Indonesia

Law 27 of 2022 applies to processing inside Indonesia and to processing outside Indonesia that has legal consequences in Indonesia or for Indonesian data subjects, and it obliges controllers and processors established outside the country to appoint a representative in Indonesia. Separately, the electronic-systems rules require private electronic system operators serving Indonesian users to register; the ministry runs a public registration portal for this and the standard sanction for non-registration is access blocking. Article-level references for the privacy law are carried at medium confidence because the official statute databases refused automated fetching on 18 August 2026 (see 'unconfirmed').

Sector by sector, on the evidence found today: banking — closed unless the Financial Services Authority grants a licence to place systems abroad (Regulation 11/POJK.03/2022, article 35); payments — closed, with initiation, authorisation, clearing and settlement to be processed domestically and the systems placed in Indonesian data centres and disaster recovery centres, offshore processing only with Bank Indonesia approval (Regulation 23/6/PBI/2021, article 48); insurance, finance companies, pension funds and other non-bank financial institutions — closed unless the Financial Services Authority approves (Regulation 4/POJK.05/2021, article 23); health — electronic medical records may only be stored with an electronic system operator that has data storage facilities in the country (Minister of Health Regulation 24 of 2022, article 22); government and public-sector systems — localised under the electronic systems regulation (Government Regulation 71 of 2019, article 20), carried at medium confidence; mapping and geospatial data — a storage-in-Indonesia rule is understood to sit in the geospatial law, carried at low confidence and listed in 'unconfirmed'; telecoms — no rule verified today, checked 18 August 2026, confidence low. Crypto and digital financial asset trading moved under the Financial Services Authority's rulebook with effect from 1 September 2026, so its infrastructure requirements should be re-checked then.

The general law offers three routes in order: an equivalent level of protection in the destination country; failing that, adequate and binding safeguards; failing that, the data subject's consent. No government adequacy list and no official standard contractual clauses were found on any Indonesian government domain on 18 August 2026, so in practice the exporter self-assesses. The banking rule is explicit that offshore placement of electronic systems requires an OJK licence, and that OJK will grant or refuse it 'paling lama 3 (tiga) bulan setelah seluruh persyaratan dipenuhi' — at the latest three months after all requirements are met. Payments and non-bank finance use the same approval logic with Bank Indonesia and OJK respectively.

Rated waking rather than active. Observable evidence of activity: the Financial Services Authority's own regulation database lists Rule 3 of 2026 on digital financial asset and crypto trading (set 30 June 2026, effective 1 September 2026), Regulation 8 of 2026 on peer-to-peer lending transaction data reporting, and Regulation 9 of 2026 on incidental reporting in the capital markets, derivatives and carbon exchange sectors (set and effective 31 July 2026). By contrast, no official page for a dedicated personal data protection authority could be located, and the ministry's own news pages could not be read by an automated fetcher. We are explicitly not asserting that the body does not exist — only that we could not verify that it does, checked 18 August 2026.

Verified today: Minister of Health Regulation 24 of 2022, article 39(1) — storage of the electronic medical record at the health facility for at least 25 years from the date of the patient's last visit. The same regulation, article 28, requires facilities to open the entire electronic medical record to the Ministry of Health. Financial-sector record-keeping periods, the ten-year company document rule and tax bookkeeping periods were not re-verified against a government source on this run and are therefore not asserted here; see 'unconfirmed'. The privacy law's erasure duty is carried at medium confidence for the same reason.

Verified today: Regulation 11/POJK.03/2022, article 60(1) — 'notifikasi awal paling lama 24 (dua puluh empat) jam setelah insiden TI diketahui' and an incident report 'paling lama 5 (lima) hari kerja setelah insiden TI diketahui'. Regulation 4/POJK.05/2021, article 31(2) — non-bank financial institutions must report critical incidents, misuse or crime to OJK at the latest five working days after becoming aware. The 72-hour privacy-law deadline (three times 24 hours, to the data subject and to the supervisory body) is carried at medium confidence because the statute text could not be machine-read on this run. Cyber incident reporting duties to the national cyber agency were not verified today — its site refused the automated request.

Trap 1 and 2 are verified from the regulators' own texts. Trap 4: Law 27 of 2022 creates criminal offences for unlawfully obtaining, disclosing or using another person's personal data, with prison terms and fines, and corporate offenders face multiplied fines; the exact terms are carried at medium confidence because the statute could not be machine-read today. Trap 5 combines the representative duty in the privacy law with the electronic system operator registration regime the ministry runs. A sixth to watch: the payments rule bites on the transaction flow itself, not only on stored records — initiation, authorisation, clearing and settlement must happen domestically, which catches architectures that route authorisation through a regional hub.

Dormant switches, which matter more than pending bills. First, the electronic systems regulation lets the government treat categories of operators as public-scope, which pulls them into the keep-it-in-Indonesia rule; that classification can be changed administratively. Second, the financial approvals for offshore data centres are permissions, not rights — they can be refused, conditioned or withdrawn by the regulator. Third, the privacy law's supervisory body can be constituted by presidential regulation at any time, which would switch on an enforcement channel that is presently invisible. Fourth, the ministry's power to order access blocking for unregistered electronic services can be exercised quickly and has been used against large platforms in the past.