Data Privacy

BTN recognizes that personal data protection is a fundamental human right, rooted in the 1945 Constitution of the Republic of Indonesia and Law No. 27 of 2022 on Personal Data Protection

BTN is fully committed to fulfilling its responsibilities as a personal data controller and/or processor by prioritizing your personal data protection through comprehensive policies, frameworks, and bank-wide personal data protection programs. This commitment spans the entire data lifecycle—from collection to deletion—while upholding your rights as a Personal Data Subject.

BTN has established a Data Privacy Department serving as the Personal Data Protection Officer within the Compliance Work Unit, under the Directorate of Human Capital, Compliance & Legal. This department is actively supervised by the Board of Directors through the Information Technology Steering Committee (KPTI), the Risk Management Committee, and the Personal Data Protection Implementation Project Steering Committee. The Data Privacy Department plays a critical role in developing frameworks, policies, and executing personal data protection programs. To ensure the holistic implementation of personal data protection controls across the bank, the department regularly coordinates with relevant work units, including:

• IT Security Unit: Ensuring the security of processed personal data to reduce cybersecurity risks and personal data protection failures.
• IT Development Unit: Implementing personal data protection regulations across all BTN applications and websites.
• Data Management Unit: Ensuring data processing follows the principles of data minimization and applying data privacy by design.
• Customer Service Unit: Safeguarding the fulfillment of Personal Data Subjects' rights and addressing personal data-related inquiries.
• Risk Management and Legal Unit: Mitigating risks associated with BTN's personal data processing activities.
• Business Unit: Ensuring the integration of personal data protection regulations across all BTN products and services.

BTN actively conducts awareness programs for all employees regarding personal data protection, including:

• Socialization, Internalization, and Training: Regular training and socialization efforts to build awareness of personal data protection through various media channels, mandatory for all BTN employees. The internalization of personal data protection policies is ensured throughout all business lines.

• Workshops:Facilitating workshops to apply personal data protection controls in line with established frameworks and applicable regulations.

In 2025, BTN plans to adopt a personal data protection curriculum as part of our commitment to comprehensively understanding and complying with personal data protection laws.

BTN has implemented a personal data protection framework aligned with relevant regulations and best practices, as outlined in the following policy documents:

1. Personal Data Protection Policy No. KK.6-K: Covers end-to-end personal data protection aspects.
2. Customer and Community Protection Policy No. KK.9-Z: Regulates customer protection in accordance with POJK No. 22 of 2023 on Consumer and Community Protection.

According to these policies, all Personal Data Subjects (including customers, prospective customers, employees, prospective employees, third parties, and other individuals) interacting with BTN must provide consent for personal data processing. BTN also enables Personal Data Subjects to exercise their rights, including access, modification, correction of personal data, and revocation of consent, as long as it does not conflict with applicable regulations.

For personal data processing conducted by BTN or external parties, BTN enforces control measures such as Records of Personal Data Processing Activities (ROPA), Data Protection Impact Assessments (DPIA), Non-Disclosure Agreements (NDA), Strongly protective contracts and agreements, and oversight in the processing of Personal Data Subjects' personal data related to BTN.

The deletion and destruction of personal data will be carried out by BTN once the data has surpassed the retention period, in accordance with internal and external regulations, including applicable laws and regulatory requirements.

To promote transparency, BTN provides Personal Data Subjects with information about the types of personal data collected, processing durations, and purposes through the published privacy policy accessible at www.btn.co.id/privacy-policy, and other BTN digital platforms.

BTN will not sell, provide, or rent Personal Data belonging to Personal Data Subjects associated with BTN, except for transaction processing, financial service provision, regulatory reporting, legal enforcement requests, and other exceptions as permitted by applicable laws. We strive to minimize processed personal data as much as possible, in compliance with relevant regulations.