On 1 April 2026, the Minister of Communication and Digital Affairs of Indonesia and the Minister of Science and Information and Communications Technology of Korea signed the Memorandum of Understanding (MoU) on strengthening data security and developing Artificial Intelligence (AI). The MoU applies to digital service providers and commits the two governments to developing next-generation communications infrastructure and strengthening data security and digital literacy. It also focuses on deploying AI in strategic sectors, including education, health, and agriculture, supported by high-performance computing.
On 6 March 2026, the Minister of Communication and Digital adopted the Regulation on Child Protection in Electronic Systems, which introduces safety-by-design requirements for electronic system operators. The regulation requires operators to implement child protection design measures to ensure that content, features, and services accessible to children correspond to their age range and developmental stage. Under Article 29, operators that require user registration must provide technology that enables parents or guardians to supervise a child’s activities through the child’s account. The regulation also establishes account creation conditions. Children under 13 may access only products specifically designed for children with a low-risk profile and subject to parental consent; children aged 13 to 16 may access low-risk products with parental consent; and children aged 16 to 18 may access products subject to parental consent. Operators must present these requirements in language that is accessible to both children and guardians. Where a product enables interaction with unknown individuals, operators must provide parental control tools that allow guardians to grant or withhold consent for such interactions. Where risk levels change due to technical modifications, operators are required to reassess their designs in line with safety-by-design and privacy-by-design principles. The Ministry, including the Director General acting on its behalf, oversees compliance with these obligations through monitoring activities and conducting preliminary and follow-up examinations of electronic systems. Where an operator is found to be in breach following examination, the Director General may issue written warnings and administrative fines, while the Minister may impose temporary suspension and/or access termination, and may delegate these powers to the Director General. Operators may challenge a sanction by submitting a written objection within 21 days of receiving the decision or its publication on the Ministry’s official website. The authority must resolve the objection within 20 days, if no decision is issued within this period, the objection is deemed accepted.
On 4 October 2025, Indonesia’s Ministry of Communication and Digital Affairs (Komdigi) lifted the temporary suspension of TikTok's electronic system provider registration, after the company submitted the requested data on traffic escalation and TikTok live monetisation for 25–30 August 2025. The submitted data included daily recaps of traffic, monetisation volumes, and indications of violations. Komdigi confirmed that TikTok had met its obligations under national law, reinstating its registered status and allowing normal platform operations.
On 3 October 2025, Indonesia’s Ministry of Communication and Digital (Komdigi) temporarily suspended TikTok's electronic system provider registration certificate for failing to provide requested data on live streaming, traffic, and monetisation, including activities linked to online gambling. TikTok only submitted partial data for 25–30 August 2025 and cited internal policies as the reason for refusing full disclosure. The action, under Article 21(1) of Ministerial Regulation No. 5 of 2020, obliges private electronic system providers to grant government access for supervision.
On 29 September 2025, the Indonesian Competition Commission (KPPU) imposed an administrative fine of IDR 15 billion on TikTok Nusantara (SG) Pte. Ltd. for failing to submit a timely notification regarding its acquisition of a 75.01 per cent ownership interest in PT Tokopedia, with the remaining 24.99 per cent retained by PT GoTo Gojek Tokopedia Tbk. The transaction became legally effective on 31 January 2024, setting a statutory deadline of 19 March 2024 for notification to KPPU. As the designated acquiring entity, TikTok Nusantara (SG) Pte. Ltd. did not fulfil this obligation, prompting KPPU to annul an earlier submission by TikTok Pte. Ltd. on 7 August 2024 and to open an investigation the following day. The Commission found an 88-working-day delay in notification. After a hearing at KPPU Headquarters in Jakarta, and taking into account the company’s cooperation and absence of prior violations, KPPU ordered payment of the fine within 30 days after the decision becomes legally binding.
On 26 August 2025, a lawsuit relating to the constitutionality of cross-border data transfers without public consent or parliamentary approval was filed at the Constitutional Court. The appellant challenged Article 56 of the 2022 Personal Data Protection Law. Article 56 of the Law regulates the transfer of personal data outside of Indonesia, permitting such transfers only if the destination country offers an equivalent or higher level of data protection, the data controller provides binding and adequate safeguards, or the data subject provides consent. The Law also requires data controllers to ensure that these conditions are met before allowing personal data to be transferred abroad. The appellant argued that allowing cross-border data transfers without public consent or parliamentary approval violates constitutional rights under the Constitution of Indonesia, specifically Article 28G (1), which guarantees the right to personal protection, and Article 1(2), which affirms that sovereignty belongs to the people. The appellant highlighted past data leaks, risks linked to artificial intelligence, and transfers to the United States that could increase the chances of loss of sovereignty. The appellant requested the Court to reinterpret the law to require either the consent of the data subject or an international agreement ratified by Parliament.
On 22 August 2025, Indonesia's Ministry of Communication and Digital Affairs closes the consultation on the Artificial Intelligence (AI) ethics guidelines. The guidelines apply to all AI developers, adopters, and users across sectors, introducing governance structures with role-specific responsibilities for policymakers, developers, and users. The guidelines establish safeguards against algorithmic bias and disinformation, mandatory self-assessment requirements, incident reporting mechanisms, sectoral monitoring systems, and a voluntary validation scheme for compliant organisations. The guidelines also propose creating a National AI Coordination Task Force for implementation oversight.
On 22 August 2025, Indonesia's Ministry of Communication and Digital Affairs closes the consultation on the National Artificial Intelligence (AI) Roadmap that establishes the country's AI strategy through 2045. The roadmap applies to all AI stakeholders across Indonesia's economy, including developers, users, government agencies, private companies, academic institutions, and civil society groups. It introduces a seven-aspect framework covering policy, ethics, talent development, infrastructure and data, industrial research and innovation, investment and financing, and use case development. The roadmap covers ten priority sectors, including food security, health, education, economy and finance, and bureaucratic reform.
On 14 August 2025, the Ministry of Communication and Digital Affairs (KOMDIGI) requested Roblox, a registered Electronic System Provider (PSE) since 2022, to enhance its platform’s systems to comply with Indonesian child protection regulations. The request follows growing concerns from parents and educators about children’s exposure to inappropriate content and interactions on the platform. KOMDIGI asked Roblox to implement measures such as limiting communication between child users, filtering vulgar user-generated content, and clarifying parental control features. The Ministry noted that these steps aim to strengthen safeguards for Indonesian children in the digital environment and indicated that Roblox will undergo regular evaluations to ensure continued compliance with applicable regulations.
On 8 August 2025, Indonesia's Ministry of Communication and Digital Affairs opened a consultation on the Artificial Intelligence (AI) ethics guidelines, until 22 August 2025. The guidelines apply to all AI developers, adopters, and users across sectors, introducing governance structures with role-specific responsibilities for policymakers, developers, and users. The guidelines establish safeguards against algorithmic bias and disinformation, mandatory self-assessment requirements, incident reporting mechanisms, sectoral monitoring systems, and a voluntary validation scheme for compliant organisations. The guidelines also propose creating a National AI Coordination Task Force for implementation oversight.
On 8 August 2025, Indonesia's Ministry of Communication and Digital Affairs opened a consultation on the National Artificial Intelligence (AI) Roadmap that establishes the country's AI strategy through 2045, until 22 August 2025. The roadmap applies to all AI stakeholders across Indonesia's economy, including developers, users, government agencies, private companies, academic institutions, and civil society groups. It introduces a seven-aspect framework covering policy, ethics, talent development, infrastructure and data, industrial research and innovation, investment and financing, and use case development. The roadmap covers ten priority sectors, including food security, health, education, economy and finance, and bureaucratic reform.
On 5 August 2025, the lawsuit challenging the criminalisation of personal data disclosure and its impact on freedom of expression was filed at the constitutional court. The lawsuit was filed by the Freedom of Information and Personal Data coalition. The coalition included academics, journalists, and civil society groups. The lawsuit challenged Articles 65(2) and 67(2) of the law, which criminalise disclosing personal data. Article 65 focuses on prohibiting the unlawful collection or obtaining of personal data for personal benefit, while Article 67 details the criminal penalties for various unlawful data-related activities, including the act described in Article 65. The lawsuit argued these provisions could silence journalism and legitimate public expression. The lawsuit requested the Court to exempt journalistic, academic, artistic, and literary work, as well as disclosures serving the right to information, to safeguard freedom of expression.
On 30 July 2025, the Constitutional Court of the Republic of Indonesia issued Decision Number 151/PUU-XXII/2024 on the judicial review of Article 53 paragraph (1) of Law Number 27 of 2022 on Personal Data Protection (PDP Law), granting the petitioners’ request in full. The Court declared that the use of the word “and” linking the criteria in points (a), (b), and (c) constitutes a cumulative formulation that narrows the obligation for personal data controllers and processors to appoint a Personal Data Protection Officer (PPDP), thereby limiting protection for high-risk personal data processing activities. The Court held that the criteria must be interpreted as independent, in line with the intent of the legislator and the principle of proportional risk-based protection under Article 34 paragraph (2) of the PDP Law. It concluded that the correct formulation is a cumulative alternative using “and/or”, as stipulated in legislative drafting guidance under Annex II of Law Number 12 of 2011. The Court ruled the word “and” unconstitutional and declared it conditionally non-binding unless interpreted as “and/or”, thereby affirming that any single criterion in points (a), (b), or (c) of Article 53 paragraph (1) is sufficient to require the appointment of a PPDP under the PDP Law.
On 22 July 2025, the White House issued a framework for the United States - Indonesia Agreement on reciprocal trade, including digital trade, services, and investment. The Agreement applies to cross-border digital trade and service providers. The statement includes a reference to a commitment supporting a permanent World Trade Organisation (WTO) moratorium on customs duties for electronic transmissions.
On 22 July 2025, the Indonesian Competition Commission (KPPU) announced an investigation into TikTok’s alleged delay in notification of Tokopedia's share acquisition. The investigation focuses on TikTok's 88-working-day delay in notifying its 75.01% share acquisition of Tokopedia. The investigation examines potential violations of Article 29 of Law No. 5/1999 on notification of mergers and Article 55 of Government Regulation No. 57/2010 on the procedural aspects of mergers. It was highlighted that KPPU had granted conditional approval for the acquisition on 17 June 2025 and the current proceedings will focus on assessing compliance with notification requirements.
On 22 July 2025, the White House issued a framework for the United States - Indonesia Agreement on reciprocal trade, including digital trade, services, and investment. The Agreement applies to cross-border digital trade and service providers, with Indonesia committing to allow personal data transfers to the United States. It also focuses on eliminating Harmonised Tariff Schedule (HTS) tariff lines for intangible products and suspending related import declaration requirements. It also includes Indonesia’s pledge to implement the WTO Joint Initiative on Services Domestic Regulation by certifying its revised specific commitments.
Last updated: 01/04/2026