Personal Data Protection for Websites and Apps: Practical Steps for Business Owners

Almost every business website and app collects personal data, often without the owner realising. A contact form stores a name and phone number, an online store holds addresses and order history, an app keeps device identifiers and location, and analytics tools record visitor behaviour. All of that is personal data, and managing it is no longer just a technical matter but a legal and trust responsibility.

In Indonesia, rules on personal data protection are now set out in a dedicated law along with its implementing regulations. For a business owner, the practical question is not memorising articles but understanding the principles and turning them into working habits: what is collected, for what purpose, where it is stored, who may access it, and what is done when something goes wrong. Businesses that build these habits are better prepared for evolving rules and more trusted by customers.

This article covers practical steps for managing personal data on websites and apps. We discuss data mapping, the basis for collection and consent, privacy notices, data subjects' rights, security, third parties, retention, breach handling, and governance habits. Note that this article is educational and not legal advice. Rules can change and their application depends on your type of business, so refer to current official sources and consult legal counsel for your case. We deliberately do not quote specific figures or deadlines that may already have changed.

Summary

• Start by mapping what personal data you collect, from where, for what, and where it flows
• Collect only what is needed and ensure there is a lawful basis, including consent where required
• Give a clear privacy notice and provide ways for data subjects to exercise their rights
• Secure data with technical and organisational controls, and govern third parties through written agreements
• Prepare a breach handling plan and appoint someone responsible for data protection in the company

Why businesses need to care now

There are three reasons that reinforce one another. First, legal obligation. Personal data controllers have certain duties, and violations can lead to administrative sanctions and other consequences under the rules. Second, customer trust. Customers are increasingly aware that their data is valuable, and a careless business will quickly lose trust, especially if there is a breach. Third, business resilience. Data that is messy, scattered, and of unknown whereabouts is an operational risk: hard to secure, hard to delete, and hard to account for.

Small businesses often assume these rules are only for large companies. Yet the basic principles apply to anyone who processes personal data, and the size of the business usually affects only how formal governance needs to be, not whether responsibility exists. A wise approach is to apply measures proportionate to your risk and scale, then raise them as you grow.

First step: mapping the data you hold

You cannot protect what you do not know about. The first step is to build an inventory of personal data: what is collected, from whom, through which channel, where it is stored, what it is used for, who it is shared with, and how long it is kept. Do this for all touchpoints, including those often forgotten such as old forms, export files, backups, and third party tools installed by the marketing team.

• Data collected through forms, registration, purchases, and customer service messages
• Technical data from devices and browsers: network addresses, device identifiers, and cookies
• Location, contacts, photos, or microphone data requested by a mobile app
• Data from analytics, advertising, and behaviour tracking tools
• Data on employees, job applicants, and business partners
• Copies of data in backups, local files, spreadsheets, and email inboxes

For each category, note its sensitivity too. Certain data, such as health, biometric, personal financial, or children's data, generally requires stricter protection under the rules. Mark such data so it receives special treatment. The result of this mapping becomes the basis for all later steps, and deserves updating each time you add a feature or a new tool.

Collect only what is needed and ensure a lawful basis

The most useful principle is minimisation: collect only the data really needed for a clear purpose. A form asking for date of birth, full address, and occupation when only an email is needed to send a newsletter is an example of overcollection. Every extra field adds risk and burden without adding value.

Every processing of personal data needs a lawful basis under the rules. The consent of the data subject is one, but not the only one. There are other bases, such as performing a contract with the data subject or meeting a legal obligation. Understand which basis applies to each of your activities. For example, processing an address to deliver an order rests on the sales contract, whereas sending promotions usually needs separate consent.

• Decide the purpose of each type of data before collecting it and do not use it for other purposes without a suitable basis
• Avoid mandatory fields that are not needed; make them optional if they are merely extras
• Where using consent, make it voluntary, specific, and easy to withdraw
• Do not bundle consent for many things into one checkbox
• Do not set consent boxes to be preticked
• Record when, how, and for what consent was given

A privacy notice that can be understood

Data subjects have the right to know how their data is treated. A privacy notice, often called a privacy policy, is the way to meet that. Many privacy policies fail because they are written like long legal documents nobody can read, or copied from another site without adapting to actual practice. A policy that does not match reality is more dangerous than none, because it becomes evidence of dishonesty.

• Who you are and how to contact you about personal data
• What data is collected and from where
• What the data is used for and on what basis
• Who the data is shared with, including categories of service providers
• How long the data is kept or the criteria for deciding it
• The rights of data subjects and how to exercise them
• Whether data is sent abroad and the protections applied

Use simple language, structure it with clear headings, and show it at the relevant moment, for example a short summary near the form with a link to the full version. Update it whenever practice changes and keep old versions. If you serve users in several languages, provide the notice in the same language as the interface so it can truly be understood.

Cookies, trackers, and analytics

Many websites install cookies and trackers for analytics, advertising, and other functions. Some are needed for the site to work, while others are for analytics or marketing and generally call for more attention to consent. Check all trackers active on your site, including those installed through third party tools, then group them by purpose.

• List all active cookies and trackers and determine the purpose of each
• Separate those truly needed for the site to function from those that are analytics or advertising
• Show a clear notice and choices, with declining as easy as accepting
• Do not run trackers that need consent before consent is given
• Provide a way to change the choice at any time
• Review periodically because new tools are often added without notice

Technical choices that respect privacy, such as analytics that use no personal identifiers or aggregated data, are often available and sufficient for many business needs. Consider that approach before enabling more invasive tracking.

Data subjects' rights and how to serve them

Personal data protection rules give data subjects certain rights over their data, such as requesting information about processing, accessing, correcting, deleting, or restricting processing, and withdrawing consent. The details and time limits for fulfilling them are set in the rules in force, so they need to be checked from current official sources.

The practical challenge: if data is scattered across many systems, fulfilling a request such as delete my data becomes very hard. This is why data mapping matters. Provide a clear channel to receive requests, for example a dedicated email address or a form, decide who handles them, verify the requester's identity so data is not given to the wrong person, and record each request with its resolution.

1. 01Receive the request through the channel stated in the privacy notice
2. 02Verify the requester's identity in a proportionate and not excessive way
3. 03Search for the requester's data across all systems recorded in the inventory, including backups and third parties
4. 04Fulfil, partly refuse, or explain the limits according to the rules, with written reasons
5. 05Tell the requester the outcome within the period set by the rules
6. 06Archive the record of the request and action as evidence of compliance

From the development side, design systems so these capabilities are easy to meet: customer data centralised and linked by consistent identities, functions to export and delete or anonymise a person's data, and data in backups with a clear retention period. Building them from the start is far cheaper than patching when the first request arrives.

Securing personal data

Personal data protection is not separate from security. A data controller must keep the data it processes secure with technical and organisational measures appropriate to the risk. What counts as adequate depends on the sensitivity of the data and the potential impact if it leaks, so more sensitive data needs stronger protection.

• Encryption of data in transit and, for sensitive data, at rest
• Role based access limits, following the principle of least privilege
• Multifactor authentication for administrative accounts and access to customer data
• Logging of access and changes to sensitive data so they can be traced
• Routine security updates for servers, applications, and the libraries used
• Encrypted backups whose restoration is tested, with limited access
• Separation of testing and production environments, and not using real customer data for testing without protection
• Employee training on data handling, phishing emails, and work devices

The organisational aspect is as important as the technical. Many leaks happen not through sophisticated hacking but through negligence: a file with customer data sent to the wrong person, a laptop lost with no encryption, or a former employee whose access was not revoked. Set simple rules and train the team to follow them, including procedures when employees join, change roles, and leave.

Third parties and service providers

Almost no business manages data entirely by itself. Hosting providers, email services, analytics tools, payment systems, customer support providers, and external developers can all touch personal data. When you hand data to them, your responsibility does not automatically disappear, so choosing and governing the relationship with them is very important.

• List all providers who process personal data on your behalf
• Check their security practices and privacy policies before use, and ask for evidence where needed
• Set out in a written agreement what they may do with the data, security obligations, and notification if a breach occurs
• Make sure the data is used only on your instructions and not for their own purposes
• Know where data is stored and check the rules if data is sent abroad
• Prepare a plan to return or delete data when the cooperation ends
• Review the provider list periodically and discontinue those no longer needed

The same applies to software development vendors. When a system is developed or maintained by an outside party, decide who may access real data, how access is granted and withdrawn, and what is done with copies of data after the project ends. This should be written into the contract, not just an oral understanding.

Retention and deletion of data

Personal data must not be kept forever without reason. Once the purpose of processing is achieved and there is no legal obligation or legitimate interest to keep it, the data should be deleted or anonymised. Hoarding data that is no longer used only enlarges the risk and the impact if a breach occurs.

1. 01Set a retention period for each data category based on purpose and applicable legal obligations, not just habit
2. 02Apply automatic deletion or anonymisation where possible
3. 03Make sure data in backups, logs, and other copies is covered by the policy
4. 04Record exceptions and their reasons, for example data that must be kept for tax or bookkeeping obligations
5. 05Review the policy periodically and adjust it to changes in the rules

Note the difference between deleting and hiding. Data merely flagged as deleted but still present in the database is still stored personal data. Design a deletion process that truly deletes or anonymises, and test that the result is correct.

Being ready for a data breach

However good the security, incidents remain possible. The difference between a controlled incident and a disaster often lies in readiness. The rules on the duty to notify a failure of personal data protection, including who must be told and within what period, are set out in the rules in force, so your plan must refer to current rules and legal advice.

1. 01Appoint the incident handling team and owner, with ways to reach them outside working hours
2. 02Prepare first steps: isolating affected systems, changing credentials, and preserving evidence
3. 03Assess the scope: what data, whose, and the potential impact on data subjects
4. 04Decide who must be notified, including the authorities and data subjects, with content and timing according to the rules
5. 05Prepare a notification template that is clear, honest, and includes steps data subjects can take
6. 06After recovery, review the cause, fix the gap, and document the lessons

Practise the plan through a short simulation, for example ask the team what they would do if tomorrow morning the customer database were found leaked. An exercise like this quickly reveals gaps: nobody knows whom to call, there is no clean backup, or there are not enough logs to assess the scope.

Governance: making it a habit, not a one off project

Personal data protection is not a project that ends but a habit that continues. Decide who is responsible in the company, whether a data protection officer where the rules require one, or an internal owner in a smaller business. Check the current rules to know whether the type and scale of your processing require appointing a dedicated officer.

• Update the data inventory whenever there is a new feature, tool, or provider
• Carry out an impact assessment for high risk processing before starting it, where required or worthwhile
• Bring privacy considerations in from feature design, not after it is built
• Train new employees and refresh training periodically
• Document policies, decisions, and evidence of compliance so they can be shown on request
• Monitor regulatory developments and update practice as they change

Documentation has two functions: it helps the team work consistently and serves as evidence of good faith when there is an inspection or complaint. It need not be thick; brief, accurate, maintained notes are more useful than a large document nobody opens.

Common mistakes to avoid

• Copying a privacy policy from another site without adapting it to real practice
• Collecting far more data than needed for a clear purpose
• Installing third party trackers without checking what data they send
• Using real customer data in testing environments without protection
• Having no way to receive and answer requests from data subjects
• Having no breach plan until a breach actually happens
• Treating data protection as a one time matter that a single document can settle

First steps you can start this week

1. 01Build a simple inventory: what personal data your website, app, and third party tools collect
2. 02Check the forms and remove fields that are not needed
3. 03Compare the privacy policy with real practice and fix any mismatch
4. 04List all providers that touch personal data and review your agreements with them
5. 05Appoint someone responsible for data protection and schedule a breach handling simulation
6. 06Consult legal counsel and refer to current official sources for your business's specific obligations

Closing

Managing personal data well is not only about avoiding sanctions but part of building a business that is trusted. Data mapping, collection as needed, a lawful basis, an honest notice, adequate security, governance of third parties, clear retention, and readiness for incidents make your business more resilient and your customers more at ease.

Start from the simplest and highest impact steps, then build consistent governance habits. Because the rules keep evolving, make periodic review and consultation with legal counsel part of your routine.