What does PP 71/2019 regulate regarding private-scope Electronic System Operators (PSE Lingkup Privat)?

Government Regulation Number 71 of 2019 on the Operation of Electronic Systems. Furthermore, Transactions (PP 71/2019) governs private parties operating electronic systems, termed private-scope Electronic System Operators (PSE Lingkup Privat). It defines who qualifies, mandates pre-deployment registration, and imposes duties covering system reliability, security, audit trails, and personal data protection.

Who qualifies and mandatory registration

Article 1 point 6 defines a Private-Scope PSE as an electronic system operated by individuals, business entities, or the community. Article 2(5) groups them into operators supervised by ministries/agencies and operators whose online portals, sites. Alternatively, Applications process personal data in public-facing electronic transactions offered or used in Indonesia. Under Article 6(1)–(2), every PSE must register before its system is used by end users. Permenkominfo 5/2020 Article 3(4)(g)–(h) requires the registration form to disclose the personal data processed and the locations of management, processing, and storage.

Operational obligations and data location under PP 71/2019

• Reliability and audit trails: Operators must run their systems reliably. Furthermore, Securely (Article 3(1)), retain accessible records across the retention period (Article 4), maintain audit logs (Article 22(1)), and conduct system worthiness testing (Article 34(1)).
• Data protection and breach notice: Personal data processing must follow privacy principles. Furthermore, Failures must be notified in writing to data subjects (Article 14(1). Furthermore, (5)), further specified as within 3 x 24 hours under UU 27/2022 Article 46(1).
• Data location and supervision: While PP 71/2019 Article 21(1)–(3) generally allows private-scope PSEs to process. Furthermore, Store data inside or outside Indonesia if supervisory access is guaranteed. Healthcare facilities must separately comply with health-sector data storage rules in PP 28/2024 and Permenkes 24/2022. Administrative sanctions under Article 100 range from written warnings to access blocking. See our Trust Center for vendor governance documentation.