Cloud Services in Indonesia
AWS Jakarta, Azure, GCP, PDNS & Data Sovereignty

1. Executive Summary

Indonesia represents the single largest untapped cloud computing opportunity in Southeast Asia. With a population of 280 million people, the fourth-largest in the world, Indonesia's digital economy reached USD 82 billion in gross merchandise value in 2025 and is projected to surpass USD 130 billion by 2028. The cloud infrastructure underpinning this transformation has entered a critical acceleration phase with the arrival of all major hyperscaler regions in Jakarta, the maturation of local cloud providers, and the implementation of Indonesia's comprehensive data localization and personal data protection frameworks.

AWS launched its Jakarta region (ap-southeast-3) in December 2021, Google Cloud opened asia-southeast2 in Jakarta in 2020, and Alibaba Cloud has operated its Indonesia region (ap-southeast-5) since 2018. Microsoft Azure launched its Indonesia region in 2024. These hyperscaler investments, totaling over USD 10 billion in combined commitments, reflect the strategic imperative of serving Indonesia's data-local requirements under GR 71/2019 while capturing the fastest-growing cloud market in ASEAN.

This guide delivers an exhaustive analysis of cloud services in Indonesia, covering the technical specifications of each provider region, the complex regulatory landscape spanning Kominfo (Ministry of Communication and Information Technology), OJK (Financial Services Authority), and BI (Bank Indonesia), the PDNS national cloud initiative, the PDP Law data protection framework, cost benchmarking, submarine cable and Palapa Ring connectivity, and actionable strategies for enterprises deploying cloud infrastructure in the Indonesian market. Whether you are a multinational entering Indonesia, a local unicorn scaling infrastructure, or a government agency modernizing under Satu Data Indonesia, this resource provides the depth required for enterprise-grade planning.

2. Indonesian Cloud Market Overview & Statistics

Indonesia's public cloud services market reached approximately USD 3.2 billion in 2025, making it the second-largest cloud market in Southeast Asia after Singapore. However, Indonesia's cloud growth rate of 25-28% CAGR significantly outpaces Singapore's 18-20%, driven by the massive greenfield opportunity across government, financial services, e-commerce, telecommunications, and manufacturing sectors. By 2028, Indonesia's cloud market is projected to reach USD 6.5 billion, potentially rivaling Singapore in absolute terms.

Market Size and Segment Analysis

The Indonesian cloud market is characterized by a high SaaS concentration (approximately 50% of total spend), reflecting the adoption of cloud-based business applications by Indonesian enterprises that have largely skipped the traditional on-premises software licensing model. IaaS accounts for approximately 32% of spending, driven by hyperscaler region deployments and local IaaS providers like Biznet Gio. PaaS represents 18% and is the fastest-growing segment as Indonesian developers adopt managed databases, container orchestration, and serverless computing.

Key Adoption Drivers

• Digital Economy Boom: Indonesia's digital economy -- led by GoTo, Tokopedia, Bukalapak, Traveloka, and hundreds of startups -- has created massive demand for scalable cloud infrastructure. GoTo alone processes over 2 billion transactions per year on cloud infrastructure.
• Data Localization Mandates: GR 71/2019 requires strategic electronic systems used for public services to store data within Indonesia, driving hyperscaler region investments and local cloud provider growth. This regulatory pull ensures that Indonesian cloud spending stays domestic.
• Government Digitization: The Satu Data Indonesia initiative, e-government transformation, and PDNS national cloud are driving significant public-sector cloud adoption across national and regional government agencies.
• Financial Services Transformation: OJK-licensed digital banks (Bank Jago, Allo Bank, Akulaku, Sea Bank Indonesia), fintech payment platforms (GoPay, OVO, Dana, ShopeePay), and P2P lending platforms are all cloud-native operations.
• Hyperscaler Region Availability: The arrival of AWS, Google Cloud, Azure, and Alibaba Cloud regions in Jakarta from 2018-2024 has removed the primary barrier to enterprise cloud adoption by enabling data-local deployments that satisfy regulatory requirements.

3. Hyperscaler Regions: AWS Jakarta, Azure, GCP & Alibaba

Indonesia is the only ASEAN country outside Singapore where all four major hyperscalers (AWS, Azure, GCP, Alibaba Cloud) operate full cloud regions. This density of hyperscaler investment -- exceeding USD 10 billion in combined commitments -- reflects Indonesia's strategic importance as ASEAN's largest economy and the regulatory requirement for local data processing.

AWS Asia Pacific (Jakarta) -- ap-southeast-3

Amazon Web Services launched its Jakarta region (ap-southeast-3) in December 2021, representing a USD 5 billion investment commitment in Indonesia through 2036. The region comprises 3 Availability Zones and supports over 100 AWS services, with continuous expansion of the service catalog.

# AWS CLI: Launch EC2 instance in Jakarta region
aws ec2 run-instances \
  --region ap-southeast-3 \
  --image-id ami-0id-jakarta-region \
  --instance-type m6i.xlarge \
  --subnet-id subnet-jkt-az1-private \
  --security-group-ids sg-id-enterprise \
  --key-name jkt-prod-key \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Environment,Value=production},{Key=DataResidency,Value=Indonesia}]'

# Verify AZ distribution for high availability
aws ec2 describe-availability-zones --region ap-southeast-3
# Returns: ap-southeast-3a, ap-southeast-3b, ap-southeast-3c

# S3 bucket with Indonesia data residency enforcement
aws s3api create-bucket \
  --bucket id-production-data \
  --region ap-southeast-3 \
  --create-bucket-configuration LocationConstraint=ap-southeast-3

# Block public access + enforce encryption (GR 71/2019 compliance)
aws s3api put-public-access-block \
  --bucket id-production-data \
  --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

Google Cloud Jakarta -- asia-southeast2

Google Cloud launched its Jakarta region (asia-southeast2) in June 2020, the first hyperscaler region in Indonesia. The region provides 3 zones and supports a growing catalog of GCP services optimized for Indonesian workloads.

Alibaba Cloud Indonesia -- ap-southeast-5

Alibaba Cloud was the first hyperscaler to establish a region in Indonesia (ap-southeast-5, launched 2018), investing over USD 1 billion in local data center infrastructure. Alibaba Cloud benefits from deep integration with the Lazada e-commerce ecosystem and strong relationships with Indonesian Chinese-owned conglomerates.

Microsoft Azure Indonesia

Microsoft Azure launched its Indonesia region in 2024, completing the hyperscaler quartet in Jakarta. Azure Indonesia supports core IaaS and PaaS services with particular strength in Microsoft 365 integration, Dynamics 365, and Azure AI services for Indonesian enterprises with existing Microsoft enterprise agreements.

Hyperscaler Comparison: Indonesia Regions

4. GR 71/2019 Data Localization & PSE Registration

Indonesia's data localization framework, anchored by Government Regulation (Peraturan Pemerintah) No. 71 of 2019 on the Implementation of Electronic Systems and Transactions (PP PSTE), establishes one of the most consequential data residency regimes in Southeast Asia. Understanding this framework is essential for any enterprise deploying cloud infrastructure for the Indonesian market.

GR 71/2019 Key Provisions

GR 71/2019 classifies electronic system operators (Penyelenggara Sistem Elektronik / PSE) into two categories with different data localization obligations:

1. Public PSE (PSE Lingkup Publik): Electronic systems used for public services, law enforcement, state defense, or state security. These systems MUST have their data centers and disaster recovery centers located within Indonesian territory. There is no exception -- all data storage, processing, and backup must occur on infrastructure physically located in Indonesia.
2. Private PSE (PSE Lingkup Privat): Electronic systems operated by private entities for commercial purposes. Private PSEs may store data abroad but must ensure that the data remains accessible for regulatory supervision, law enforcement, and coordination purposes by Indonesian authorities. In practice, this means maintaining mirrored or accessible copies of data within Indonesia even if primary processing occurs offshore.

PSE Registration Requirements (Kominfo)

Under Ministerial Regulation (Permenkominfo) No. 5 of 2020, all electronic system operators -- both public and private, domestic and foreign -- must register with Kominfo through the PSE registration system. Failure to register can result in access blocking within Indonesia. Major cloud providers including AWS, Google Cloud, Microsoft Azure, and Alibaba Cloud have completed PSE registration.

5. PDNS: National Data Center & Government Cloud

Pusat Data Nasional (PDNS / National Data Center) is Indonesia's flagship government cloud initiative, managed by the Directorate General of Informatics Applications (Ditjen Aptika) under Kominfo. PDNS represents one of the most ambitious government data center consolidation programs in Southeast Asia, aiming to unify the fragmented government IT landscape.

The Fragmentation Problem

Before PDNS, Indonesian government IT infrastructure was severely fragmented across an estimated 27,000+ independent server rooms and small data centers operated by individual government agencies at national, provincial, and district levels. This fragmentation resulted in massive duplication of infrastructure spending, inconsistent security standards, poor interoperability between government systems, inability to share data across agencies (undermining the Satu Data Indonesia initiative), and extreme vulnerability to cyberattacks due to unpatched and unmanaged systems.

PDNS Architecture

The PDNS program encompasses multiple physical data center facilities and a cloud management platform:

• PDNS 1 (Serpong, Banten): Temporary facility operated by Telkom Sigma providing initial government cloud capacity while permanent facilities are constructed.
• PDNS 2 (Surabaya, East Java): Major facility operated in partnership with Telkom, which suffered the high-profile ransomware attack in June 2024 that disrupted 282 government agencies and became a watershed moment for Indonesian cybersecurity.
• PDNS Cikarang (West Java): The flagship permanent facility under construction in the Cikarang industrial area, designed for 10,000+ rack capacity with Tier 3+ standards.
• PDNS Batam (Riau Islands): Secondary facility in Batam Free Trade Zone, providing geographic disaster recovery and benefiting from proximity to Singapore's submarine cable hub.

# PDNS Government Cloud Service Catalog (Illustrative)
# =====================================================

# Compute Services
- Virtual Machine (VM) instances: 2vCPU/4GB to 64vCPU/256GB
- Container orchestration: Kubernetes-based (OpenShift/Rancher)
- Serverless computing: Function-as-a-Service for event-driven workloads

# Storage Services
- Block storage: SSD and HDD tiers
- Object storage: S3-compatible API for unstructured data
- File storage: NFS-compatible shared file systems
- Backup: Automated backup with 30-day retention policy

# Database Services
- Relational: PostgreSQL, MySQL managed instances
- NoSQL: MongoDB, Redis managed instances
- Data warehouse: For Satu Data analytics workloads

# Security & Compliance
- Web Application Firewall (WAF)
- DDoS protection
- SSL/TLS certificate management
- Identity and Access Management (IAM)
- Security Information and Event Management (SIEM)
- Mandatory: ISO 27001, SNI compliance

# Network Services
- Virtual Private Cloud (VPC)
- Load balancing: Layer 4 and Layer 7
- VPN: Site-to-site for agency network integration
- CDN: Content delivery for citizen-facing applications

# Pricing: Government agencies pay subsidized rates
# typically 30-50% below commercial cloud pricing

6. Local Providers: Telkom Sigma, Biznet Gio, Lintasarta, DCI

Indonesia's local cloud ecosystem is the most developed among emerging ASEAN markets, driven by data localization mandates that create protected market share for domestic providers, government procurement preferences for local companies, and a large domestic enterprise market that values Bahasa Indonesia support and local relationships.

7. PDP Law (UU PDP): Indonesia's Data Protection Framework

Indonesia's Personal Data Protection Law (Undang-Undang Perlindungan Data Pribadi / UU PDP), enacted on October 17, 2022, is the country's first comprehensive data protection legislation. Modeled significantly on the EU GDPR, the PDP Law establishes a rights-based framework for personal data protection that fundamentally shapes cloud architecture and data management practices for any organization operating in Indonesia.

Key Provisions Affecting Cloud Deployments

1. Data Controller and Processor Obligations: The PDP Law distinguishes between data controllers (pengendali data) and data processors (prosesor data), mirroring GDPR concepts. Cloud providers typically act as data processors, and clear contractual arrangements must define responsibilities for data protection, security measures, breach notification, and data deletion.
2. Cross-Border Data Transfer: Article 56 permits cross-border transfer of personal data only to countries with an equivalent level of data protection or where adequate safeguards are in place. The implementing regulations define adequacy criteria and approved contractual mechanisms. This provision works in conjunction with GR 71/2019 to shape data residency architecture decisions.
3. Breach Notification: Data controllers must notify data subjects and the supervisory authority within 72 hours of discovering a personal data breach. Cloud architectures must incorporate automated breach detection and notification workflows.
4. Data Subject Rights: Indonesian residents have rights to access, correct, delete, withdraw consent, and obtain copies of their personal data. Cloud systems must support these rights through appropriate APIs and data management capabilities.
5. Penalties: Administrative fines of up to 2% of annual revenue, criminal penalties including imprisonment of up to 6 years and fines up to IDR 6 billion for serious violations.

8. OJK Cloud Regulations for Financial Services

Indonesia's financial services authority, OJK (Otoritas Jasa Keuangan), regulates cloud adoption by banks, insurance companies, multifinance companies, and capital market participants through a comprehensive regulatory framework that adds sector-specific requirements on top of the general GR 71/2019 and PDP Law obligations.

POJK 11/2022: IT Implementation for Commercial Banks

The primary regulation governing cloud adoption by Indonesian banks is POJK No. 11/POJK.03/2022 on the Implementation of Information Technology by Commercial Banks and its supporting circulars. Key requirements include:

• Mandatory OJK Notification: Banks must notify OJK at least 30 days before deploying core banking systems or customer data on cloud infrastructure. The notification must include a detailed risk assessment, cloud provider evaluation, data flow diagrams, and security architecture documentation.
• Data Center Location: Core banking systems and customer data storage must be located in data centers within Indonesian territory. This effectively mandates the use of Jakarta-based cloud regions for all banking workloads involving customer data.
• Disaster Recovery: Banks must maintain disaster recovery capability with the DR site located in Indonesia, at a minimum distance of 60 km from the primary data center but within the same seismic zone constraints.
• Penetration Testing: Annual penetration testing of cloud infrastructure is mandatory, conducted by OJK-approved third-party assessors.
• Exit Strategy: Banks must maintain documented and tested exit strategies demonstrating the ability to migrate away from any cloud provider within a defined timeframe (typically 6-12 months).
• Audit Access: OJK must have the right to audit cloud infrastructure, either directly or through appointed third parties, with reasonable notice. Cloud provider contracts must include explicit OJK audit access clauses.

# OJK-Compliant Cloud Architecture Pattern (AWS ap-southeast-3)
# ==============================================================

# 1. Data residency enforcement -- ALL data in Jakarta region
Region: ap-southeast-3 (Jakarta) -- PRIMARY AND ONLY region for banking data
DR: Cross-AZ within ap-southeast-3 (3 AZs provide local HA)
    + Backup to separate Jakarta facility (Telkom NeutraDC or DCI)

# 2. Network architecture
VPC: 10.0.0.0/16 (ap-southeast-3)
  +-- Private Subnet AZ-a: Core banking application tier
  +-- Private Subnet AZ-b: Core banking replica tier
  +-- Private Subnet AZ-c: Analytics and reporting tier
  +-- Data Subnet AZ-a/b: RDS Multi-AZ (customer data)
  +-- Management Subnet: Bastion, monitoring, logging
  NO public subnets -- all access via AWS PrivateLink or VPN

# 3. Encryption (OJK minimum standards)
Data at Rest:  AWS KMS with customer-managed CMK (AES-256)
Data in Transit: TLS 1.2+ (mandatory), TLS 1.3 (preferred)
Database:      RDS encryption + column-level encryption for PII
Key Storage:   AWS CloudHSM for banking-grade key management

# 4. OJK audit readiness
CloudTrail:    Enabled, logs retained 7+ years (OJK requirement)
VPC Flow Logs: All subnets, 5+ year retention
Config:        Continuous compliance monitoring
Access Logs:   ALB, S3, RDS audit logs centralized to SIEM
Report:        Monthly OJK compliance dashboard generation

# 5. Annual penetration testing (OJK-mandated)
Scope:    All cloud infrastructure, applications, and APIs
Provider: Must be OJK-approved third-party assessor
Output:   Formal report submitted to OJK compliance team
Remediation: Critical findings within 30 days, High within 90 days

9. Data Center Landscape & Submarine Cable Infrastructure

Indonesia's data center market is experiencing explosive growth, driven by hyperscaler region deployments, data localization requirements, and the digital economy boom. The Greater Jakarta area (Jabodetabek) is the primary data center hub, with emerging capacity in Surabaya, Batam, and Makassar. The country's submarine cable connectivity has improved dramatically in recent years, though the archipelagic geography creates unique connectivity challenges.

Submarine Cable Systems

10. Cloud for Indonesia's Digital Economy: Unicorns & Super-Apps

Indonesia's digital economy, the largest in Southeast Asia, is built almost entirely on cloud infrastructure. The country's technology unicorns and decacorns operate some of the most sophisticated cloud architectures in ASEAN, processing billions of transactions annually across e-commerce, ride-hailing, fintech, and digital services.

Major Cloud-Native Technology Companies

11. Hybrid & Multi-Cloud Strategies for Indonesia

Multi-cloud and hybrid architectures are increasingly common among large Indonesian enterprises, driven by OJK concentration risk guidance, the need to balance hyperscaler capabilities with local provider relationships for government contracts, and the desire to optimize costs across providers with different pricing strengths.

Common Indonesian Multi-Cloud Patterns

Pattern A: Hyperscaler Primary + Local DR/Government
The most common enterprise pattern deploys production workloads on a hyperscaler (typically AWS or GCP in Jakarta) while maintaining disaster recovery and government-facing systems on local infrastructure (Telkom NeutraDC or Biznet Gio). This satisfies both performance requirements and government procurement preferences.

Pattern B: Dual-Hyperscaler for Financial Services
OJK-regulated entities increasingly deploy across two hyperscaler regions in Jakarta (e.g., AWS ap-southeast-3 + GCP asia-southeast2) to address concentration risk. Core banking runs on one provider, analytics and AI on the other, with cross-provider networking via SD-WAN or interconnect providers.

Pattern C: Indonesia Primary + Singapore Hub
Multinational enterprises maintain Jakarta-based infrastructure for data-local Indonesian workloads while using Singapore as the ASEAN hub for regional services, analytics aggregation, and international connectivity. Data classification policies determine which data flows between regions.

12. Sovereign Cloud & National Security Architecture

Indonesia's sovereign cloud strategy is evolving rapidly in the wake of the June 2024 PDNS ransomware incident, which disrupted 282 government agencies and exposed critical vulnerabilities in the national cloud infrastructure. The incident catalyzed significant reforms in government cloud security governance, leading to enhanced BSSN (National Cyber and Crypto Agency) oversight, mandatory backup requirements, and the acceleration of the permanent PDNS facility construction.

Post-Incident Security Reforms

• Mandatory Backup Policy: All government agencies must now maintain encrypted backups separate from primary PDNS infrastructure, with regular restoration testing.
• BSSN Enhanced Oversight: BSSN has been granted expanded authority over government cloud security, including mandatory security assessments, penetration testing, and incident response coordination.
• Multi-Tier Classification: Government data is now classified into sensitivity tiers with corresponding cloud security requirements, from standard PDNS hosting for routine data to air-gapped infrastructure for intelligence and defense systems.
• Zero Trust Architecture: New PDNS deployments must implement zero-trust networking principles with microsegmentation, continuous authentication, and least-privilege access controls.

13. Cloud Costs: Jakarta vs Singapore vs Mumbai

Cloud pricing in Indonesia's Jakarta regions tends to carry a 5-15% premium over Singapore and Mumbai for equivalent hyperscaler services, reflecting the newer infrastructure, smaller scale, and data localization-driven demand. However, local providers like Biznet Gio offer significant savings for basic IaaS workloads.

14. Palapa Ring & Archipelago Connectivity

The Palapa Ring is Indonesia's national fiber optic backbone, a 12,000+ kilometer submarine and terrestrial cable network connecting the major islands of the Indonesian archipelago. Completed in 2019, the Palapa Ring provides the domestic connectivity foundation that enables cloud services to reach users across Indonesia's 17,000+ islands, though last-mile connectivity remains uneven.

Palapa Ring Architecture

• Western Ring (Palapa Ring Barat): 3,600 km connecting Sumatra, Java, and Kalimantan with redundant submarine paths through the Java Sea and Karimata Strait.
• Central Ring (Palapa Ring Tengah): 3,200 km connecting Kalimantan, Sulawesi, and Nusa Tenggara with submarine crossings through the Makassar Strait and Flores Sea.
• Eastern Ring (Palapa Ring Timur): 5,200 km connecting Maluku, Papua, and the eastern islands through submarine paths across the Banda Sea and Arafura Sea -- the most challenging and expensive segment.

Cloud service latency varies significantly across the archipelago. Users in Java (60% of Indonesia's population) enjoy 5-15ms latency to Jakarta cloud regions. Sumatra and Kalimantan users experience 20-40ms. Sulawesi sees 30-50ms. And eastern Indonesia (Maluku, Papua) can experience 50-100ms+ latency to Jakarta, creating challenges for real-time applications and motivating interest in edge computing and regional data center deployments in Makassar and Manado.

15. Implementation Roadmap & Partner Selection

Deploying cloud infrastructure in Indonesia requires navigating a more complex regulatory and operational environment than Singapore or other ASEAN markets. The following roadmap reflects best practices for both multinational enterprises entering Indonesia and Indonesian companies modernizing their infrastructure.

Phase 1: Regulatory and Market Assessment (6-10 weeks)

• GR 71/2019 classification: determine whether your systems qualify as Public PSE or Private PSE and corresponding data localization obligations
• PDP Law impact assessment: map personal data flows, identify controller/processor relationships, assess cross-border transfer requirements
• Sector-specific regulation: if financial services, assess OJK POJK 11/2022 compliance requirements; if telecom, assess Kominfo licensing
• PSE registration: ensure your electronic systems are registered with Kominfo's PSE system
• Provider evaluation: assess hyperscaler Jakarta regions vs. local providers based on workload requirements, compliance, and cost

Phase 2: Foundation and Landing Zone (8-12 weeks)

• Jakarta-primary architecture: deploy multi-AZ infrastructure in chosen hyperscaler Jakarta region
• Network connectivity: establish VPN or Direct Connect from existing infrastructure; provision Indonesian ISP connectivity (Telkom, Indosat, XL)
• Security baseline: implement encryption, IAM, logging, and monitoring aligned with BSSN guidelines and sector-specific requirements
• Data classification: implement automated data classification and tagging to enforce residency policies
• Local team enablement: ensure Indonesian operations team has cloud administration training and access

Phase 3: Migration and Deployment (12-30 weeks)

• Wave 1: Non-production environments and internal tools
• Wave 2: Customer-facing applications with Indonesia-only data
• Wave 3: Financial and regulated workloads (with OJK notification if applicable)
• Wave 4: Data analytics, AI/ML, and cross-border integrated systems

Phase 4: Optimize and Scale (Ongoing)

• Cost optimization: implement FinOps practices with IDR budgeting and chargeback
• Performance: CDN deployment for Indonesian user base, edge caching, latency optimization for outer islands
• Compliance: ongoing PDP Law compliance monitoring, annual OJK penetration testing, PSE registration maintenance
• Expansion: evaluate edge deployments in Surabaya, Makassar for improved eastern Indonesia coverage

16. Satu Data Indonesia & Government Digital Transformation

Satu Data Indonesia (One Data Indonesia) is the national data governance initiative established by Presidential Regulation No. 39 of 2019, aiming to create a unified, interoperable data ecosystem across all government agencies. Cloud infrastructure is the enabling platform for Satu Data, providing the shared data lake, API gateway, and analytics capabilities required to break down information silos across Indonesia's 34 provinces and hundreds of district-level governments.

Cloud Enablers for Satu Data

• National Data Lake: Centralized data storage on PDNS infrastructure aggregating data from all government agencies, with standardized metadata, data quality controls, and access governance.
• API Gateway: Standardized API platform enabling real-time data sharing between government agencies, reducing duplicate data collection and improving service delivery to citizens.
• Analytics Platform: Cloud-based business intelligence and data analytics tools enabling evidence-based policymaking across ministries and agencies.
• Open Data Portal: data.go.id provides public access to government datasets, hosted on cloud infrastructure with CDN distribution for public consumption.

17. Frequently Asked Questions

Which AWS region serves Indonesia?

AWS operates the Asia Pacific (Jakarta) region with the code ap-southeast-3, launched in December 2021. It includes 3 Availability Zones and supports over 100 AWS services including EC2, S3, RDS, Lambda, EKS, and SageMaker. Jakarta is AWS's second ASEAN region after Singapore, built specifically to address Indonesia's data localization requirements under GR 71/2019.

What is Indonesia's GR 71/2019 data localization requirement?

GR 71/2019 mandates that public electronic system operators (PSE Lingkup Publik) used for public services, law enforcement, state defense, and state security must have their data centers and disaster recovery centers within Indonesian territory. Private PSEs may store data abroad but must ensure accessibility for regulatory supervision. This regulation effectively requires Jakarta-based cloud regions for government and public-service workloads.

What is PDNS and why is it significant?

PDNS (Pusat Data Nasional / National Data Center) is Indonesia's government cloud initiative managed by Kominfo, aiming to consolidate over 27,000 government server rooms into unified national cloud infrastructure. The project includes facilities in Serpong, Surabaya, Cikarang, and Batam. PDNS gained international attention after a major ransomware incident in June 2024, leading to significant security reforms and accelerated investment in government cyber resilience.

How does OJK regulate cloud adoption by financial institutions?

OJK regulates cloud usage through POJK 11/2022, requiring mandatory OJK notification before cloud deployment, data center location within Indonesia for core banking systems, comprehensive risk assessments, annual penetration testing by OJK-approved assessors, business continuity with Indonesian-based DR, documented exit strategies, and explicit OJK audit access clauses in cloud provider contracts.

How large is the Indonesian cloud computing market?

Indonesia's public cloud services market reached approximately USD 3.2 billion in 2025, the second-largest in Southeast Asia. It is growing at a 25-28% CAGR through 2028, projected to reach USD 6.5 billion, driven by the 280-million population's digital transformation, data localization mandates keeping spending domestic, government digitization, and the technology unicorn ecosystem.

What are the major local cloud providers in Indonesia?

Key local providers include Telkom Sigma (largest, state-owned Telkom subsidiary, PDNS operator), Biznet Gio (independent public cloud IaaS at 20-40% below hyperscaler pricing), Lintasarta (Indosat Group enterprise cloud), DCI Indonesia (Salim Group hyperscale data centers), CBN Cloud (mid-market IaaS), and IdCloudHost/Dewaweb (SME segment). These providers benefit from government procurement preferences and GR 71/2019 compliance advantages.

What submarine cables connect Indonesia to global networks?

Indonesia is served by 15+ international submarine cable systems including SEA-ME-WE 3/5, INDIGO (Google), Apricot (Google), ECHO (Google/Meta), SJC2, AAE-1, and domestic systems like Jasuka and Palapa Ring. The 12,000+ km Palapa Ring provides domestic backbone connectivity across the archipelago. Major international cable landing stations are at Jakarta (Ancol), Batam, Dumai, and Manado.

What is Indonesia's PDP Law and how does it affect cloud?

The PDP Law (UU PDP), enacted October 2022, is Indonesia's comprehensive data protection legislation modeled on GDPR. It establishes consent requirements, data subject rights, 72-hour breach notification obligations, and cross-border transfer restrictions. Cloud deployments must implement clear controller/processor agreements, encryption, breach detection workflows, and data subject rights fulfillment APIs. Full enforcement is active as of October 2024.

How does Alibaba Cloud compete in Indonesia?

Alibaba Cloud was the first hyperscaler in Indonesia (2018), offering 15-25% lower pricing than AWS, integration with the Lazada/Tokopedia e-commerce ecosystem, IDR billing, Chinese enterprise customer relationships, and localized Indonesian language support. It holds particular strength among e-commerce businesses and companies with China trade connections.

What incentives exist for cloud and data center investment?

Indonesia offers tax holidays of 5-20 years for data center investments exceeding IDR 500 billion, Special Economic Zone (KEK) benefits in Batam and other locations with reduced corporate tax and import duty exemptions, Making Indonesia 4.0 support for cloud adoption in manufacturing, and fast-track licensing through BKPM's Online Single Submission (OSS) system for data center projects.