Indonesia - Electronic Transactions Law (1/2024)

Overview

The Second Amendment (Undang-Undang Nomor 1 Tahun 2024) updates the Indonesian Electronic Information and Transactions framework to improve legal clarity and operational governance in digital spaces. Enacted on 2 January 2024, the amendment adds seven new articles and expressly recognizes a set of electronic certification services (electronic signatures, seals, time stamps, authenticated delivery, website authentication, preservation, and digital identity). It also imposes specific child protection duties on Penyelenggara Sistem Elektronik (PSE). The law establishes administrative sanctions for PSE non-compliance (written warnings, administrative fines, temporary suspension, and discontinuation of access) and retains criminal liability provisions subject to later constitutional interpretation. Official text and explanatory notes are published on government legal information portals, for example the Ministry JDIH and the national legal repository. See the official registry at JDIH Ministry of Communication and Informatics and the national regulation database at Peraturan BPK (Regulatory Database).

Definitions

The Act preserves core definitions from the 2008 law ("Electronic Information", "Electronic Documents", "Electronic Systems", "Electronic Signatures", "Penyelenggara Sistem Elektronik/PSE") and adds defined scope around "Penyelenggara Sertifikasi Elektronik" (Electronic Certification Service Providers) and child-protection related terms (e.g., "child user", "minimum age"). The new Article 13A enumerates certificate-based services (electronic signature, electronic seal, time-stamping, registered electronic delivery, website authentication, preservation of signatures/seals, digital identity services, and other certificate services). Definitions remain primarily functional rather than highly technical to preserve legal adaptability to technology changes.

Governance and Institutional Framework

Regulatory oversight and operational governance remain centered on the Ministry of Communication and Informatics (Kementerian Komunikasi dan Informatika). The Act delegates implementation detail and administrative enforcement to the Government and Ministerial regulations; implementing measures and registration frameworks are expected from KOMINFO and related agencies. The law indicates publication in the State Gazette (Lembaran Negara) and places implementing guidance on official JDIH nodes such as the Secretariat-General of the DPR and KOMINFO’s JDIH. See the DPR and KOMINFO registry entries: DPR JDIH listing and Kominfo JDIH page. The Constitutional Court (Mahkamah Konstitusi) sits as the final interpreter of constitutionality and has issued decisions refining the Act’s application; see MK press release 29 April 2025. Inter-agency coordination (Justice, Law Enforcement, Children’s Welfare agencies, and sectoral regulators for finance and health) is expected for cross-cutting enforcement.

Key Focus Areas

The amendment targets several interlocking policy priorities: clarifying electronic trust services; strengthening protections for children online; refining liability and delictal scope for reputational harm and content that disturbs public order; and creating a proportional administrative enforcement ladder against PSEs. The Act responds to practical issues observed under the 2008/2016 texts where terms and enforcement led to legal uncertainty. For electronic trust, Article 13A lists services under certification providers and opens a legal basis for recognized electronic signatures and digital identity frameworks (a necessary step for e-government, e-commerce, and cross-border digital transactions). For children, Articles 16A–16B require PSEs to provide minimum-age information, verification mechanisms, and abuse reporting channels — measures intended to reduce exposure and harm. The Act’s enforcement architecture prioritizes administrative sanctions against PSEs while preserving criminal sanctions for certain intentional offenses, though the Constitutional Court later narrowed some applications of those criminal provisions (see Putusan MK Nomor 105/PUU-XXII/2024 and 115/PUU-XXII/2024 on 29 April 2025). The law also contemplates preservation, time-stamping, and authenticated delivery services to support evidentiary certainty in electronic transactions.

Implementation Framework

Implementation depends on follow-on Government and Ministerial regulations that detail registration/notification requirements, technical standards for certification services, child-protection implementation guidelines, reporting formats, and administrative sanction procedures. The Act itself sets the policy and legal baseline; operationalization includes (a) registration/recognition of Electronic Certification Service Providers, (b) KOMINFO-issued rules for PSE obligations and complaint processes, (c) sector-specific interoperability and data handling rules (e.g., finance and health), and (d) enforcement protocols for issuing written warnings, levying administrative fines, ordering temporary suspensions, or directing termination of access. Developers and PSE operators should monitor KOMINFO JDIH entries and Peraturan Pemerintah/Peraturan Menteri that implement the Act (see Kominfo 2024 inventory).

Monitoring and Evaluation

The Act establishes a statutory basis for administrative oversight and requires ministry-level monitoring of compliance. Metrics for evaluation will include the number of registered electronic certification providers, PSE compliance rates with child-protection measures, number and type of administrative sanctions issued, and trend data on ITE-related complaints. The implementing regulations are expected to specify reporting frequency, data to be collected, and indicators for performance. The DPR and sectoral oversight bodies may require periodic reporting on the law’s implementation and impacts on free expression, child safety, and market activity.

Penalties, Liability, and Appeals

UU No. 1/2024 sets administrative sanctions specifically targeted at PSE non-compliance (written warnings, administrative fines, temporary suspension, and termination of access) and preserves criminal liability for certain offenses originating from the 2008/2016 framework. However, the Constitutional Court’s April 29, 2025 decisions narrowed certain wordings: it limited the criminalization of digital "kerusuhan" (commotion) and restricted defamation-type applications so only natural persons (not institutions or organizations) may be complainants in certain offenses. Appeals from administrative sanctions follow the administrative/administrative-judicial procedures outlined by implementing regulations and general administrative law. Criminal prosecutions remain subject to ordinary criminal procedure and constitutional case law emerging from MK rulings (see Peraturan BPK summary and MK press release).

Relationship to Other Instruments

UU No. 1/2024 amends and sits alongside Undang-Undang Nomor 11 Tahun 2008 (original ITE) and Undang-Undang Nomor 19 Tahun 2016 (first amendment). It interacts with: electronic signature regulations, sectoral data protection rules, child-protection statutes, criminal law (KUHP), and government/ministerial regulations that establish technical and operational standards. Subsequent Peraturan Pemerintah (Government Regulations) and Peraturan Menteri (Ministerial Regulations) are expected to implement specific obligations introduced by the Act. Official databases that index the relationship include the DPR and KOMINFO JDIH repositories and the national law register at Peraturan BPK (DPR JDIH and Peraturan BPK).

International Alignment

The Act’s recognition of electronic certification services and digital identity aligns Indonesia’s legal framework with international norms on electronic trust services and e-signatures (comparable in intent to UNCITRAL e-commerce principles and many national e-signature laws), while child-protection obligations reflect global policy trends for platform responsibility. Cross-border interoperability, mutual recognition of electronic signatures, and data transfer considerations will depend on future implementing rules and international agreements. Stakeholders engaged in cross-border services should monitor KOMINFO guidance and bilateral frameworks for digital certificates and identity recognition.

Implementation Timeline

Sources and References