What does Permenkominfo 5/2020 regulate regarding cloud computing providers?

Ministry of Communication and Informatics Regulation Number 5 of 2020 (Permenkominfo 5/2020) classifies cloud computing providers as Private-Scope Electronic System Operators (PSE). Consequently, cloud providers must register before their services are used in Indonesia. Article 12 sets two specific duties: maintaining electronic information governance and providing customer data for supervision and law enforcement. Article 42 adds a duty to grant law enforcement access in specified emergency situations.

Who qualifies as a cloud computing provider

Article 1 point 9 defines cloud computing as on-demand network access to shared computing resources such as servers, storage, and applications. A cloud computing operator is any Private-Scope PSE that provides, manages, or operates those services (Article 1 point 10).

As a Private-Scope PSE, a cloud provider must register before users use its system (Article 2 paragraphs (1) and (3)). The registration form must state the location where data is managed, processed, and stored (Article 3 paragraph (4)(h)). Foreign-incorporated providers must still register if they offer services in Indonesia (Article 4 paragraph (1)). Facing access blocking if they fail to register (Article 7 paragraph (2)).

Specific obligations and law enforcement access

• Information governance (Article 12 paragraphs (1) and (2)): Cloud providers must maintain governance rules for electronic information and documents. At a minimum, these rules must cover user rights and duties, provider operational rights and duties, and user accountability for data stored in the cloud.
• Customer data for supervision (Article 12 paragraph (3)): Providers must supply electronic information. Furthermore, Data under their control regarding service users for regulatory supervision and law enforcement purposes.
• Emergency law enforcement access (Article 42 paragraphs (1) and (2)). Cloud providers must grant law enforcement access to electronic systems and/or data, limited to emergency situations. Covered emergencies include terrorism, child pornography, human trafficking, organized crime, or situations threatening human life and physical injury.
• Audit trails and sanctions (Articles 43, 44, and 46). Providers that refuse emergency access under Article 42 or fail to keep access audit trails face written warnings and/or revocation of their PSE registration certificate.

What clinics and hospitals should verify

• PSE registration status: Check whether the cloud provider appears on the official Private-Scope PSE registry published by the ministry (Article 6 paragraph (2)).
• Service contract terms: Ensure the terms of service specify the rights and duties of both parties and accountability for stored data (Article 12 paragraph (2)).
• Handling of Specific Personal Data: Review how the provider handles law enforcement requests involving health data. This Is classified as Specific Personal Data (Article 1 point 21. Article 36 paragraphs (4) and (5)).
• Regulatory amendments: Permenkominfo 5/2020 was amended by Permenkominfo 10/2021, so cited provisions should be read alongside that amendment.

Legal basis

• Ministry of Communication and Informatics Regulation Number 5 of 2020 on Private-Scope Electronic System Operators (as amended by Permenkominfo 10/2021). Article 1 points 9, 10, and 21. Article 2 paragraphs (1) and (3). Article 3 paragraph (4)(h). Article 4 paragraph (1). Article 6 paragraph (2). Article 7 paragraph (2). Article 12. Articles 32–34. Article 36 paragraphs (4) and (5). and Articles 42–46.