Protecting Every Journey Starts with Protecting Your Data

Digital technology has made rail travel easier than ever, from searching schedules and purchasing tickets to making payments and boarding trains. Alongside this growing digital ecosystem, PT Kereta Api Indonesia (Persero) continues to strengthen its information security to ensure customer data remains protected.

The company's initiatives include stronger data protection policies, enhanced system security, stricter access controls, cyber incident management, and greater transparency regarding how customer information is collected and used.

Vice President Corporate Communication KAI Anne Purba explained that the rapid growth of digital services has made responsible data management a key priority. Customer trust is maintained through continuous improvements in security systems, governance, employee competency, and regular evaluations of data protection practices.

According to KAI's 2025 Sustainability Report, digital transformation also brings challenges such as cybersecurity threats, software vulnerabilities, and potential misuse of personal data. As a result, protecting customer information remains a core element of the company's digital service development.

This commitment is reflected in the Privacy Policy available through the Access by KAI application, which provides customers with clear information about the types of data collected, the purpose of data processing, retention periods, and available data deletion procedures.

The initiative also aligns with the spirit of Indonesia's 81st Independence Day theme, "Indonesia Berdaulat, Adil, dan Makmur," where digital sovereignty is increasingly associated with the nation's ability to responsibly manage technology and protect public information.

Digital adoption continues to grow across KAI's services. Between January and June 2026, a total of 5,555,034 long-distance rail passengers used the Face Recognition Boarding Gate, making the boarding process faster and more convenient.

The feature verifies passengers through facial recognition linked directly to their travel tickets, allowing registered users to board without presenting a boarding pass, e-boarding pass, or national identity card.

Anne explained that Face Recognition remains an optional service. Customers who wish to use the feature provide their consent during registration through the Access by KAI application, Check-in Counter machines, or Customer Service officers at stations. Passengers who choose not to register can continue using the existing boarding procedures.

The Face Recognition system uses customer names, National Identity Numbers (NIK), and facial images. According to the 2025 Sustainability Report, this information is securely stored within KAI's infrastructure and is used exclusively to support Face Recognition Boarding Gate operations.

Registration data is retained for one year before being automatically deleted. Customers may also request earlier deletion through the Access by KAI application or by contacting Customer Service at any station.

KAI's digital transformation is also reflected in the continued growth of the Access by KAI application. As of June 30, 2026, the platform had 30,449,049 registered users, 9,058,935 active users, and a cumulative total of 41,011,320 downloads.

During the first half of 2026, Access by KAI processed 17,009,374 Mainline and Local Train ticket transactions, representing 76.34 percent of all ticket purchases through available sales channels.

A total of 24,544,468 Mainline and Local Train passengers also obtained their tickets through Access by KAI during the same period, accounting for 73.68 percent of all passengers purchasing tickets across every sales channel.

Anne noted that the growing adoption of Access by KAI demonstrates how digital services have become an essential part of the customer journey. Beyond ticket purchases, the application allows users to check schedules, modify or cancel bookings, access e-boarding passes, register for Face Recognition, and enjoy various integrated services across the KAI Group ecosystem.

As digital services continue to expand, KAI continues strengthening its information security through the implementation of the internationally recognized ISO 27001 Information Security Management System. The standard provides a comprehensive framework for managing information security risks, controlling data access, and maintaining the confidentiality, integrity, and availability of customer information.

To further enhance cybersecurity readiness, KAI has established a Computer Security Incident Response Team (CSIRT) responsible for coordinating and responding to cyber security incidents.

The company has also appointed a Data Protection Officer (DPO) to oversee data protection policies and ensure compliance with applicable regulations. According to the 2025 Sustainability Report, KAI's information technology governance maturity level has reached approximately Level 3.8.

As part of its ongoing security strategy, KAI regularly performs vulnerability assessments and security testing to identify and address potential weaknesses across its applications and digital infrastructure before they impact services or customer data.

All customer data management practices comply with Indonesia's Personal Data Protection Law (Law No. 27 of 2022) and the company's internal policies. KAI also continues to strengthen employee awareness of information security, access management, and responsible data handling.

Anne concluded that KAI will continue investing in technology, strengthening governance, and enhancing cyber incident preparedness as digital services continue to evolve. For KAI, delivering a seamless travel experience also means ensuring that every piece of customer information is protected with the highest level of care.