Indonesia: technology regulation at a glance

Framework: OJK Regulation No. 27 of 2024 (as amended by POJK No. 23 of 2025) on Trading of Digital Financial Assets Including Crypto Assets; Government Regulation No. 49 of 2024 (transfer of authority from Bappebti to OJK/Bank Indonesia); Law No. 4 of 2023 on the Development and Strengthening of the Financial Sector (P2SK Law); Law No. 7 of 2011 on Currency (rupiah as sole legal tender); Ministry of Finance Regulation (PMK) No. 50 of 2025 on crypto taxation.

Crypto assets are legal to trade and hold as 'digital financial assets' but are prohibited as a means of payment under Indonesia's Currency Law, which reserves that role for the rupiah. Since 10 January 2025, the Financial Services Authority (OJK) has taken over primary regulatory and supervisory authority from Bappebti (commodity futures agency) under Government Regulation 49/2024, operating a comprehensive licensing regime for exchanges, custodians and traders (POJK 27/2024, amended by POJK 23/2025 in December 2025). Bank Indonesia retains authority over payment/monetary aspects and is developing a digital rupiah with stablecoin-like features.

Framework: Kominfo/Komdigi Circular Letter No. 9 of 2023 on AI Ethics (Surat Edaran No. 9/2023); National AI Strategy (Stranas KA) 2020–2045; sectoral guidance (OJK AI Governance for Banking, April 2025); two draft Presidential Regulations (Perpres) on AI Ethics and the National AI Roadmap pending presidential signature

Indonesia has no comprehensive, binding AI-specific statute. Governance rests on non-binding instruments: the Ministry of Communication and Digital Affairs' (Komdigi, formerly Kominfo) Circular Letter No. 9/2023 on AI Ethics, the 2020–2045 National AI Strategy (Stranas KA), and sectoral supervisory guidance (notably OJK's April 2025 AI Governance guidance for banks), backed by cross-cutting laws such as the Personal Data Protection Law (UU PDP) and the ITE Law. As of September 2026, two draft Presidential Regulations (a national AI roadmap and an AI ethics framework) have been finalized by Komdigi and are awaiting President Prabowo Subianto's signature.

Framework: Law No. 27 of 2022 on Personal Data Protection (PDP Law), as amended by Law No. 1 of 2026, with Government Regulation No. 33 of 2026 as the primary implementing regulation.

Indonesia has a comprehensive, GDPR-inspired personal data protection regime under Law No. 27 of 2022, which took effect on 17 October 2022 with a two-year transition period that expired on 17 October 2024. Government Regulation No. 33 of 2026, issued on 16 July 2026 and taking effect 16 January 2027, provides detailed implementing rules on data subject rights, controller/processor obligations, DPIAs, DPOs, breach notification, cross-border transfers and sanctions. The dedicated independent Personal Data Protection Authority (Lembaga PDP) mandated by the law has not yet been formally established; supervision and enforcement are handled on an interim basis by the Ministry of Communication and Digital Affairs (Komdigi).

Framework: Dual-regulator regime: Bank Indonesia (payments/e-money) under PBI 23/6/PBI/2021 on Payment Service Providers (to be superseded by PBI 10/2025 effective 31 March 2026) and PBI 20/6/PBI/2018 on Electronic Money; Otoritas Jasa Keuangan (OJK) supervises fintech lending under POJK 40/2024 and BNPL under POJK 32/2025.

Indonesia operates a mature, dedicated licensing regime for digital payments and fintech split between Bank Indonesia (BI) — which licenses Payment Service Providers (PJPs), Payment System Infrastructure Operators (PIPs), and e-money issuers — and OJK, which authorises P2P lending platforms, BNPL providers, and other non-bank financial services. A comprehensive rewrite (BI Regulation 10/2025 issued 24 December 2025, effective 31 March 2026) consolidates the payment-system rules and introduces the TIKMI risk-based classification framework. Instant payments run via BI-FAST and QRIS, and open-banking APIs are standardised under BI's SNAP framework.

Framework: Remote Worker Visa (index E33G / 'Visa Rumah Kedua Pekerja Jarak Jauh') administered by the Directorate General of Immigration (Direktorat Jenderal Imigrasi), Ministry of Immigration and Corrections, under Indonesia's immigration law framework; complemented by the Second Home Visa (E33E) and the Golden Visa (E28 series) for investors.

Indonesia has a dedicated remote-worker route: the E33G KITAS, launched 1 April 2024, is a one-year, multiple-entry stay permit expressly for foreigners employed by an overseas company, requiring at least USD 60,000 annual foreign-source income and no local employer sponsor. Alongside it, the Second Home Visa (5- or 10-year) and the Golden Visa (E28 investor categories) provide longer-term residency by deposit, property, or investment. Freelancers and sole traders remain awkwardly served — there is no dedicated freelance KITAS, and self-employed foreigners typically must incorporate a PT PMA to work legally onshore.

Framework: Law No. 11/2008 on Electronic Information and Transactions (UU ITE), as amended by Law No. 19/2016 and Law No. 1/2024; Ministerial Regulation (Kominfo/Komdigi) No. 5/2020 (MR5) on Private Electronic System Operators; and Government Regulation No. 17/2025 (PP Tunas) on Child Protection in Electronic Systems. Regulator: Ministry of Communication and Digital Affairs (Komdigi, formerly Kominfo).

Indonesia has a comprehensive, multi-layered online-content regime centred on the ITE Law (twice amended, most recently by Law No. 1/2024), MR5 (2020) requiring platform registration and rapid takedowns, and PP Tunas (2025), which entered force in April 2025 with child-safety obligations for high-risk platforms taking effect on 28 March 2026. The regime is broad and restrictive: Komdigi can order takedowns within 4 hours (urgent) or 24 hours (other 'prohibited' content) via the SAMAN system, block non-registered platforms, and pursue criminal penalties under UU ITE for defamation, hate speech, and 'immoral' content. Freedom House classifies Indonesia's internet as 'Partly Free', reflecting significant state content control alongside the formal legal framework.

Framework: No single overarching cybersecurity statute; obligations arise from a mosaic of laws and regulations: Law No. 11/2008 as amended (Electronic Information and Transactions / ITE Law), Government Regulation 71/2019 on Electronic Systems and Transactions, Law No. 27/2022 on Personal Data Protection (breach-notification obligations), Presidential Regulation 82/2022 on Vital Information Infrastructure Protection, BSSN Regulation 1/2024 (cyber incident management) and 2/2024 (cyber crisis management), and sector rules such as OJK regulations for financial services. The National Cyber and Crypto Agency (Badan Siber dan Sandi Negara — BSSN) is the lead cyber authority. A draft Cybersecurity and Cyber Resilience Bill (RUU KKS) remains pending in the DPR (2025/2026 Prolegnas).

Indonesia does not yet have a single, comprehensive cybersecurity law. Cybersecurity obligations are drawn from the ITE Law, GR 71/2019, the 2022 PDP Law, the 2022 Vital Information Infrastructure Perpres, BSSN's 2024 incident- and crisis-management regulations, and sector-specific supervisory rules (notably OJK for finance). A dedicated Cybersecurity and Cyber Resilience Bill (RUU KKS), first tabled in 2019 and re-finalised by the Law Ministry in October 2025, sits in the 2025/2026 legislative agenda but has not been enacted.

Framework: Law No. 25/2007 on Capital Investment and Law No. 6/2023 (Job Creation) implemented via Presidential Regulation 10/2021 (Positive Investment List, as amended by Perpres 49/2021) and BKPM Regulation No. 5 of 2025; business registration is handled by BKPM through the risk-based Online Single Submission system (OSS-RBA) at oss.go.id.

Indonesia allows foreigners to fully own a local limited-liability company (PT PMA) in most sectors under the Positive Investment List, and the OSS-RBA portal has streamlined licensing since 2021. However, setup remains moderately complex for foreigners: a notarized deed with at least two shareholders, one director and one commissioner, a physical Indonesian address, and a paid-up capital of IDR 2.5 billion (~USD 150,000) are required, with an overall timeline typically of several weeks plus ongoing LKPM reporting.