Indonesia Tax Office Assures Data Security After New Financial Reporting Rule

Indonesia’s Tax Chief Assures Data Security Amid Expanded Financial Reporting Rules

Jakarta – Indonesia’s Director General of Taxes, Bimo Wijayanto, has moved to reassure the public regarding the security of taxpayer data following the implementation of new regulations requiring 23 banks to report credit card transaction data to the Directorate General of Taxes (DJP). The move, stemming from a new ministerial regulation, has prompted scrutiny regarding data privacy, leading to assurances from the tax authority that robust security measures are in place. This comes as the government seeks to bolster tax revenue and improve compliance, a priority underscored by recent assessments from international financial institutions.

Wijayanto stated that the DJP’s data management systems have undergone rigorous testing by national agencies, emphasizing that data protection is a core principle of tax administration. “We have undergone a review of personal data protection with Komdigi, as well as BSSN to review the sovereignty and security of our data and systems,” Wijayanto said during a media briefing on March 5, 2026.

New Regulations and Data Scope

The recent assurances follow the issuance of Regulation of the Minister of Finance Number 8 of 2026, signed by Finance Minister Purbaya Yudhi Sadewa. This regulation mandates that government institutions, agencies, associations, and other parties submit tax-related data to the DJP. Specifically, banks are now required to report credit card transactions made by customers at merchants, including details such as the issuing and acquiring banks, merchant identification and address, transaction values, settlement amounts, and cancelled transactions. A total of 23 banks are currently subject to this reporting requirement, including major players like PT Bank Central Asia Tbk, PT Bank Negara Indonesia Persero Tbk, PT Bank Mandiri Persero Tbk, and PT Bank Rakyat Indonesia Persero Tbk.

Data Security Measures in Place

Wijayanto explained that the DJP’s systems, including Coretax, have been subject to security and data protection reviews. He further highlighted that the confidentiality of taxpayer data is legally protected under Article 34 of tax regulations, which obligates officials to maintain data secrecy. The principle of data security is, according to Wijayanto, embedded in the development of the DJP’s technology. Systems also undergo penetration testing by independent agencies to identify and address vulnerabilities.

Several agencies have been involved in these security assessments, including the National Cyber and Crypto Agency (BSSN), the State Intelligence Agency (BIN), and the Strategic Intelligence Agency (BAIS). These reviews aim to ensure the integrity and confidentiality of taxpayer information in the face of increased data collection.

Bimo Wijayanto: A Profile of the Current Director General of Taxes

Bimo Wijayanto’s appointment as Director General of Taxes on May 23, 2025, marked a significant shift in leadership for the Indonesian tax authority. He was directly appointed by President Prabowo Subianto, who tasked him with improving the accountability, integrity, and independence of the Indonesian tax system, particularly in securing state revenue. According to the Directorate General of Taxes website, Wijayanto holds a Ph.D. In Economics from the University of Canberra, Australia, and a Master of Business Administration from the University of Queensland. He began his career as a civil servant at the Ministry of Finance in 2002.

Prior to his current role, Wijayanto held several strategic positions, including Senior Expert Staff at the Executive Office of the President (2016-2020) and Assistant Deputy for Strategic Investment at the Coordinating Ministry for Maritime and Investment Affairs (2020). His extensive experience in public service and economic policy positions him as a key figure in the government’s efforts to enhance tax collection and modernize the tax administration system.

Context: The Push for Increased Tax Revenue

The move to expand data collection from financial institutions reflects a broader government strategy to increase tax revenue and improve compliance rates. Indonesia has been working to broaden its tax base and reduce tax evasion, particularly as it seeks to fund infrastructure projects and social programs. The new regulations are intended to provide the DJP with greater visibility into taxpayers’ financial transactions, enabling more accurate tax assessments and reducing opportunities for underreporting income. Here’s particularly relevant given recent scrutiny from international bodies like Fitch Ratings regarding Indonesia’s revenue performance.

Confirmed vs. Unclear

Confirmed: The new regulation (PMK 8/2026) requires 23 banks to report credit card transaction data to the DJP. Bimo Wijayanto is the current Director General of Taxes. The DJP has undergone security reviews by Komdigi, BSSN, BIN, and BAIS.

Unclear: Specific details regarding the frequency of data submissions from banks were not provided. The exact methodologies used by the security agencies in their reviews have not been publicly disclosed. The long-term impact of the new regulations on tax revenue collection remains to be seen. The specific criteria used to select the 23 banks subject to the reporting requirement has not been detailed.

What Happens Next?

The DJP will now begin receiving data from the 23 banks, and will likely focus on analyzing the information to identify potential discrepancies and improve tax compliance. The effectiveness of the new regulations will be closely monitored, and adjustments may be made based on the initial results. Further regulations or expansions of data collection requirements are possible as the government continues its efforts to strengthen the tax system. The DJP will also need to continue investing in its data security infrastructure to maintain public trust and protect taxpayer information.

The implementation of these new rules marks a significant step in Indonesia’s ongoing efforts to modernize its tax administration and improve revenue collection. The success of this initiative will depend on the DJP’s ability to effectively analyze the data, enforce compliance, and maintain the security and confidentiality of taxpayer information.