Can a private clinic store electronic medical records in a foreign cloud data center?

No. PP 28/2024 Article 966 paragraph (2) and Permenkes 24/2022 Article 22 paragraph (1) mandate that health data storage centers must be located inside Indonesia.

Does PP 71/2019 allow general private electronic system operators to store data abroad?

Yes. Article 21 paragraph (1) allows private PSEs to store data abroad provided effective regulatory supervision and law enforcement access are guaranteed.

What approvals are required to send patient medical records abroad?

Under PP 28/2024 Article 972 paragraph (3), cross-border transfers require approval from the Minister of Health and compliance with UU 27/2022 Article 56.

Where can patient health data and electronic systems be stored under Indonesian law?

Indonesian health data must be stored in domestic data centers under PP 28/2024 Article 966 and Permenkes 24/2022, while general private systems may be stored abroad under PP 71/2019.

For health data, the statutory baseline is domestic residency. Law Number 17 of 2023 on Health (UU 17/2023) requires Health Information System operators, including healthcare facilities, to process health data within Indonesia. Government Regulation Number 28 of 2024 (PP 28/2024) mandates that health data must be stored in data centers located inside Indonesia. Even when using third-party services. Cross-border transfers are permitted only for specific, limited purposes under government authorization.

For electronic systems generally, PP 71/2019 requires Public-Scope Electronic System Operators to manage and store data domestically. Conversely, Private-Scope operators may generally locate systems abroad provided regulatory supervision and law enforcement access remain effective.

General rules: public scope versus private scope

For Public-Scope PSEs, PP 71/2019 Article 20 paragraph (2) mandates managing, processing, and storing electronic systems and data inside Indonesia. Overseas hosting is permitted only if the required storage technology is unavailable domestically (paragraph (3)), as determined by an inter-ministerial committee (paragraph (4)).

For Private-Scope PSEs, Article 21 paragraph (1) generally permits data management and storage domestically or overseas. However, operators must guarantee effective regulatory oversight and law enforcement access (paragraphs (2) and (3)). Permenkominfo 5/2020 Article 34 reinforces that offshore data must remain accessible for criminal investigations and legal proceedings.

Health data: stricter sectoral restrictions

Health Information System operators include healthcare facilities (UU 17/2023 Article 345 paragraph (2)(c). PP 28/2024 Article 946 paragraph (1)(c)). UU 17/2023 Article 346 paragraph (6) requires these operators to process health data within Indonesian territory. Processing outside Indonesia may occur pursuant to laws and regulations (paragraph (7)). The elucidation of paragraph (7) explains that processing includes transfer and storage, governed by electronic transaction and personal data protection laws.

For data storage, implementing regulations are explicit. Under PP 28/2024, storage is a mandatory health data processing activity (Article 961 paragraph (1)(c)). The database must be established as a data center located inside Indonesia (Article 966 paragraph (2)). Storage may utilize third-party services, provided the facilities are located inside Indonesia under a written agreement (paragraph (5)(a)). Article 966 of PP 28/2024 contains no exceptions allowing offshore health data storage.

Guidelines for selecting software and cloud providers

Before selecting a system or cloud computing provider, healthcare facilities must request written documentation regarding data storage, processing. In addition, Backup locations, as well as access controls.

Electronic medical record storage requirements

Permenkes 24/2022 Article 20 paragraph (3) recognizes servers, certified cloud computing, and certified digital media as approved storage media. Periodic backups must be maintained at a separate off-site location (paragraphs (4) and (5)).

When a healthcare facility partners with a PSE for storage due to resource constraints, Article 22 imposes key conditions. The PSE must maintain domestic data storage facilities (paragraph (1)) and secure a recommendation from the Ministry of Health (paragraph (2)). The PSE is prohibited from accessing or exploiting data under an integrity pact or NDA (paragraphs (3). Furthermore, (4)), while the facility retains unrestricted access (paragraph (5)).

Cross-border transfer of patient personal data

UU 17/2023 Article 349 paragraph (7) allows health data transfers abroad only for specific, limited purposes with Central Government approval. PP 28/2024 Article 972 paragraphs (2) and (3) detail those permitted purposes, requiring approval from the Minister of Health. Furthermore, Compliance with UU 27/2022 Article 56 personal data transfer rules.

Legal basis

Government Regulation Number 71 of 2019 (PP 71/2019): Article 1 points 5, 6, 35. Article 20 paragraphs (2)–(4). Article 21 paragraphs (1)–(3). and Article 100 paragraphs (1) and (2).
Permenkominfo Number 5 of 2020: Articles 32–34.
Ministry of Health Regulation Number 24 of 2022 on Medical Records: Article 20 paragraphs (3)–(5). and Article 22 paragraphs (1)–(5).
Law Number 27 of 2022 on Personal Data Protection: Article 56.
Law Number 17 of 2023 on Health: Article 345 paragraph (2)(c). Article 346 paragraphs (6)–(7) and its Elucidation. and Article 349 paragraph (7).
Government Regulation Number 28 of 2024: Article 946 paragraph (1)(c). Article 961 paragraph (1)(c). Article 966 paragraphs (2) and (5). and Article 972 paragraphs (2)–(3).