Indonesia - Electronic Systems Regulation (71/2019)

Overview

Peraturan Pemerintah Nomor 71 Tahun 2019 (PP 71/2019) was adopted to update the previous government regulation on electronic systems and transactions and to align implementing rules with modern digital services. The regulation was promulgated in October 2019 and entered into force on 10 October 2019. PP 71/2019 clarifies the legal status of electronic documents and e-signatures, expands the definition of "Penyelenggara Sistem Elektronik (PSE)", and sets cross-cutting obligations for security, governance, transparency and data protection. The official regulation and its metadata are published on the national regulations portal; see the registry entry at peraturan.go.id: PP No.71/2019 and the state legal repository at peraturan.bpk.go.id: PP No.71/2019 (BPK/JDIH).

Definitions

PP 71/2019 sets key definitions used throughout the regulation. Important conceptual terms include: "Electronic System" (a set of electronic devices and procedures to prepare, collect, process, store, display, announce, transmit and/or disseminate electronic information); "Electronic Transaction" (legal acts carried out using computers, computer networks or other electronic media); and "Penyelenggara Sistem Elektronik (PSE)" — which covers any person, state actor, business entity, or community operating an electronic system for itself or for others. The regulation distinguishes PSE in the public scope (government and public service providers) from PSE in the private scope (commercial/private providers), with different operational requirements and obligations. The definition section provides the foundation for obligations such as data protection, system reliability, and cooperation with supervisory and law enforcement agencies.

Governance and Institutional Framework

PP 71/2019 assigns coordinating and implementing roles primarily to the Ministry of Communication and Informatics (Kominfo) and to the National Cyber and Crypto Agency (BSSN). Kominfo is empowered to adopt implementing ministerial regulations (including registration and procedural rules for PSEs) while BSSN provides technical standards and security assessment frameworks; both institutions collaborate in oversight, incident handling, and enforcement. The regulation also references the Information and Electronic Transactions Act and envisages implementing measures by other ministries for sectoral public-scope PSEs. For the official Kominfo implementing instruments and PSE registration rules, see the Kominfo JDIH and Permenkominfo pages such as Permenkominfo No.5/2020 (PSE private scope). BSSN’s role in technical security guidance and assessments is accessible via BSSN (Official).

Key Focus Areas

PP 71/2019 addresses multiple substantive domains: (1) Personal data protection — PSEs must process personal data according to protection principles, secure data against loss, misuse and unauthorised disclosure, and notify data subjects and authorities in the event of data protection failures; (2) System reliability and security — PSEs are required to ensure their electronic systems are reliable, secure (physically and logically) and operate according to specifications; (3) Transparency and user information — PSEs must disclose operator identity, system functionality, user terms, data protection guarantees and complaint channels to users; (4) Registration and oversight — the regulation provides authority for PSE registration (detailed in ministerial rules) and supervisory mechanisms including audit, inspection and compliance review; (5) Access by authorities — PSEs must provide lawful access to systems and data to competent authorities for supervision and legal enforcement under specified conditions; (6) Content moderation and takedown — PSEs are expected to implement processes to remove or disable access to prohibited information upon lawful request; and (7) Cross-border data treatment — PP 71/2019 distinguishes obligations for public-scope and private-scope PSEs, and permits certain cross-border processing while reserving national interests and public-scope localization requirements.

Implementation Framework

The regulation is an enabling (executive) text: many operational requirements are delegated to ministerial regulations (Permenkominfo) and technical standards issued by BSSN. For example, the design and schedule for registration of private-scope PSEs, the form and timing of breach notifications, administrative sanctions, and the procedural rules for temporary suspension are implemented through Permenkominfo instruments such as Permenkominfo No.5/2020 and its amendments. BSSN provides technical security frameworks and readiness assessment instruments (see BSSN Regulation No.8/2020 on protection systems). The PP establishes deadlines and transitional arrangements for PSEs to comply and authorises Kominfo to publish registries and enforce administrative measures.

Monitoring and Evaluation

PP 71/2019 mandates monitoring by Kominfo and by other designated agencies; monitoring activities include registration checks, audits, readiness assessments, incident reporting reviews and compliance verification. BSSN’s technical assessments support monitoring through security index tools and ISO/IEC 27001 readiness checks. The ministerial implementing rules set out reporting standards and periodic review mechanisms; where non-compliance is found, the PP provides for administrative measures. The regulation anticipates coordination with other oversight frameworks, including sectoral regulators (finance, health) where critical or sector-specific systems are concerned.

Penalties, Liability, and Appeals

Enforcement under PP 71/2019 is primarily administrative. Article 100 sets out a graduated set of administrative sanctions that Kominfo (or delegated authorities) may impose: written warnings, administrative fines, temporary suspension of services, disconnection/pemutusan akses, and removal from official registries. The PP makes clear that administrative sanctions do not preclude civil or criminal liability where applicable. Procedural rules for imposition, appeal and challenge are to be further specified by ministerial regulation, and affected parties retain rights to administrative review and judicial remedies under Indonesian administrative law.

Relationship to Other Instruments

PP 71/2019 operates together with the Information and Electronic Transactions Act (UU No.11/2008 and its amendments), and it explicitly replaces PP No.82/2012. The regulation is implemented via Permenkominfo instruments on PSE registration and governance (e.g., Permenkominfo No.5/2020, Permenkominfo revisions), and by BSSN regulations concerning system security and assessments (e.g., BSSN No.8/2020). It also interlocks with sectoral laws (finance, health) and with pending or adopted data protection laws; practitioners must review PP 71/2019 alongside those instruments for complete compliance obligations. The primary legal basis text for information & transactions is available at UU No.11/2008 (peraturan.go.id).

International Alignment

PP 71/2019 reflects international trends in recognising electronic signatures and documents, requiring PSEs to implement safeguards and enabling cross-border data transfers subject to conditions. It differs from strict data-localisation models by permitting private-scope PSE data processing outside Indonesia under transitional and conditional arrangements, while preserving localization for public-scope systems. The PP interacts with international standards by referencing security assessment practices (such as ISO/IEC standards) and by tasking BSSN and Kominfo to align technical and oversight practices with internationally-recognised approaches. For trade, cloud services and cross‑border incident cooperation, PP 71/2019 must be read together with sectoral and international commitments.

Implementation Timeline

Sources and References