VPNs with servers in Indonesia

Operators must give ministries access to their systems and data for supervision, and law enforcers access for enforcement (art. 21), including data held abroad on Indonesian residents or entities (art. 34). On a formal request, an operator supplies traffic data and subscriber information within five calendar days (arts. 36–37). The regulation names no retention period. Whether a VPN operator falls within its scope is not established.

Unregistered systems are cut off (art. 7(2)). Operators must keep prohibited content off their systems: content that breaks a law, disturbs public order, or explains how to reach prohibited content (art. 9(4)). They must remove it within 24 hours of an order, or four hours for terrorism, child pornography or content disturbing public order; failing that, the minister may cut access to the whole system or order internet providers to (arts. 14–16).

The Electronic Information and Transactions Law, as amended by Law 1 of 2024, lets the government cut access to unlawful content or order operators to (art. 40(2b)).

The Criminal Code (Law 1 of 2023, in force since 2 January 2026), as enacted, punishes defamation by writing or pictures shown in public with up to one year and six months or a fine of up to Rp50 million, raised by a third where information technology is used, and only on the victim’s complaint (arts. 433, 440, 441).

Publicly expressing hostility, hatred or contempt towards a group of the population on grounds of race, nationality, ethnicity, colour, sex or disability carries up to three years or a fine of up to Rp200 million (art. 242). Spreading such statements through information technology, with violence resulting, carries up to four years (art. 243).

Law 1 of 2024 made its articles on these offences apply only until the Criminal Code took effect (art. II), and article 622 of the Code repeals, among other provisions, articles 27(1), 27(3) and 28(2) of the 2008 law. Subscriber information is released to law enforcers under article 36 of the 2020 regulation.

In decision 20/PUU-XIV/2016 of 7 September 2016 the Constitutional Court held that interception may be done only under a statute, that its procedure belongs in a dedicated statute, and that it should have court permission so that someone supervises it. Finding that procedural law missing, it held that electronic evidence from interception counts only if gathered for law enforcement at the request of the police, prosecutors or other bodies a statute designates.

Under the 2020 regulation, communication content and specific personal data require a district court chief judge’s order (art. 36(4)–(5)); data access is limited to offences carrying at least two years (art. 32), and system access to five years or more, or two to five with a district court order (art. 33). The order of the rows is the security score, and a server’s location is not a recommendation.