Key Changes at a Glance
On October 10, 2024, Indonesia's Ministry of Communication and Information Technology issued Regulation No. 5 of 2024, introducing significant changes to the regulatory landscape for foreign technology companies operating in Indonesia.
The new regulation introduces three primary areas of reform:
- Mandatory local data processing requirements for certain categories of personal data
- Enhanced licensing requirements for foreign digital platform operators
- A foreign ownership review mechanism for acquisitions of Indonesian tech companies above certain thresholds
This regulation signals Indonesia's intent to assert greater sovereignty over its digital economy while remaining open to foreign investment — a delicate balance that will require careful navigation.
Implications for Foreign Investors
For foreign investors and technology companies, the regulation introduces both challenges and opportunities. On one hand, the enhanced licensing requirements create additional compliance burdens. On the other, the clearer regulatory framework provides greater certainty for long-term investment planning.
Data Localization
The expanded data localization requirements now cover financial data, health information, and strategic electronic system data — categories that were previously exempt.
M&A Review Mechanism
Regulation No. 5 introduces a mandatory notification requirement for acquisitions exceeding IDR 500 billion (~US$32 million) involving strategic electronic system operators. Kominfo has 90 business days to review, with the ability to impose conditions or block transactions.
Recommended Next Steps
- Conduct a comprehensive data mapping exercise
- Review existing and planned M&A transactions for notification triggers
- Engage with Kominfo through the pre-consultation mechanism