PSE Registration in Indonesia: 2026 Guide for Platforms and Apps

Bali Zero

Any private operator whose website, app or platform is used by people in Indonesia must register it with the Ministry of Communication and Digital Affairs (Komdigi, formerly Kominfo). The obligation covers foreign operators with no Indonesian office. An unregistered system can be blocked from Indonesia, and since 2022 the ministry has done exactly that to PayPal, Yahoo, Steam, eBay and KLM.

Summary

PSE registration at a glance

Who must register

PP 71/2019 Art. 6(1) makes registration an obligation for every electronic system operator. Permenkominfo 5/2020 Art. 2 applies it to private-scope operators (PSE Lingkup Privat), and Art. 2(3) says you register before users start using the system, not after.

Art. 2(2) puts two groups in scope. The first is any operator regulated or supervised by a ministry or agency under sector law. The second is any operator with a portal, site or online application used to:

offer or trade goods or services;
provide financial transaction services;
deliver paid digital content, whether by download, email or another application;
provide communication services, including messaging, voice and video calls, email, online chat, digital platforms, networking and social media;
run a search engine, or provide electronic information as text, sound, images, animation, music, video, film or games;
process personal data for operational activities serving the public in connection with electronic transactions.

Foreign operators are covered by Art. 4(1). An operator established or domiciled abroad must register if it provides services in Indonesia, does business in Indonesia, or its electronic system is used or offered in Indonesia. Not having an Indonesian entity takes you out of none of these three tests.

What happens if you do not register

Permenkominfo 5/2020 Art. 7 sets the sanctions:

Not registered at all: access blocking of the electronic system (Art. 7(2)).
Registered, but changes not reported or information incorrect: a written warning by email, then temporary suspension if the warning is ignored, then access blocking and revocation of the TD-PSE if you do not respond within 7 days of the suspension (Art. 7(3)).
Back in compliance: the ministry restores access, which Komdigi calls normalisasi (Art. 7(4) and 7(5)).

In practice, Komdigi sends a notification letter and a warning letter before it blocks. The deadlines in those letters are short, one week in the 2026 round below.

Enforcement record

30 July 2022: Kominfo cut access to eight sites and platforms: PayPal, Yahoo, Epic Games, Steam, Dota, Counter Strike, Xandr.com and Origin (EA). The action was later challenged at the Jakarta administrative court, case 424/G/TF/2022/PTUN.JKT.
28 June 2025: Komdigi blocked three operators under Art. 7: eBay Inc. (eBay), KLM Royal Dutch Airlines (KLM) and PT Dunia Luxindo (bathandbodyworks). The ministry said all three had received notification and warning letters and made no attempt to register before the deadline.
26 June 2026: Komdigi sent notification letters to 25 operators, 15 foreign and 10 domestic, covering 57 websites and apps, with a registration deadline of 3 July 2026. The list included Strava, Qatar Airways, Qantas, ANA, Accor, Best Western, Banyan Tree, Six Senses, The Ascott, Archipelago International, Aryaduta, Hotel Indonesia Group, Tauzia, Kodland, Stimuler and Engoo. The ministry said operators that missed the deadline would receive warning letters and then face access blocking.

Airlines, hotel groups and education apps made up most of the 2026 list. Your operator does not need to be a social network or a marketplace to be in scope. A booking engine used by Indonesian guests is enough.

Domestic versus foreign registration

	Domestic PSE	Foreign PSE
Who	Operators established in Indonesia	Operators established or domiciled abroad that serve, do business with, or offer their system to users in Indonesia (Art. 4(1))
Where	OSS-RBA, the online business licensing system (Art. 3(2))	Filed with the minister (Art. 3(1) and 4(2)); Komdigi runs the PSE registration portal at pse.komdigi.go.id
System data	Name, sector, URL, domain or server IP, business model, how the system works, personal data processed, where the system and data are managed and stored, and a commitment to give authorities access for supervision (Art. 3(4))	The same system data (Art. 4(2))
Company data	Filed through the OSS account; operators exempt from OSS add legal entity details, deed, NPWP and a contact person (Art. 3(5))	Company identity, identity of the head of the company or responsible officer, domicile or certificate of incorporation with a sworn Indonesian translation, number of Indonesian users, and transaction value from Indonesia (Art. 4(2) and 4(3))
Fee	None set in the regulation	None set in the regulation

When the file is complete, the minister issues the TD-PSE and adds the system to the public list on the ministry's website (Art. 6). That list is what Komdigi checks, and what anyone can search at pse.komdigi.go.id.

After registration

Keep the record current. Any change to the registered information must be reported to the minister (Art. 5): a new app, a new domain, a new server location, a new responsible officer. Failing to report is itself sanctionable under Art. 7(3).
Take down content when ordered. A takedown order must be acted on within 24 hours of receipt (Art. 15(6)). For urgent requests (terrorism, child sexual abuse material, and content that disturbs public order, as listed in Art. 14(3)) the limit is 4 hours after the warning (Art. 15(8)).
Protect personal data. Registration sits alongside UU 27/2022 on personal data protection. The two are separate obligations and a TD-PSE does not satisfy the second.

Where people go wrong

Registering one domain when the group runs several websites and apps. The 2026 letters listed up to 12 booking domains for a single hotel group.
Mapping brand names to the wrong legal entity. The registry records the operator, and brands often sit under a different company from the one filing.
Assuming a foreign entity is out of scope because it has no Indonesian office. Art. 4(1) looks at where the users are, not where the company is.
Letting the responsible officer leave without updating the record.

What we do

We assess whether your systems fall under Art. 2 and Art. 4, map every website and app to the right legal entity, prepare the document pack, file it, and follow up until the TD-PSE is issued. The fee is fixed and agreed before we start. Ongoing liaison with Komdigi after registration is a separate monthly service.

Check whether your systems are registered: a free twenty-minute call.

Sources

Summary

PSE registration at a glance

Who must register

offer or trade goods or services;
provide financial transaction services;
deliver paid digital content, whether by download, email or another application;
provide communication services, including messaging, voice and video calls, email, online chat, digital platforms, networking and social media;
run a search engine, or provide electronic information as text, sound, images, animation, music, video, film or games;
process personal data for operational activities serving the public in connection with electronic transactions.

What happens if you do not register

Permenkominfo 5/2020 Art. 7 sets the sanctions:

Not registered at all: access blocking of the electronic system (Art. 7(2)).
Registered, but changes not reported or information incorrect: a written warning by email, then temporary suspension if the warning is ignored, then access blocking and revocation of the TD-PSE if you do not respond within 7 days of the suspension (Art. 7(3)).
Back in compliance: the ministry restores access, which Komdigi calls normalisasi (Art. 7(4) and 7(5)).

In practice, Komdigi sends a notification letter and a warning letter before it blocks. The deadlines in those letters are short, one week in the 2026 round below.

Enforcement record

30 July 2022: Kominfo cut access to eight sites and platforms: PayPal, Yahoo, Epic Games, Steam, Dota, Counter Strike, Xandr.com and Origin (EA). The action was later challenged at the Jakarta administrative court, case 424/G/TF/2022/PTUN.JKT.
28 June 2025: Komdigi blocked three operators under Art. 7: eBay Inc. (eBay), KLM Royal Dutch Airlines (KLM) and PT Dunia Luxindo (bathandbodyworks). The ministry said all three had received notification and warning letters and made no attempt to register before the deadline.
26 June 2026: Komdigi sent notification letters to 25 operators, 15 foreign and 10 domestic, covering 57 websites and apps, with a registration deadline of 3 July 2026. The list included Strava, Qatar Airways, Qantas, ANA, Accor, Best Western, Banyan Tree, Six Senses, The Ascott, Archipelago International, Aryaduta, Hotel Indonesia Group, Tauzia, Kodland, Stimuler and Engoo. The ministry said operators that missed the deadline would receive warning letters and then face access blocking.

Domestic versus foreign registration

	Domestic PSE	Foreign PSE
Who	Operators established in Indonesia	Operators established or domiciled abroad that serve, do business with, or offer their system to users in Indonesia (Art. 4(1))
Where	OSS-RBA, the online business licensing system (Art. 3(2))	Filed with the minister (Art. 3(1) and 4(2)); Komdigi runs the PSE registration portal at pse.komdigi.go.id
System data	Name, sector, URL, domain or server IP, business model, how the system works, personal data processed, where the system and data are managed and stored, and a commitment to give authorities access for supervision (Art. 3(4))	The same system data (Art. 4(2))
Company data	Filed through the OSS account; operators exempt from OSS add legal entity details, deed, NPWP and a contact person (Art. 3(5))	Company identity, identity of the head of the company or responsible officer, domicile or certificate of incorporation with a sworn Indonesian translation, number of Indonesian users, and transaction value from Indonesia (Art. 4(2) and 4(3))
Fee	None set in the regulation	None set in the regulation

After registration

Keep the record current. Any change to the registered information must be reported to the minister (Art. 5): a new app, a new domain, a new server location, a new responsible officer. Failing to report is itself sanctionable under Art. 7(3).
Take down content when ordered. A takedown order must be acted on within 24 hours of receipt (Art. 15(6)). For urgent requests (terrorism, child sexual abuse material, and content that disturbs public order, as listed in Art. 14(3)) the limit is 4 hours after the warning (Art. 15(8)).
Protect personal data. Registration sits alongside UU 27/2022 on personal data protection. The two are separate obligations and a TD-PSE does not satisfy the second.

Where people go wrong

Registering one domain when the group runs several websites and apps. The 2026 letters listed up to 12 booking domains for a single hotel group.
Mapping brand names to the wrong legal entity. The registry records the operator, and brands often sit under a different company from the one filing.
Assuming a foreign entity is out of scope because it has no Indonesian office. Art. 4(1) looks at where the users are, not where the company is.
Letting the responsible officer leave without updating the record.

What we do

Check whether your systems are registered: a free twenty-minute call.

PSE Registration in Indonesia: Who Must Register, What Happens If You Do Not, and How to Do It

Summary

Who must register

What happens if you do not register

Enforcement record

Domestic versus foreign registration

After registration

Where people go wrong

What we do

Sources

Questions about how this applies to your case?

PSE Registration in Indonesia: Who Must Register, What Happens If You Do Not, and How to Do It

Summary

Who must register

What happens if you do not register

Enforcement record

Domestic versus foreign registration

After registration

Where people go wrong

What we do

Sources

Questions about how this applies to your case?