Encryption, Digital Governance, and Personal Data Protection: Developing a Juridical–Technical Enforcement Model under Indonesia’s Law No. 27 of 2022
DOI:
https://doi.org/10.38035/gijlss.v4i4.1080Keywords:
Personal Data Protection Law, Privacy by Design, XChaCha20-Poly1305, Authenticated Encryption, Digital Data GovernanceAbstract
The rapid digitalization of organizational data management has intensified concerns about personal data protection and the practical implementation of regulatory obligations. A significant gap remains between the normative requirements of Indonesia’s Law Number 27 of 2022 concerning Personal Data Protection and their technical implementation in information systems. This study aims to develop and evaluate a Juridical–Technical Model for encrypted digital data storage in cooperative information systems. The study employed an interdisciplinary design integrating juridical analysis and software engineering through Privacy by Design and a prototyping approach. Data were obtained through system observation, database analysis, and requirements identification. The prototype implemented XChaCha20-Poly1305 authenticated encryption through the Libsodium cryptographic library. The findings showed that the existing system stored directly identifiable personal information in plaintext, creating substantial risks of unauthorized access and manipulation. The proposed model converted protected data into authenticated ciphertext and successfully rejected modified records during decryption testing. These results demonstrate that selected legal obligations concerning security, confidentiality, unlawful processing, and unlawful access can be translated into executable technical safeguards. The study contributes a practical and replicable framework for strengthening secure, accountable, and privacy-preserving digital data governance in cooperatives.
References
Alghamdi, Y., & Munir, A. (2024). Image encryption algorithms: A survey of design and evaluation metrics. Journal of Cybersecurity and Privacy, 4(1), 126–152. https://doi.org/10.3390/jcp4010007
Al-Khater, W. A., Al-Maadeed, S., Ahmed, A. A., Sadiq, A. S., & Khan, M. K. (2020). Comprehensive review of cybercrime detection techniques. IEEE Access, 8, 137293–137311. https://doi.org/10.1109/ACCESS.2020.3011259
Alkubaisy, D., Piras, L., Al-Obeidallah, M. G., Cox, K., & Mouratidis, H. (2022). A framework for privacy and security requirements analysis and conflict resolution for supporting GDPR compliance through privacy-by-design. In R. Ali, H. Kaindl, & L. A. Maciaszek (Eds.), Evaluation of novel approaches to software engineering (pp. 67–87). Springer. https://doi.org/10.1007/978-3-030-96648-5_4
Andrade, V. C., Gomes, R. D., Reinehr, S., Freitas, C. O. A., & Malucelli, A. (2022). Privacy by design and software engineering: A systematic literature review. In Proceedings of the XXI Brazilian Symposium on Software Quality. Association for Computing Machinery. https://doi.org/10.1145/3571473.3571480
Arif, T., Jo, B., & Park, J. H. (2025). A comprehensive survey of privacy-enhancing and trust-centric cloud-native security techniques against cyber threats. Sensors, 25(8), 2350. https://doi.org/10.3390/s25082350
Atobishi, T., Moh’d Abu Bakir, S., & Nosratabadi, S. (2024). How do digital capabilities affect organizational performance in the public sector? The mediating role of organizational agility. Administrative Sciences, 14(2), 37. https://doi.org/10.3390/admsci14020037
Benadjila, R., Khati, L., & Vergnaud, D. (2022). Secure storage—Confidentiality and authentication. Computer Science Review, 44, 100465. https://doi.org/10.1016/j.cosrev.2022.100465
Bilan, Y., Oliinyk, O., Mishchuk, H., & Skare, M. (2023). Impact of information and communications technology on the development and use of knowledge. Technological Forecasting and Social Change, 191, 122519. https://doi.org/10.1016/j.techfore.2023.122519
Chaudhuri, R., Chatterjee, S., Mariani, M. M., & Wamba, S. F. (2024). Assessing the influence of emerging technologies on organizational data-driven culture and innovation capabilities: A sustainability performance perspective. Technological Forecasting and Social Change, 200, 123165. https://doi.org/10.1016/j.techfore.2023.123165
Das, D. K. (2024). Exploring the symbiotic relationship between digital transformation, infrastructure, service delivery, and governance for smart sustainable cities. Smart Cities, 7(2), 806–835. https://doi.org/10.3390/smartcities7020034
Degabriele, J. P., Govinden, J., Günther, F., & Paterson, K. G. (2021). The security of ChaCha20-Poly1305 in the multi-user setting. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security (pp. 1981–2003). Association for Computing Machinery. https://doi.org/10.1145/3460120.3484814
Dhirani, L. L., Mukhtiar, N., Chowdhry, B. S., & Newe, T. (2023). Ethical dilemmas and privacy issues in emerging technologies: A review. Sensors, 23(3), 1151. https://doi.org/10.3390/s23031151
Georgiadis, G., & Poels, G. (2021). Enterprise architecture management as a solution for addressing General Data Protection Regulation requirements in a big data context: A systematic mapping study. Information Systems and E-Business Management, 19(1), 313–362. https://doi.org/10.1007/s10257-020-00500-5
Hale, M. L., & Gamble, R. F. (2019). Semantic hierarchies for extracting, modeling, and connecting compliance requirements in information security control standards. Requirements Engineering, 24(3), 365–402. https://doi.org/10.1007/s00766-017-0287-5
Ibrahim, A. M., Abdel-Aziz, H. R., Mohamed, H. A. H., Zaghamir, D. E. F., Wahba, N. M. I., Hassan, G. A., Shaban, M., El-Nablaway, M., Aldughmi, O. N., & Aboelola, T. H. (2024). Balancing confidentiality and care coordination: Challenges in patient privacy. BMC Nursing, 23(1), 564. https://doi.org/10.1186/s12912-024-02231-1
Iman, N. (2024). The fight for our personal data: Analyzing the economics of data and privacy on digital platforms. International Journal of Law and Management, 66(6), 774–791. https://doi.org/10.1108/IJLMA-12-2022-0258
Kementerian Komunikasi dan Informatika Republik Indonesia. (2024, May 30). Wamen Nezar Patria ajak tingkatkan keamanan siber semua sektor digital. https://www.komdigi.go.id/berita/pengumuman/detail/siaran-pers-no-372-hm-kominfo-05-2024-tentang-wamen-nezar-patria-ajak-tingkatkan-keamanan-siber-semua-sektor-digital
Leite, L., dos Santos, D. R., & Almeida, F. (2022). The impact of General Data Protection Regulation on software engineering practices. Information & Computer Security, 30(1), 79–96. https://doi.org/10.1108/ICS-03-2020-0043
Naguib, A., & Fouad, K. M. (2024). Database security: Current challenges and effective protection strategies. In 2024 6th International Conference on Computing and Informatics (ICCI) (pp. 120–130). IEEE. https://doi.org/10.1109/ICCI61671.2024.10485182
Negri-Ribalta, C., Lombard-Platet, M., & Salinesi, C. (2024). Understanding the GDPR from a requirements engineering perspective: A systematic mapping study on regulatory data protection requirements. Requirements Engineering, 29, 523–549. https://doi.org/10.1007/s00766-024-00423-4
Nir, Y., & Langley, A. (2018). ChaCha20 and Poly1305 for IETF protocols (RFC 8439). RFC Editor. https://doi.org/10.17487/RFC8439
Radanliev, P. (2024). Digital security by design. Security Journal, 37(4), 1640–1679. https://doi.org/10.1057/s41284-024-00435-3
Ramakrishna, D., & Ali Shaik, M. (2025). A comprehensive analysis of cryptographic algorithms: Evaluating security, efficiency, and future challenges. IEEE Access, 13, 11576–11593. https://doi.org/10.1109/ACCESS.2024.3518533
Republic of Indonesia. (2022). Undang-Undang Republik Indonesia Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi [Law of the Republic of Indonesia Number 27 of 2022 concerning Personal Data Protection]. https://peraturan.bpk.go.id/Details/229798/uu-no-27-tahun-2022
Saleem, F., Salim, N., Altalhi, A. H., Ullah, Z., Al-Malaise Al-Ghamdi, A., & Mahmood Khan, Z. (2020). Assessing the effects of information and communication technologies on organizational development: Business values perspectives. Information Technology for Development, 26(1), 54–88. https://doi.org/10.1080/02681102.2017.1335279
Samaraweera, G. D., & Chang, J. M. (2021). Security and privacy implications on database systems in the big data era: A survey. IEEE Transactions on Knowledge and Data Engineering, 33(1), 239–258. https://doi.org/10.1109/TKDE.2019.2929794
Sánchez, M. (2022). A general approach on privacy and its implications in the digital economy. Journal of Economic Issues, 56(1), 244–258. https://doi.org/10.1080/00213624.2022.2025729
Scheibner, J., Ienca, M., Kechagia, S., Troncoso-Pastoriza, J. R., Raisaro, J. L., Hubaux, J.-P., Fellay, J., & Vayena, E. (2020). Data protection and ethics requirements for multisite research with health data: A comparative examination of legislative governance frameworks and the role of data protection technologies. Journal of Law and the Biosciences, 7(1), lsaa010. https://doi.org/10.1093/jlb/lsaa010
Sekretariat Kabinet Republik Indonesia. (2022, March 28). Presiden Jokowi targetkan 20 juta UMKM masuk toko daring di tahun 2022. https://setkab.go.id/presiden-jokowi-targetkan-20-juta-umkm-masuk-toko-daring-di-tahun-2022/
Shojaei, P., Vlahu-Gjorgievska, E., & Chow, Y.-W. (2024). Security and privacy of technologies in health information systems: A systematic literature review. Computers, 13(2), 41. https://doi.org/10.3390/computers13020041
Shukla, S., Bisht, K., Tiwari, K., & Bashir, S. (2023). Data economy in the digital age. Springer Nature Singapore. https://doi.org/10.1007/978-981-99-7677-5
Sim, J., Kim, B., Jeon, K., Joo, M., Lim, J., Lee, J., & Choo, K.-K. R. (2023). Technical requirements and approaches in personal data control. ACM Computing Surveys, 55(9), 1–30. https://doi.org/10.1145/3558766
Sun, N., Li, C.-T., Chan, H., Le, B. D., Islam, M. Z., Zhang, L. Y., Islam, M. R., & Armstrong, W. (2022). Defining security requirements with the Common Criteria: Applications, adoptions, and challenges. IEEE Access, 10, 44756–44777. https://doi.org/10.1109/ACCESS.2022.3168716
Yeung, K., & Bygrave, L. A. (2022). Demystifying the modernized European data protection regime: Cross-disciplinary insights from legal and regulatory governance scholarship. Regulation & Governance, 16(1), 137–155. https://doi.org/10.1111/rego.12401
Zaeem, R. N., & Barber, K. S. (2025). Economics of cybercrime: Identity theft and fraud. In Encyclopedia of cryptography, security and privacy (pp. 732–734). Springer Nature Switzerland. https://doi.org/10.1007/978-3-030-71522-9_1613
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Musa Darwin Pane, Mari Maryati, Angga Setiyadi
This work is licensed under a Creative Commons Attribution 4.0 International License.
Copyright :
Authors who publish their manuscripts in this journal agree to the following conditions:
- Copyright in each article belongs to the author.
- The author acknowledges that the Greenation International Journal of Law and Social Sciences (GIJLSS) has the right to be the first to publish under a Creative Commons Attribution 4.0 International license (Attribution 4.0 International CC BY 4.0).
- Authors can submit articles separately, arrange the non-exclusive distribution of manuscripts that have been published in this journal to other versions (for example, sent to the author's institutional repository, publication in a book, etc.), by acknowledging that the manuscript has been published for the first time at GIJLSS.
