PSE in Indonesia: Why Businesses Need It and How It Is Checked by the Regulator

What is PSE

PSE is an acronym for Penyelenggara Sistem Elektronik, which translates to an electronic system operator. This legal status is required for companies and projects that offer digital services to users in Indonesia.

In the business environment, the term 'PSE certificate' is often used. In practice, it is not a security certificate but mandatory state registration of the electronic system operator. This registration is conducted by the Ministry of Communication and Digital Economy of Indonesia (Kominfo).

Registration is done through the OSS RBA platform (Online Single Submission – Risk-Based Approach). It is mandatory for private electronic system operators (PSE Lingkup Privat). These include commercial and public online services.

Types of PSE

Indonesian legislation divides electronic system operators into two types:

  1. PSE Public Scope (Lingkup Publik) includes state and public electronic systems. These are government portals, registries, and official digital platforms.

  2. PSE Private Scope (Lingkup Privat) covers commercial and private services. The majority of business platforms operating through the internet fall into this category.

Who is required to register

PSE registration is mandatory for any electronic platforms available to users in Indonesia that process data or provide digital services. Having an office or legal entity in the country does not matter.

These requirements apply to websites and mobile applications with user accounts, e-commerce platforms and marketplaces, streaming and media services, fintech projects, payment systems, cloud services, and SaaS platforms. Registration is also mandatory for social networks and messengers.

It is sufficient that the service can be used by people from Indonesia.

Why it's important now

  • Indonesia's digital market is growing rapidly. The state is strengthening control over risks and data protection.

  • The Personal Data Protection Law (PDP Law) has raised the requirements for electronic system operators.

  • Lack of PSE registration creates the risk of sudden service disruptions.

  • A company may lose access to the Indonesian market.

  • For businesses, PSE has become a basic requirement for legal operations.

  • For investors, PSE status serves as an indicator of regulatory reliability.

Legal framework

The PSE system relies on several regulatory acts that operate simultaneously.

  1. Government Regulation No. 71/2019 (PP 71/2019) — regulates electronic systems and transactions, determines the obligations of operators, including rules for storing and processing user data.

  2. Permenkominfo No. 10/2021 (formerly Permenkominfo No. 5/2020) — describes the PSE registration procedure, document requirements, and sanctions for non-compliance with the rules.

  3. Law No. 27/2022 (PDP Law) — the Personal Data Protection Law, which is directly related to the PSE system. It fully came into force on October 17, 2024, and increased the responsibility of companies for processing personal data.

What Kominfo checks

The PSE registration procedure is not a technical audit, but the regulator checks several key aspects.

  1. Description of the electronic system. Kominfo requests information on how the service works, what functions it performs, what modules it uses, and where data processing takes place.

  2. Legal status of the operator. The company must confirm the legality of the business. This is usually done using a Business Identification Number (NIB) or a similar document for foreign companies.

  3. Approach to personal data processing. Although PSE registration does not assess the level of cybersecurity, the regulator expects the operator to be ready to comply with the PDP Law requirements, including legal grounds for data processing and user rights.

  4. Place of data storage and processing. The regulator needs to understand whether the servers are located in Indonesia or abroad, as this affects control and access by government authorities.

Sanctions and non-compliance risks

PSE is not a formality but a mandatory legal requirement. Lack of registration creates direct legal and operational risks.

  • Kominfo has the right to temporarily or completely block access to the service for users in Indonesia. In some cases, blocking is possible without prior notice. The regulator also applies administrative measures, including warnings, access restrictions, and other legal actions.

  • Additional difficulties arise when working with partners. Payment providers and financial institutions often require confirmation of PSE status. Its absence may halt market operations.

  • For foreign platforms, the consequences are especially significant. Service blocking leads not only to the loss of users but also to serious reputational risks.

Real examples of blockings

Cases of blockings due to the lack of PSE are already officially confirmed. In June 2025, the Ministry of Communication and Digital Economy of Indonesia (Kominfo) announced the suspension of three international platforms. The reason was the absence of registration as PSE Lingkup Privat.

PT Dunia Luxindo, representing the Bath & Body Works brand, eBay Inc., and the airline KLM Royal Dutch Airlines were affected by the restrictions.

Warnings and risk of blockings

In addition to actual blockings, Kominfo regularly sends warnings to platforms that are not registered or have not updated the data.

The regulator has officially notified at least 36 operators of the risk of blocking due to non-compliance with requirements. In other cases, 25 foreign and local platforms, including Cloudflare, Dropbox, Duolingo, Marriott, and OpenAI with ChatGPT service, received warnings.

All notices explicitly state that ignoring the requirements may result in administrative sanctions, up to a complete blockage of access in Indonesia.

Conclusion

PSE in Indonesia is mandatory state registration of an electronic system operator. It is required for all platforms that offer digital services to Indonesian users or process their data.

PSE is not a security certificate. It is a legal status confirmed by registration in Kominfo through the OSS RBA system. It reduces the risk of blockages, simplifies cooperation with partners, and increases user trust.

Ignoring the requirements may lead to access blockage, administrative sanctions, and reputational losses.

Contact us for details

You may also like