonesia with legal effects in Indonesia or on Indonesian citizens abroad; it can cover director, shareholder and employee records held by the secretariat. Breach notification within 3 x 24 hours and administrative fines of up to 2 percent of annual revenue now shape board-level priorities.
What Does Board-Level Cyber Governance Ask of the Secretariat?
The secretariat can support directors with agendas, controlled board papers, policy records and a reliable record of decisions.
Cyber governance fails when nobody coordinates it. Directors set direction, but they rely on the secretariat to place items on agendas, circulate papers and record decisions. That makes the role the connective tissue of oversight.
The documents below attract the most attention from attackers. For a foreign-owned company, capital records also evidence the IDR 2.5 billion minimum paid-up capital set by BKPM Regulation No. 5 of 2025.
Many companies outsource corporate secretarial services in Indonesia. Provider security deserves the same scrutiny as in-house systems: portal controls, access rules, encryption and retention terms.
1. Setting the cyber agenda
Include cyber risk on the agenda at an agreed interval. Ask management for a concise update on significant threats, incidents, remediation and decisions needed.
2. Custodian of the policy set
Where assigned, maintain an approved policy register showing owners, versions and review dates. Security and legal teams remain responsible for their respective advice and operational decisions.
3. Anchoring decisions in law and frameworks
Use Law No. 40 of 2007 on limited liability companies, as amended, as part of the governance context. The NIST Cybersecurity Framework and ISO/IEC 27001 can guide control design; using a framework alone does not establish legal compliance.
4. Overseeing the decision trail
Record decisions, their dates, responsible owners and follow-up deadlines in the minutes. Restrict access and preserve approved versions so the decision trail remains available.
Board Documents and Their Cyber Sensitivity
| Document | Why attackers want it | Protection practice |
|---|---|---|
| Board minutes | Strategy and personal data in one file | Portal-only access, watermarks, version locks |
| Shareholder register | Identity and contact data of owners | Role-based access, encryption at rest |
| Share certificates and resolutions | Proof of ownership and authority | Originals in custody, digital copies encrypted |
| Employee and payroll files | Personal data under the PDP Law | Least-privilege access, retention schedule, logged disposal |
| Capital and financing documents | Bank terms and security packages | Restricted distribution list, expiry-based access |
| M&A and contract drafts | Price-sensitive information | No email distribution; view-only portal rights |
Which Cyber Controls Protect Secretarial Records?
Five controls carry most of the load: a secure board portal, strict access rules, encryption, retention discipline and audit trails.
Start by identifying where each class of record is stored, who needs it and which provider administers the system. The controls table offers a starting point; management should adapt it to the company’s risks and resources.
Identity details also need protection. A Tax Identification Number (NPWP) and director profiles can appear alongside other information in filing records. Limit access and review copies held outside the primary repository.
1. Secure board portals
A secure board portal can centralize packs and restrict access by user. Where supported, use view-only permissions, watermarks and remote wipe; check that these features are configured and tested.
2. Access controls
Grant access according to role and need, and use multi-factor authentication for portal, email and administrative accounts. Review permissions regularly and revoke access promptly when a person leaves or changes role.
3. Encryption
Use encryption in transit and at rest, including on laptops and backups. Assign responsibility for encryption keys and test that authorized staff can restore records.
4. Retention rules
Set a retention schedule by record type, taking account of applicable legal requirements, business needs and any litigation hold. Dispose of records securely and document the disposal.
The Directorate General of Taxes states that the annual corporate tax return is generally due within four months after the tax year ends. That is not a blanket deadline for all financial statements. Separately, Article 78 of the company law generally requires the annual general meeting within six months after the financial year ends; check applicable financial-statement, meeting and filing requirements for the company.
5. Audit trails
Keep protected logs of access, changes and exports where the system supports them. Assign someone to review alerts and preserve relevant logs if an incident or review requires them.
Core Cyber Controls for the Secretariat
| Control | Risk it addresses | Everyday practice |
|---|---|---|
| Multi-factor authentication | Stolen or reused passwords | Apply to portal, email and server logins |
| Role-based access | Over-broad permissions | Grant by role, review quarterly |
| Encryption | Interception and device theft | TLS in transit, full-disk on laptops |
| Retention schedule | Expired data lingering in storage | Align to statutory deadlines, log disposal |
| Audit logging | Undetected insider misuse | Log opens, edits and exports, review monthly |
| Board portal | Email leakage of board packs | View-only packs, watermarks, remote wipe |
How Is Responsibility for Cyber Risk Allocated?
Directors oversee the risk, management operates controls, and the secretariat supports the board process where assigned.
The responsibility table is an example, not a mandatory organizational chart. Agree the split in writing, including who owns each control, who can make incident decisions and who reports to directors.
The board of commissioners supervises the directors. A committee can challenge reports where one exists, while IT and security teams manage technical controls. The controller and its legal or privacy advisers assess notification duties; a secretary may coordinate records and communications if assigned that task.
Responsibility Allocation for Cyber Risk
| Role | Responsibility | Typical outputs |
|---|---|---|
| Board of directors | Tone, risk appetite, resourcing | Approves the security policy annually |
| Board of commissioners | Independent oversight of directors | Reviews incident reports and remediation |
| Audit or risk committee | Testing and challenge | Quarterly control reviews |
| Management and IT security | Day-to-day operation | Patching, monitoring, incident handling |
| Corporate secretariat | Records, policies, board process | Agendas, minutes, retention and notification logs |
| Vendors | Services touching company data | Contracts, data processing terms, due diligence |
How Should the Secretariat Prepare for a Cyber Incident?
Prepare a response plan, contact tree, decision log and secure copies of essential records before an incident occurs.
Article 46 of the PDP Law requires the controller to provide written notice to affected data subjects and the designated institution no later than 3 x 24 hours in the event of a personal data protection failure. The notice must identify the personal data disclosed, when and how it was disclosed, and the handling and recovery measures.
Article 46 does not expressly specify the clock’s starting point. The forthcoming Government Regulation No. 33 of 2026 addresses the trigger in Article 114, but takes effect on 16 January 2027. Until then, promptly record detection, assessment and confirmation times; involve counsel immediately to determine the applicable deadline, recipient and any sector-specific duties. Do not delay escalation while waiting for complete information.
Step 1: Maintain the response plan
Maintain an incident response plan naming the response lead, decision-makers and communications contacts. Review it at least annually and after a material change or incident.
Step 2: Keep the notification log
Record when the issue was detected and assessed, what was confirmed, decisions made and notices sent. Preserve supporting evidence securely and apply an appropriate retention schedule.
Step 3: Test the communications chain
Keep an up-to-date contact tree and an alternative communication channel for use if email is unavailable. Test the chain through a tabletop exercise and record follow-up actions.
Step 4: Preserve filing continuity
Identify essential AHU, OSS, tax and investment-reporting tasks and their applicable deadlines. Keep protected copies of templates and recovery instructions, and use an approved secure credential-recovery method rather than unprotected offline passwords.
Incident-Response Records Worth Keeping
| Record | Purpose | Update frequency |
|---|---|---|
| Incident response plan | Defines roles and first moves | At least once a year |
| Contact tree | Reaches board, counsel and regulator quickly | Verify each quarter |
| Notification log | Evidences the 3 x 24-hour clock | Within each incident, retained long term |
| Board minutes on incident decisions | Protects director accountability | At every incident meeting |
| Restoration test results | Proves backups actually work | Twice a year |
| Post-incident review | Turns lessons into controls | Within 30 days of closure |
How Do AI Tools Raise New Information-Security Risks?
AI tools can expose confidential records, introduce inaccurate drafts and enable convincing impersonation unless their use is controlled.
The risks are less about the technology than about where data travels. Boards can respond with simple rules rather than outright bans.
Vendor questions stay the same whoever supplies the software. The same diligence applies when choosing between cloud accounting platforms used by the finance function.
1. Confidential prompts
Do not paste confidential minutes, contracts or register extracts into an unapproved tool. Review the provider’s retention and training terms rather than assuming that an enterprise product excludes training.
2. AI-assisted drafting
Treat AI-generated resolutions and minutes as drafts. An authorized person should check names, dates, figures and legal effect against source records before approval.
3. Vendor diligence
Ask where data is processed, who can access it, which subprocessors are used and how long information is retained. Document contractual security, incident escalation and return or deletion arrangements.
4. A register of approved tools
Maintain a register of approved tools, owners, permitted data types and review dates. Remove or reassess tools when their terms or risk profile change.
Conclusion
Effective cyber governance connects board oversight with practical records control. A company secretary can support that connection through agendas, secure document handling, decision records and incident coordination, according to the role assigned.
3E Accounting Indonesia supports companies with corporate secretarial work and filing workflows. Contact our team to discuss how your board records and responsibilities are organized.
Protect the Records Your Board Depends On
Speak with 3E Accounting Indonesia about corporate secretarial support, secure filing workflows and board-level compliance in Indonesia.
Frequently Asked Questions
The PDP Law can apply when board records contain personal data and the processing falls within the law’s scope. Minutes, registers and payroll extracts may identify individuals and should be assessed accordingly.
Responsibilities depend on the person’s appointment, delegated duties and the organization. Directors retain overall company oversight; the secretary may support records, board processes and incident coordination without becoming the technical security owner.
Review the provider's portal security, MFA, encryption, retention and disposal practices, audit logging, data processing terms and staff vetting. Ask who can access your records and how departures are handled.
Set a review schedule based on the risk and control, and revisit it after an incident or major change. An annual overall review and regular board updates are practical starting points, not universal legal deadlines.
Shareholder registers, share certificates, resolutions, employee and payroll files, capital and financing documents, and price-sensitive drafts such as M&A papers.
Abigail Yu
Director
Abigail Yu oversees executive leadership at 3E Accounting Group, leading operations, IT solutions, public relations, and digital marketing to drive business success. She holds an honors degree in Communication and New Media from the National University of Singapore and is highly skilled in crisis management, financial communication, and corporate communications.
