The Obligation to Register and Update Data for Private Electronic System Operators: Between Compliance, Benefits, and Sanctions

Learn the legal requirements for Private PSE registration in Indonesia, including scope, OSS process, sanctions, and compliance benefits for the electronic system operators.

1. Private PSEs must register before their digital services are made available to the public. This applies to both domestic and foreign operators. Registration is a mandatory requirement before any digital service can operate publicly.
2. There are two main categories of electronic system operators that fall under the scope of Private PSE. In general, any operator providing internet-based digital services to the public may potentially qualify as a Private PSE.
3. Registration is submitted through the OSS system, unless otherwise regulated. The applicant must complete a form that includes a description of the electronic system, along with commitments to ensure information security, protect personal data, and conduct a system feasibility test.
4. Failure to register may result in administrative sanctions, including access termination. Meanwhile, failure to update registration data may lead to warnings, suspension, access blocking, or revocation of registration.
5. Registration demonstrates legal compliance, builds user and partner trust, and reflects a Private PSE’s commitment to data protection and system security, while also helping avoid administrative sanctions such as access blocking.

In several news reports, it has been stated that the Ministry of Communication and Digital Affairs (“Komdigi”) plans to block access to sites owned by Private PSEs that have not registered or updated their registration information. This is due to the fact that there are still Private PSEs that have not fulfilled this obligation. The deadline for registration was actually set by Komdigi to be no later than July 20, 2022. Furthermore, the reports also mention that Komdigi has sent letters to several Private PSEs suspected of having this obligation.

The obligation to register and update registration information is governed by (i) Government Regulation No. 71 of 2019 on the Operation of Electronic Systems and Transactions, and (ii) Minister of Communication and Informatics Regulation No. 5 of 2020 on Private Electronic System Operators, as amended by Minister of Communication and Informatics Regulation No. 10 of 2021.

One frequently asked question in practice is: who falls under the Private PSE? Broadly speaking, there are two main categories included under this scope.

First, electronic system operators that are regulated or supervised by government agencies or state institutions, in accordance with the applicable laws and regulations in each sector. For example, fintech platforms that are under the supervision of the Financial Services Authority (OJK) or Bank Indonesia, in line with financial sector regulations.

Second, electronic system operators that provide services to the public through internet-based portals, websites, or applications for the following activities:

• providing, managing, and/or operating the offering and/or trading of goods and/or services;
• providing, managing, and/or operating financial transaction services;
• delivering paid digital content through data networks, whether by download from a website, email delivery, or through applications to user devices;
• providing digital communication services, including but not limited to text messages, voice and video calls, email, and online chats via digital platforms, social media, or networking services;
• providing search engines and electronic information in various forms, such as text, sound, images, animations, music, video, film, games, or combinations of these formats; and/or
• processing personal data in the course of service operations for the public that are related to electronic transaction activities.

From the explanation above, it can be understood that any electronic system operator operating internet-based digital services to the public potentially qualifies as a Private PSE.

Every Private PSE is required to register with the Komdigi. This registration must be completed even before the electronic system is used by users. This means that the registration is a primary requirement before the digital service can be publicly operated.

This registration obligation applies not only to Private PSE established in Indonesia, but also to foreign entities established under the laws of other countries, as long as they meet the following criteria (foreign Private PSE):

• provide services within the territory of Indonesia;
• conduct business in Indonesia; and/or
• their electronic systems are used and/or offered within the territory of Indonesia.

The registration is made through the Online Single Submission (“OSS”) system, unless regulated otherwise under the prevailing laws and regulations.

The application for registration by a Private PSE shall be made by completing a form containing the following information:

• an overview of the electronic system operation, which includes: (i) the name and sector of the electronic system, (ii) the website URL, (iii) the server domain or IP address, (iv) a description of the business model, (v) the functions and business processes of the system, (vi) information on the personal data being processed, (vii) information on the location where the data is managed and/or stored, and (viii) a statement that the Private PSE guarantees access to the system and electronic data for the purpose of supervision and law enforcement;
• the obligation to ensure information security;
• the obligation to protect personal data; and
• the obligation to conduct an electronic system feasibility test.

For foreign Private PSEs, in addition to completing the above-mentioned information, they are also required to submit the following additional information, accompanied by supporting documents that have been translated into Indonesian by a sworn translator:

• the identity of the foreign Private PSE;
• the identity of the company’s executives and/or designated person in charge;
• the domicile information and/or deed of establishment of the company (certificate of incorporation);
• the number of users from Indonesia; and
• the value of transactions originating from Indonesia.

Private PSE that fail to register as required will be subject to administrative sanctions in the form of access termination to their electronic systems.

Meanwhile, Private PSEs that have already obtained a registration certificate but fail to report changes to their registration information will face sanctions such as written warnings, temporary suspension, access termination, and revocation of their registration certificate.

Registration as a Private PSE essentially provides various benefits for the electronic system provider itself. By fulfilling this obligation, the Private PSE demonstrates compliance with applicable laws, thereby avoiding the risk of administrative sanctions, including access blocking by the Komdigi.

In digital services, user trust is one of the key factors. Being registered sends a positive signal to both users and business partners that the Private PSE conducts its operations in accordance with national digital regulations. Further, the registration obligation also reflects the Private PSE’s initial commitment to ensuring information system security and personal data protection.