An e-commerce company knows its customer data is scattered across five spreadsheets, yet nobody has ever recorded the risks. When one of those files is exposed to the public, no one knows who is responsible or what to do first.
A data breach is not just a technical event that ends once the system is restored. According to IBM’s 2026 Cost of a Data Breach Report, the global average cost of a single incident reached USD 4.99 million, the highest figure in the report’s history.
Incidents like this can be prevented through personal data risk management that runs routinely, not only during a crisis. This practical guide covers the legal basis, the most common types of risk, and the steps you can apply in your company.
Why Personal Data Has Become a Business Risk
Personal data is the raw material of many business processes, from transactions and shipping to billing and recruitment. That is why every breach reaches operations directly, not just the IT team.
The impact shows up in finances, reputation, and partner relationships. Recovery costs balloon, customers hesitate to share their data again, and prospective partners ask for proof of controls they never questioned before.
The threats are also becoming more varied. Fraudsters can now imitate a manager’s voice using deepfake technology, then demand that customer or payroll data be sent immediately.
Imagine a finance staff member receiving a call from a fake “director”. Without a verification procedure, the request can look very convincing.
Legal Basis You Need to Understand (Indonesia’s PDP Law)
In Indonesia, personal data management is governed by Law Number 27 of 2022 on Personal Data Protection, commonly called the PDP Law. The adjustment period for companies ended on 17 October 2024, so the rules now apply in full.
The law divides responsibility between two roles: the data controller and the data processor. Knowing which role your company plays determines which obligations you must meet and which sanctions you may face.
Obligations of the Personal Data Controller
A controller is the party that determines the purpose and means of processing personal data, for example a company that collects customer data through its website or app. A controller must have a lawful basis for processing and keep the data it processes secure (Article 35).
If data protection fails, the controller must notify the data owner and the authority in writing within 3×24 hours (Article 46). Companies that process data on a large scale must also appoint a data protection officer.
Example: a shopping app stores users’ addresses and purchase history. If its database is exposed, the company, as controller, must report within 3×24 hours.
Obligations of the Personal Data Processor
A processor handles data on behalf of the controller, such as a cloud provider or an email marketing agency. Some controller obligations, including keeping data secure, also apply to processors.
A processor acts on the controller’s instructions and may not use the data for its own purposes. Even so, primary responsibility remains with the controller.
Example: a bulk SMS agency stores a list of customer phone numbers on an unprotected server. The company that owns the list must still answer to customers and regulators.
Sanctions for Violations
Violations of obligations can bring administrative sanctions under Article 57: a written warning, temporary suspension of processing, deletion or destruction of data, and an administrative fine. The maximum fine is 2% of annual income or annual revenue relating to the violation.
Criminal sanctions also apply to anyone who unlawfully obtains, discloses, uses, or falsifies personal data, with prison terms of up to 6 years. When the offender is a corporation, the criminal fine can reach ten times the fine stipulated.
Example: an employee sells a customer list to an outside party. The employee may face prosecution, while the company can still face administrative sanctions if it is found negligent in protecting that data.
What Is Personal Data Risk Management?
Personal data risk management is a continuous process of identifying, assessing, handling, and monitoring threats to the personal data a company holds. Personal data covers any information that can identify a person, whether a customer, an employee, or a business partner.
Examples include full names, phone numbers, email addresses, ID numbers, bank account details, and health records. Even data that looks trivial can be dangerous when combined, such as a full name paired with a date of birth and a mobile number.
Its scope is broader than cybersecurity. Cybersecurity protects systems from attacks, while personal data risk management also asks more basic questions: what data do we hold, for what purpose, who may see it, and how long do we keep it.
Risk and incident also need to be told apart. A risk is the possibility that something will happen, while an incident is an event that has already occurred, and risk management works on the first so the second never has to happen.
Because personal data is spread across many departments, managing it cannot be left to the IT team alone. HR holds employee data, marketing holds prospect data, and finance holds bank details, and each carries its own risks.
The Most Common Personal Data Risks in Companies
Before getting to the management steps, first get to know the most common forms of risk. The four types below appear in companies of all sizes.
- Misdirected or over-shared files, where a file containing customer data reaches the wrong recipient. For example, a folder of client lists is shared with the setting “anyone with the link”.
- Unauthorized access, where people without permission open data, whether outside hackers or insiders. For example, an employee’s password leaks and is used to enter the HR system.
- Ransomware, where attackers lock the data and demand a ransom, sometimes threatening to leak its contents. For example, a clinic’s system is locked and patient records are threatened with publication.
- Vendor negligence, where data leaks from a third party you trusted. For example, an email marketing provider suffers a breach and your customer list is exposed with it.
Steps to Manage Personal Data Risk
The seven steps below run in order, from assigning responsibility to monitoring results. Each step comes with a short example to make it easier to picture.
1. Set a Policy and Assign Responsibility
A risk without an owner is usually left alone. Appoint one person or team to monitor compliance and receive incident reports, then put your data handling rules into a written policy.
Example: a customer service agent finds that a customer file was sent to the wrong party. She knows exactly who to report to, so the incident is handled the same day.
2. Take Inventory of the Personal Data You Manage
You cannot manage risks from data you do not know exists. Record the types of data, where they are stored, how they move, and who processes them.
Example: the marketing team turns out to keep a webinar attendee list in a personal spreadsheet, even though IT assumes everything sits in the CRM. The data only becomes visible once the inventory is done.
3. Identify the Risks
Once the data is mapped, ask what could go wrong with each item. Look at it from the angle of people, processes, systems, and third parties.
Example: in the recruitment process, applicants’ CVs are sent to managers’ personal email accounts. The risk is clear, since applicant data ends up in inboxes the company does not control.
4. Assess the Level of Each Risk
Assessment measures two things: how likely the risk is to occur and how large its impact would be. Sensitive data such as medical records or biometrics automatically carries a higher impact than an email address.
Example: the risk of sending a payroll spreadsheet to the wrong person is rated high because it happens often and the impact is large. The risk of sending a promotional brochure to the wrong person is rated low.
5. Set Priorities and Treatment Options
You cannot handle every risk at once, so start from the highest score. For each risk, choose one option: reduce it, avoid it, transfer it, or consciously accept it.
Example: a company decides to stop collecting ID numbers at member registration because the data is not needed. The risk disappears entirely, with no extra security cost.
6. Apply Security Controls
Controls are the concrete actions that reduce risk: access limited to job needs, encryption, employee training, vendor screening, and deletion of data whose retention period has ended. Write data protection obligations into vendor contracts.
Example: a finance employee leaves a laptop at the airport. Because its hard disk is encrypted, the client data inside stays unreadable to whoever finds it.
7. Monitor, Test, and Review Regularly
Risks change as the business runs. A new system, vendor, or campaign can open gaps that did not exist last year, so schedule a review at least once a year and test your incident response plan.
Example: a company simulates a customer database exposure and discovers that nobody knows who has the authority to contact customers. The gap is fixed before a real incident arrives.
Conclusion
Personal data risk management is not a one-time project. Start by appointing an owner and mapping your data, because those two things shape every step that follows.
The PDP Law already sets out clear obligations and sanctions, so companies have little reason to delay. What matters most is consistency: regular reviews, repeated training, and plans that are actually tested.
Ready to Manage Privacy Compliance as a Business Risk?
See how GRC helps map personal data risks, monitor compliance with the PDP Law, and prepare companies for audits without complicated manual processes.
FAQ
Cybersecurity focuses on protecting systems from attacks. Personal data risk management has a wider scope, covering what data is held, who can access it, and how long it is kept.
Under the PDP Law, companies can face administrative sanctions such as a written warning, temporary suspension of processing, data deletion, and a fine of up to 2% of annual income. Certain violations can also lead to criminal sanctions.
Start by appointing an owner and taking inventory of the personal data you manage. These two steps form the basis for identifying and assessing the risks that follow.
