Cybersecurity Guidelines for FSTI Providers
e. Operational Data Retention Period:
Log System:
Project Documentation: Retain for the duration of the project + 3 years.
Retain for 1 year.
Conditions: - Ensure operational data is retained long enough to support business continuity and disaster recovery efforts. - Regularly review and update retention policies according to the changes in the applicable regulations in Indonesia.
In addition to the data retention reference above, the following are recommended best practices for FSTI Providers:
- Conduct periodic risk assessments to evaluate if retention periods need to be extended based on emerging risks. - Implement data minimisation techniques to only collect and retain necessary data. - For Innovative Credit Scoring (ICS) providers, anonymise non-financial data used in credit models after the retention period. - For InsurTech providers, consult industry-specific data retention regulations.
34
Made with FlippingBook. PDF to flipbook with ease