Traceable Privacy and Cybersecurity Compliance Control Baseline for Indonesian Academic Information Systems
DOI:
https://doi.org/10.62123/enigma.v4i1.201Keywords:
Information systems, Privacy governance, Cybersecurity compliance, IT governance, Audit readinessAbstract
Academic information systems process student identities, academic records, library transactions, authentication logs, learning analytics, and third-party service integrations. In Indonesia, privacy and cybersecurity compliance is difficult to operationalize because legal obligations are often separated from system risks, IT governance controls, ownership, and audit evidence. This study develops a traceable privacy and cybersecurity compliance control baseline for Indonesian academic information systems. The method applies structured literature-based conceptual synthesis and design science-inspired artifact development through source selection, concept coding, framework reconciliation, regulatory mapping, control mapping, and ex-ante conceptual evaluation. The evidence base consists of 55 academic, regulatory, framework, and design science sources. The results produce a five-layer governance model, framework reconciliation protocol, Indonesian regulatory mapping, privacy and cybersecurity risk-control-evidence matrices, an audit evidence schema, and an implementation roadmap. The contribution is an initial control-oriented governance baseline for aligning privacy obligations, cybersecurity safeguards, accountable ownership, and audit preparation. The model is conceptual and requires future expert validation and institutional case evaluation.
Downloads
References
[1] D. J. Solove, “A taxonomy of privacy,” University of Pennsylvania Law Review, vol. 154, no. 3, pp. 477-564, 2006.
[2] N. Vieira Dantas, A. P. H. de Gusmão, and M. T. Gonzaga, “A multicriteria model to support decisions regarding data protection compliance,” Journal of Decision Systems, vol. 33, no. 4, pp. 744-760, 2024, doi: 10.1080/12460125.2023.2263683.
[3] C. Del-Real, E. De Busser, and B. van den Berg, “A systematic literature review of security and privacy by design principles, norms, and strategies for digital technologies,” International Review of Law, Computers & Technology, vol. 39, no. 3, pp. 374-405, 2025, doi: 10.1080/13600869.2025.2457227.
[4] Miftahurrizqi, I. S. Windiarti, and A. Prabowo, “Analisis keamanan sistem pada sistem informasi akademik menggunakan COBIT 5 framework pada sub domain DSS05,” Jurnal Sains Komputer dan Teknologi Informasi, vol. 3, no. 2, pp. 75-80, 2021, doi: 10.33084/jsakti.v3i2.2293.
[5] T. Ariyadi, T. L. Widodo, N. Apriyanti, and F. S. Kirana, “Analisis kerentanan keamanan sistem informasi akademik Universitas Bina Darma menggunakan OWASP,” Techno.COM, vol. 22, no. 2, pp. 418-429, 2023.
[6] Y. Hamdi, C. E. Gunawan, and I. S. Putra, “Analisis perilaku kesadaran privasi data pengguna sistem informasi akademik dengan pendekatan Technology Threat Avoidance Theory,” TIN: Terapan Informatika Nusantara, vol. 6, no. 1, pp. 24-33, 2025, doi: 10.47065/tin.v6i1.7590.
[7] A. S. Putra, E. R. Sambhodo, F. M. Aisfa, M. S. Nur, and M. A. Priyanta, “Audit menggunakan COBIT 5 domain DSS pada SIAKAD Universitas Merdeka Malang,” SATESI: Jurnal Sains Teknologi dan Sistem Informasi, vol. 5, no. 1, pp. 31-37, 2025, doi: 10.54259/satesi.v5i1.4044.
[8] T. I. Putra, N. Fibrianti, and M. R. Fakhrullah, “Basis of Data Protection Officer appointment: Comparative study of Indonesia and European Union regulation,” SASI, vol. 31, no. 1, pp. 1-15, 2025, doi: 10.47268/sasi.v31i1.2068.
[9] C. Labadie and C. Legner, “Building data management capabilities to address data protection regulations: Learnings from EU-GDPR,” Journal of Information Technology, vol. 38, no. 1, pp. 16-44, 2023, doi: 10.1177/02683962221141456.
[10] N. A. Zaguir, G. H. de Magalhães, and M. de M. Spinola, “Challenges and enablers for GDPR compliance: Systematic literature review and future research directions,” IEEE Access, 2024, doi: 10.1109/ACCESS.2024.3406724.
[11] O. Afolalu and M. S. Tsoeu, “Cybersecurity in higher education institutions: A systematic review of emerging trends, challenges and solutions,” Future Internet, vol. 17, no. 12, art. 575, 2025, doi: 10.3390/fi17120575.
[12] M. Salam, K. A. Abu Bakar, A. T. Abdul Ghani, and A. H. M. Aman, “Cybersecurity in higher education institutions digitalisation: Addressing threats and vulnerabilities,” SAGE Open, Jan.-Mar. 2026, doi: 10.1177/21582440251413473.
[13] A. R. Hevner, S. T. March, J. Park, and S. Ram, “Design science in information systems research,” MIS Quarterly, vol. 28, no. 1, pp. 75-105, 2004, doi: 10.2307/25148625.
[14] K. D. Schubert and D. Barrett, “Data governance, privacy, and ethics,” in Human Privacy in Virtual and Physical Worlds: Multidisciplinary Perspectives, M. C. Lacity and L. Coon, Eds. Cham: Springer Nature Switzerland, 2024, pp. 87-110, doi: 10.1007/978-3-031-51063-2_5.
[15] J. Wiwoho, U. K. Pati, and A. M. Pratama, “Enabling data portability and interoperability under Indonesia’s data protection law,” Masalah-Masalah Hukum, vol. 53, no. 3, pp. 271-282, 2024.
[16] F. Burmeister, C. Kurtz, and I. Schirmer, “Governing information privacy in data ecosystems with architectural thinking,” Electronic Markets, vol. 35, art. 67, 2025, doi: 10.1007/s12525-025-00808-5.
[17] M. Rhahla, S. Allegue, and T. Abdellatif, “Guidelines for GDPR compliance in Big Data systems,” Journal of Information Security and Applications, vol. 61, art. 102896, 2021.
[18] H. J. Smith, T. Dinev, and H. Xu, “Information privacy research: An interdisciplinary review,” MIS Quarterly, vol. 35, no. 4, pp. 989-1015, 2011, doi: 10.2307/41409970.
[19] J. Fernandes, C. Machado, and L. Amaral, “Identifying critical success factors for the General Data Protection Regulation implementation in higher education institutions,” Digital Policy, Regulation and Governance, vol. 24, no. 4, pp. 355-379, 2022, doi: 10.1108/DPRG-03-2021-0041.
[20] L. Magnusson, S. Iqbal, P. Elm, and F. Dalipi, “Information security governance in the public sector: Investigations, approaches, measures, and trends,” International Journal of Information Security, vol. 24, art. 177, 2025, doi: 10.1007/s10207-025-01097-x.
[21] A. A. Nugraha and A. H. Nasyuha, “Integrating ISO 27001 and Indonesia’s personal data protection law for data protection requirement model,” Journal of Information Systems and Informatics, vol. 6, no. 2, 2024, doi: 10.51519/journalisi.v6i2.754.
[22] M. Yang, L. Tan, X. Chen, Y. Luo, Z. Xu, and X. Lan, “Laws and regulations tell how to classify your data: A case study on higher education,” Information Processing & Management, vol. 60, art. 103240, 2023, doi: 10.1016/j.ipm.2022.103240.
[23] C. K. Bareh and T. Temjen, “Library privacy framework: Comparative review of data protection laws towards maturity model,” Journal of Librarianship and Information Science, 2025, doi: 10.1177/09610006251372634.
[24] F. Knoke and I. Nwankwo, “Practitioner’s Corner. Managing Data Protection Compliance through Maturity Models: A Primer,” European Data Protection Law Review, vol. 8, no. 4, pp. 536-543, 2022, doi: 10.21552/edpl/2022/4/14.
[25] D. Torre, M. Alferez, G. Soltana, M. Sabetzadeh, and L. Briand, “Modeling data protection and privacy: Application and experience with GDPR,” Software and Systems Modeling, vol. 20, no. 6, pp. 2071-2087, 2021, doi: 10.1007/s10270-021-00935-5.
[26] F. Bélanger and R. E. Crossler, “Privacy in the digital age: A review of information privacy research in information systems,” MIS Quarterly, vol. 35, no. 4, pp. 1017-1041, 2011, doi: 10.2307/41409971.
[27] H. Ajiraga, “Peran dan tanggungjawab Data Protection Officer dalam pelaksanaan perlindungan data pribadi,” Asas Wa Tandhim: Jurnal Hukum, Pendidikan & Sosial Keagamaan, vol. 5, no. 1, pp. 261-290, 2026.
[28] S. Yuniarti, “Petugas/Pejabat pelindungan data pribadi dalam ekosistem perlindungan data pribadi: Indonesia, Uni Eropa dan Singapura,” Jurnal BECOSS, vol. 4, no. 2, pp. 111-120, 2022, doi: 10.21512/becossjournal.v4i2.8377.
[29] H. Nissenbaum, “Privacy as contextual integrity,” Washington Law Review, vol. 79, no. 1, pp. 119-158, 2004.
[30] A. Cavoukian, Privacy by Design: The 7 Foundational Principles. Ontario, Canada: Information and Privacy Commissioner of Ontario, 2011.
[31] M. R. Sanfilippo, N. Apthorpe, K. Brehm, and Y. Shvartzshnaider, “Privacy governance not included: Analysis of third parties in learning management systems,” Information and Learning Sciences, vol. 124, no. 9/10, pp. 326-349, 2023, doi: 10.1108/ILS-04-2023-0033.
[32] C. Mutimukwe, O. Viberg, C. McGrath, and T. Cerratto-Pargman, “Privacy in online proctoring systems in higher education: Stakeholders’ perceptions, awareness and responsibility,” Journal of Computing in Higher Education, vol. 38, pp. 732-761, 2026, doi: 10.1007/s12528-025-09461-5.
[33] M. Francis, M. B. M. Avoseh, K. Card, L. Newland, and K. Streff, “Student privacy and learning analytics: Investigating the application of privacy within a student success information system in higher education,” Journal of Learning Analytics, vol. 10, no. 3, pp. 102-114, 2023, doi: 10.18608/jla.2023.7975.
[34] M. D. Birnhack and G. Mundlak, “The Brussels effect(s) and the rise of a privacy profession,” International Data Privacy Law, vol. 15, no. 2, pp. 138-155, 2025, doi: 10.1093/idpl/ipaf005.
[35] H. M. Naguib, H. M. Kassem, and A. E.-H. M. Abou Naem, “The impact of IT governance and data governance on financial and non-financial performance,” Future Business Journal, vol. 10, art. 15, 2024, doi: 10.1186/s43093-024-00300-0.
[36] H. Ketmaneechairat, M. Maliyaem, and P. Puttawattanakul, “Towards a management system framework for the integration of personal data protection and data governance: A case study of Thai laws and practices,” International Journal of Technology, vol. 15, no. 1, pp. 219-229, 2024, doi: 10.14716/ijtech.v15i1.5885.
[37] J. Fernandes, C. F. Machado, and L. Amaral, “Towards a readiness model derived from critical success factors for the general data protection regulation implementation in higher education institutions,” Strategic Management, vol. 28, no. 1, pp. 004-019, 2023, doi: 10.5937/StraMan2200033F.
[38] C. Negri-Ribalta, M. Lombard-Platet, and C. Salinesi, “Understanding the GDPR from a requirements engineering perspective: A systematic mapping study on regulatory data protection requirements,” Requirements Engineering, vol. 29, pp. 523-549, 2024, doi: 10.1007/s00766-024-00423-4.
[39] J. G. Proudfoot, W. A. Cram, and S. Madnick, “Weathering the storm: Examining how organisations navigate the sea of cybersecurity regulations,” European Journal of Information Systems, vol. 34, no. 3, pp. 436-459, 2025, doi: 10.1080/0960085X.2024.2345867.
[40] Republic of Indonesia, Law No. 27 of 2022 on Personal Data Protection, 2022.
[41] Republic of Indonesia, Government Regulation No. 71 of 2019 on the Implementation of Electronic Systems and Transactions, 2019.
[42] Republic of Indonesia, Law No. 1 of 2024 on the Second Amendment to Law No. 11 of 2008 on Electronic Information and Transactions, 2024.
[43] Ministry of Communication and Informatics of the Republic of Indonesia, Regulation No. 5 of 2020 on Private Electronic System Operators, 2020.
[44] Ministry of Communication and Informatics of the Republic of Indonesia, Regulation No. 10 of 2021 amending Regulation No. 5 of 2020 on Private Electronic System Operators, 2021.
[45] Republic of Indonesia, Presidential Regulation No. 47 of 2023 on National Cybersecurity Strategy and Cyber Crisis Management, 2023.
[46] NIST, NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management, Version 1.0. Gaithersburg, MD: National Institute of Standards and Technology, 2020.
[47] OECD, OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data. Paris: OECD, 2013.
[48] ISO/IEC, ISO/IEC 27001:2022 Information Security, Cybersecurity and Privacy Protection - Information Security Management Systems - Requirements. Geneva: ISO, 2022.
[49] NIST, The NIST Cybersecurity Framework (CSF) 2.0. Gaithersburg, MD: National Institute of Standards and Technology, 2024.
[50] ISACA, COBIT 2019 Framework: Governance and Management Objectives. Schaumburg, IL, USA: ISACA, 2018.
[51] ISO/IEC, ISO/IEC 27701:2025 Information Security, Cybersecurity and Privacy Protection - Privacy Information Management Systems - Requirements and Guidance. Geneva, Switzerland: ISO, 2025.
[52] K. Peffers, T. Tuunanen, M. A. Rothenberger, and S. Chatterjee, “A design science research methodology for information systems research,” Journal of Management Information Systems, vol. 24, no. 3, pp. 45-77, 2007, doi: 10.2753/MIS0742-1222240302.
[53] ISO/IEC, ISO/IEC 27005:2022 Information Security, Cybersecurity and Privacy Protection - Guidance on Managing Information Security Risks. Geneva, Switzerland: ISO, 2022.
[54] Ministry of Education, Culture, Research, and Technology of the Republic of Indonesia, Regulation No. 31 of 2022 on One Data for Education, Culture, Research, and Technology, 2022.
[55] Ministry of Education, Culture, Research, and Technology of the Republic of Indonesia, Regulation No. 53 of 2023 on Quality Assurance of Higher Education, 2023.
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Yudhi Nugroho Adi, Nurwanto Ade Setiawan, Nendi Isharmawan, Muhammad Farrell Alaric Zada, Muharman Lubis
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
