What does PP 71/2019 regulate regarding Public-Scope Electronic System Operators?

Government Regulation Number 71 of 2019 (PP 71/2019) divides Electronic System Operators (PSE) into public-scope and private-scope categories. Public-Scope PSEs cover state administration agencies and institutions appointed to operate electronic systems on their behalf. Beyond general PSE obligations, public-scope operators face three major extra rules. They must obtain custom software source code, maintain disaster continuity plans, and store systems and data inside Indonesia.

Who qualifies as a public-scope operator

Article 1 point 5 defines a Public-Scope PSE as an electronic system operated by a state agency or an institution appointed by that agency. State agencies cover central and regional legislative, executive, and judicial bodies created by law (Article 1 point 35). The elucidation of Article 2 paragraph (3)(b) clarifies that an appointed institution operates the system on behalf of the appointing agency. Financial sector regulatory and supervisory authorities are excluded from this category (Article 2 paragraph (4)).

PP 71/2019 does not explicitly name hospitals, community health centers (puskesmas), or clinics. Systems operated by individuals, business entities, or the public fall under the private scope (Article 1 point 6). Therefore, private healthcare facilities are generally Private-Scope PSEs unless formally appointed by a state agency. Government-owned healthcare facilities must be evaluated individually based on their establishing mandate.

Additional obligations in the public scope

• Source code handover: Developers building custom software for a Public-Scope PSE must hand over the source code and technical documentation (Article 9 paragraph (1)). If storage infrastructure is unavailable, the code may be placed in escrow with a trusted third party (Article 9 paragraphs (3) and (6)). The developer must guarantee access, while the operator must protect confidentiality (Article 9 paragraphs (4) and (5)).
• Business continuity planning: Every PSE must maintain system continuity plans as part of governance (Article 19 paragraph (2)(e)). Public-Scope PSEs must also establish operational continuity plans to handle disruptions or disasters according to impact risk (Article 20 paragraph (1)).
• Domestic system and data residency: Public-scope electronic systems and data must be managed, processed, and stored inside Indonesia (Article 20 paragraph (2)). Overseas storage is permitted only if the required storage technology is unavailable domestically as determined by a ministerial committee (Article 20 paragraphs (3)–(5)). By contrast, Private-Scope PSEs may store data outside Indonesia provided regulatory supervision and law enforcement access are guaranteed (Article 21 paragraphs (1)–(3)).
• Stricter rules for health data: Health information system operators, including healthcare facilities, must process health data inside Indonesia (Law 17/2023 Article 346 paragraph (6). PP 28/2024 Article 946 paragraph (1)(c)). Storage must use data centers inside Indonesia, even when using third-party facilities (PP 28/2024 Article 966 paragraph (2) and paragraph (5)(a)). Cross-border health data transfers require approval from the Minister of Health and compliance with personal data transfer rules (PP 28/2024 Article 972 paragraph (3)).
• Third-party risk classification: When using third-party services, Public-Scope PSEs must classify data by risk and ensure secure electronic transactions (Article 20 paragraph (6). Article 43).

Registration, strategic data, and administrative sanctions

• Mandatory PSE registration: Both public and private PSEs must register before end users use their systems (Article 6 paragraphs (1) and (2)). Violating registration or source code handover rules triggers administrative sanctions ranging from written warnings to access termination (Article 100 paragraphs (1) and (2)). Administrative sanctions do not remove civil or criminal liability (Article 100 paragraph (5)).
• Strategic electronic data: The government designates institutions holding strategic Electronic Data that must be protected. This includes The healthcare sector (Article 99 paragraph (1) and paragraph (2)(e)). Designated holders must create electronic records and backups connected to designated data centers (Article 99 paragraph (3)). The two-year transition period from 10 October 2019 (Article 102 paragraph (2). Article 104) has already expired.

Legal basis

• Government Regulation Number 71 of 2019 on Electronic Systems and Transactions (PP 71/2019): Article 1 points 5, 6, and 35. Article 2 paragraphs (3) and (4). Articles 6, 9, 19 paragraph (2)(e), 20, 21, 43, 99, 100, 102 paragraph (2), and 104.
• Law Number 17 of 2023 on Health: Article 346 paragraphs (6) and (7).
• Government Regulation Number 28 of 2024 (PP 28/2024): Article 946 paragraph (1)(c), Article 966 paragraph (2) and paragraph (5)(a), and Article 972 paragraph (3).