PDP Law · ISO/IEC 27001:2022

Audit-ready. Every day.

Not only the week before the auditor arrives. Saksama maps the personal data across your company, reviews who holds access, records every touch in a log that cannot be quietly changed, and drafts the 72-hour notice before you ever need it.

Book a 30-minute survey See our Trust Center

Data processed in Jakarta · 93 Annex A controls mapped to the PDP Law

Control survey

Four passes. Twelve bolts.

Scroll to scan. Each pass checks one part of the door, and every control that checks out draws one bolt.

Pass 01/0401Inventory plate·Data map

Know what is in the vault, before the auditor asks.

Saksama reads your systems and builds a map of personal data: what is kept, where, on what basis and for how long. Specific data such as biometrics and finances is flagged on its own, and so is every transfer abroad.

Data map · 214 processing activities

ActivityDataLocationNote
PayrollID number, tax ID, bank accountJakartaPersonal financial data
Face attendanceFace photo, check-in locationJakartaBiometric, specific data
Sales CRMName, WhatsApp numberSingaporeTransfer abroad
RecruitmentCV, education historyJakartaDeleted 12 months after rejection

A.5.9Inventory of information and other assetsPendingPassed
A.5.12Classification of informationPendingPassed
PDP Law Art. 31Records of processingPendingPassed

Pass 02/0402Combination dial·Access reviews

Who holds the combination? Review in four days, not three weeks.

Every quarter Saksama pulls access lists from Google Workspace, AWS and your other apps, then sends each one to the right manager. Access unused for 90 days is flagged, and every revocation is kept as evidence.

Access review Q4 2026 · Finance142 of 168 decisions

Dimas HaryantoAWS production · Admin
94 days ago
Sari WulandariTalenta · Editor
2 days ago
Sinar Teknik (vendor)Finance Drive · Viewer
211 days ago
Rizky PratamaJurnal · Admin
6 days ago

A.5.15Access controlPendingPassed
A.5.18Access rightsPendingPassed
A.8.2Privileged access rightsPendingPassed

Pass 03/0403Hinges·Audit log

A ledger of who touched what, in order, and never quietly changed.

Every access, export and policy change goes into a log where each line carries the fingerprint of the one before. Auditors can check the chain themselves, without having to trust us.

Audit log · production · Thu 8 Oct 2026Fingerprint chain intact · 48,211 lines

10:42:08
Rani Kusumawardani opened payroll_october_2026.xlsx
Data
10:41:55
System revoked access Sinar Teknik (vendor) · Finance Drive
Access
10:39:12
Bagus Pratama exported Customer list, 1,204 rows
Data
10:36:40
Dewi Anggraini approved Access review Q4 · Finance
Access
10:33:40
Yohanes Siregar closed public access Bucket ktp-archive
Incidents
10:31:07
System detected Bucket ktp-archive open to the public
Incidents
10:22:19
Ketut Ardana published Data Retention Policy v2.3
Policy
10:15:03
System rotated a key KMS jakarta-1 · customer data key
Policy

Showing 8 of 8 linesExport for the auditor · CSV · PDF

A.8.15LoggingPendingPassed
A.8.16Monitoring activitiesPendingPassed
A.5.28Collection of evidencePendingPassed

Pass 04/0404Locking wheel·Incident response

When the 72-hour clock starts, the steps are already written.

The PDP Law gives you 72 hours to notify data subjects and the authority. Saksama starts the clock the moment an incident is logged, splits up the work, and drafts a notice with the three things the law requires: what data was exposed, when and how, and what is being done about it.

INS-2026-0142,140 ID card photos · medium severity

Bucket ktp-archive was briefly public

Time left to notify61:28:14of 72 hours

10:31Detected by automated monitoring
10:33Public access closed
12:10Impact assessed: 2,140 data subjects
NowNotice to data subjects, ready for review
NextReport to the authority

Open the draft notice

A.5.24Incident management planningPendingPassed
A.5.26Response to incidentsPendingPassed
PDP Law Art. 46Notice within 72 hoursPendingPassed

§ 05

Used by compliance teams at 140 companies, from fintech to clinics

001Lumbung KreditLending fintechsince 2023
002Rawat SehatTelemedicinesince 2024
003Pelita PayrollPayrollsince 2024
004Asuransi TeduhMicro insurancesince 2024
005Sinar Retail GroupRetail, 2.1 million memberssince 2025
006Nusa EdukasiEducationsince 2025
007Kargo TimurLogisticssince 2025
008Klinik Gigi PratamaHealthcare, 19 clinicssince 2026

§ 06

Measured where it is used

14 weeks

from kick-off to an ISO/IEC 27001 certificate

median 39 weeks without Saksama, 22 customers

31 hours

median time to notify data subjects of an incident

the PDP Law allows 72 hours

4 days

for one round of access reviews

down from 21 days on spreadsheets

§ 07

Our own vault is open for inspection.

Saksama's control status, subprocessors and policies live in our Trust Center, updated automatically every 15 minutes.

Open the Trust Center

Annex A controls passing: 91/93
latest penetration test: 2 Sep 2026
where all customer data lives: Jakarta
subprocessors, every one listed: 6

§ 08

From people who have been audited

Statement 01

The auditor asked for 140 pieces of evidence. We sent one link to the auditor workspace in Saksama, and it was all done before lunch.

Andreas WijayaHead of Information Security, Lumbung Kredit

Statement 02

Medical records are specific data. The data map showed us exactly where ours were kept, including on two doctors' laptops we never suspected.

Dr Maria TambunanDirector of Operations, Rawat Sehat

Statement 03

Access reviews used to take three weeks and twenty spreadsheets. Now our managers finish them from their phones, and the evidence files itself.

Hendra GunawanHead of IT, Pelita Payroll

Open the door for the auditor. The evidence is already inside.

Thirty minutes with our team: we map the controls you already have, and you leave with the list of what remains, weeks included.

Book a 30-minute survey