Prevent Compliance Risk for Data Center Operations in Indonesia

Operating a data center involves more than infrastructure. Companies must also address business licensing, PSE registration, data protection, environmental approvals, and other regulatory requirements. 

As requirements vary by business model, identifying the applicable data center compliance obligations early can help prevent licensing gaps, operational delays, and missed renewal deadlines. 

Key Takeaways

• KBLI 63102 under KBLI 2025 is the main classification for data center infrastructure, hosting, cloud services, and colocation activities. 
• PP No. 28/2025 and Permenkomdigi No. 15/2025 are key regulations within Indonesia’s current risk-based licensing framework for this sector. 
• PSE registration is separate from the NIB and business license, and it applies when the operator qualifies as a Private-Scope PSE. 
• A data center doesn’t automatically need a telecommunications license unless it directly provides regulated telecommunications networks or services. 
• Operators should manage business licensing, PSE obligations, data protection, facility approvals, environmental requirements, and ongoing reporting as part of one compliance framework. 

Indonesia Data Center Compliance at a Glance 

Compliance Area	What to Confirm
Business Classification	Use the correct KBLI 2025, including KBLI 63102 for core data center activities.
Business Licensing	Obtain the required NIB and OSS licenses.
PSE Registration	Confirm whether Private-Scope PSE registration applies.
Telecommunications	Check if regulated telecom services are provided directly.
Data Protection	Meet applicable controller or processor obligations.
Facility Approvals	Secure required spatial, environmental, building, and operational approvals.
Ongoing Compliance	Maintain required reporting and regulatory updates.

The exact requirements should be mapped against the operator’s business model, location, infrastructure, customers, and services before investment or construction commitments are finalized, helping you feel prepared and in control. 

Data Center Regulation in Indonesia 

Data center operators may need to comply with several regulatory areas depending on their business model and facility setup: 

• Business Licensing: PP No. 28/2025 and Permenkomdigi No. 15/2025. 
• PSE and Electronic Systems: PP No. 71/2019 and Permenkominfo No. 5/2020, as amended. 
• Personal Data Protection: Law No. 27/2022. 
• Telecommunications: PP No. 46/2021 for regulated telecom activities. 
• Building Compliance: PP No. 16/2021, including PBG and SLF requirements. 
• Environmental Compliance: PP No. 22/2021 for applicable environmental approvals. 

The exact requirements depend on the services, location, and scope of the data center operation, and staying informed about regulatory updates is essential for ongoing compliance. 

What KBLI Applies to Data Center Operations in Indonesia? 

Under KBLI 2025, KBLI 63102 is the main classification for commercial data center and colocation activities. It covers hosting, cloud infrastructure, server and network space rental, electronic data storage, and related computing infrastructure services. 

KBLI	Business Activity	When It Applies
63102	Computing Infrastructure, Hosting, and Related Activities	Data center colocation, hosting, cloud infrastructure, server/network space rental, and data storage
63101	Data Processing Activities	Data processing, migration, cleansing, big-data management, and related processing services for clients

For a standard data center in Indonesia, KBLI 63102 is therefore the primary classification. KBLI 63101 may apply only where the company also performs separate data-processing activities. 

InCorp Indonesia (an Ascentium Company) can assist with KBLI assessment, company incorporation, and OSS business licensing for data center investments. Talk to our team -> 

What Licenses are Required to Build and Operate the Facility? 

A data center project may require both business licenses and facility approvals, depending on its scale and activities. 

• NIB and OSS Business Licensing: Based on the registered KBLI and applicable risk-based requirements. 
• Spatial and Location Requirements: To confirm the site is suitable for the planned development. 
• Environmental Approval: This may include AMDAL or UKL-UPL, depending on the project’s scale and impact. 
• Persetujuan Bangunan Gedung (PBG): Building plans must comply with the applicable building approval requirements. 
• Sertifikat Laik Fungsi (SLF): Confirms that the completed facility is fit for its intended use. 
• Sector-Specific Approvals: Additional requirements may apply for PSE, telecommunications, or other regulated activities. 

Mapping these approvals early can help prevent delays during construction, commissioning, or commercial operations. 

READ MORE:

• Data Center Recruitment in Indonesia: How to Hire the Right Talent 
• Why Indonesia’s Data Center Market Offers Strong Potential 
• Understanding The New Data Protection Regulations in Indonesia 

PSE, Telecommunications, and Data Protection Requirements 

Three areas require particular attention because they depend heavily on the data center’s actual services. 

PSE Registration 

• Applies to businesses that qualify as Private-Scope Electronic System Operators. 
• Registration is separate from the NIB and other business licenses. 
• Applicability should be assessed based on the electronic systems and digital services operated. 

Telecommunications 

• Using connectivity from licensed carriers doesn’t automatically require a telecommunications license. 
• Additional licensing may apply if the company directly provides regulated network, connectivity, interconnection, or telecommunications services. 

Data Protection 

• Law No. 27 of 2022 applies to the processing of personal data. 
• Obligations depend on whether the operator acts as a data controller, processor, or both. 
• Requirements may include security safeguards, contractual controls, breach management, and notification within 3 x 24 hours where applicable. 
• Indonesia doesn’t impose a blanket rule requiring all private-sector data to be stored domestically, although sector-specific restrictions may still apply. 

What Ongoing Reports Must Operators Submit? 

Reporting requirements vary depending on the data center’s licenses and activities. Common obligations may include: 

• LKPM Reporting: Required for companies subject to investment reporting through OSS. 
• PSE Updates: Registered PSEs must keep their information up to date. 
• Environmental Reporting: May be required under the facility’s environmental approval. 
• Data-Breach Reporting: Applies where notification is required under the PDP Law. 
• Other sector reports: May apply if the company also provides regulated telecommunications or other services. 

Operators should align reporting with the licenses and approvals they hold. 

What Happens When Data Center Requirements are Missed? 

Non-compliance can affect both digital operations and the underlying business. Potential consequences include: 

• PSE access blocking for unregistered or non-compliant electronic systems. 
• Data protection sanctions, including fines of up to 2% of annual revenue or income. 
• Licensing issues that may affect continued operations. 
• Construction or commissioning delays due to incomplete facility approvals. 
• Expansion risks if new services are added without updating the company’s licenses. 

For this reason, data center compliance should be reassessed when the facility expands its services, capacity, location, or operating model, rather than only upon the company’s initial incorporation. 

Protect Your Data Center Operations from Compliance Risk 

Setting up or expanding an Indonesia data center requires the right licensing, compliance, and workforce structure from the start. InCorp Indonesia (an Ascentium Company) can support you with: 

• Company incorporation and business setup 
• KBLI, NIB, and OSS licensing 
• Environmental permit coordination 
• LKPM reporting and ongoing compliance 
• Recruitment and hiring support for data center roles 
• Employer of Record (EOR) and payroll support, where needed 

Planning to establish or expand a data center in Indonesia? Fill out the form below to strengthen your setup, compliance, and hiring process. 

Frequently Asked Questions