KAI Strengthens Customer Data Security, Implements ISO 27001 and Establishes Cyber Incident Response Team
PT Kereta Api Indonesia (Persero) continues to strengthen the security and confidentiality of customer data as digital-based travel services become increasingly widespread. These efforts include data protection policies, system security, access control, cyber incident response, and providing customers with clear information regarding the use of their data.
Vice President Corporate Communication KAI Anne Purba stated that digitalization has made the travel process easier, from searching schedules, purchasing tickets, making payments, managing trips, to the boarding process. This development must be accompanied by responsible data management.
“Customers entrust KAI with a significant amount of information when using our digital services. We protect that trust by continuously strengthening our systems, governance, employee competencies, and data protection mechanisms,” said Anne.
In its 2025 Sustainability Report, KAI explained that the advancement of digital technology brings cybersecurity risks, software vulnerabilities, and the potential misuse of personal data. Therefore, the security and confidentiality of customer data remain one of the company's top priorities in managing its digital services.
KAI’s customer data protection policy is also outlined in the Privacy Policy section of Access by KAI. This information helps customers understand the types of data collected, the purposes of its use, the data retention period, and the procedures for requesting data deletion.
This initiative aligns with the spirit of the 81st Anniversary of the Independence of the Republic of Indonesia, themed “Indonesia Berdaulat, Adil, dan Makmur” (Sovereign, Just, and Prosperous Indonesia). In the context of economic development and digital services, sovereignty also relates to the nation's ability to manage technology and protect public information responsibly.
Based on KAI’s internal data, from January to June 2026, a total of 5,555,034 Long-Distance Train customers used the Face Recognition Boarding Gate.
This facility simplifies the boarding process by verifying customer identities through facial recognition data linked to their travel tickets. Customers who have registered no longer need to present their boarding pass, e-boarding pass, or identity card to station officers when passing through the Face Recognition Boarding Gate.
The use of Face Recognition is optional. Customers who choose to use this service must provide their consent during registration through Access by KAI, the Check-in Counter machine at stations, or with assistance from Customer Service officers.
“Customer consent is an essential part of the Face Recognition service. Customers who choose not to register their facial data may continue using the other available boarding methods,” Anne explained.
The data used for Face Recognition includes the customer’s name, National Identity Number (NIK), and facial photograph. According to the 2025 Sustainability Report, this data is stored within KAI’s system infrastructure and is used exclusively for the operation of the Face Recognition Boarding Gate.
Face Recognition registration data is stored for one year and is automatically deleted once the retention period expires. Customers may also request earlier deletion of their data through Access by KAI or by submitting a request to Customer Service officers at the station.
The expansion of digital services is also reflected in the growth of Access by KAI. As of June 30, 2026, the application had 30,449,049 registered users, 9,058,935 active users, and a cumulative total of 41,011,320 downloads.
During the first semester of 2026, Access by KAI processed 17,009,374 Mainline and Local Train ticket transactions. This represented 76.34 percent of all ticket transactions through sales channels for these services.
In terms of passenger volume, 24,544,468 Mainline and Local Train customers obtained their tickets through Access by KAI during the January–June 2026 period. This accounted for 73.68 percent of total passengers purchasing tickets through all available sales channels for these services.
According to Anne, the high level of application usage demonstrates that digital services have become an essential part of customers’ travel experience. Access by KAI is currently used to obtain schedule information, purchase and cancel tickets, reschedule trips, access e-boarding passes, register for Face Recognition, and utilize various supporting services within the KAI Group ecosystem.
“As the use of digital services continues to grow, so does KAI’s responsibility to safeguard both its systems and customer data. Service convenience must go hand in hand with security, transparency, and respect for customer rights,” Anne stated.
KAI implements an Information Security Management System that complies with the international ISO 27001 standard. This standard serves as the framework for managing information security risks, controlling data access, and ensuring the confidentiality, integrity, and availability of information.
The company has also strengthened its governance by establishing a Computer Security Incident Response Team (CSIRT). This team is responsible for handling, coordinating, and responding to cybersecurity incidents whenever they occur.
KAI has also appointed a Data Protection Officer (DPO) responsible for overseeing the implementation of data protection policies and ensuring the company’s compliance with data protection regulations. According to the 2025 Sustainability Report, KAI’s information technology governance maturity level has reached approximately level 3.8.
In addition to strengthening its organizational structure, KAI regularly conducts vulnerability assessments and security testing across its systems. These evaluations are designed to identify potential weaknesses in applications and digital infrastructure so they can be addressed before disrupting services or posing risks to customer information.
Customer data management is carried out in accordance with Law Number 27 of 2022 concerning Personal Data Protection, as well as the company’s internal policies. KAI also continuously educates its employees on information security, access management, and their responsibilities in processing customer data.
“KAI will continue strengthening its technology, governance, and incident response capabilities as our digital services continue to evolve. For KAI, protecting our customers’ journeys also means protecting the information they have entrusted to us,” Anne concluded.
VP Corporate Communication KAI