For businesses
Tech Law & Data Protection
Technology businesses move fast, and Indonesia’s rules on electronic systems, payments and personal data keep changing. We guide tech companies from activation to growth, and our certified Data Protection Officer can act as your company’s official liaison.
All information you share with us is treated as confidential.
01You may need this if
- You are launching a website, app or platform in Indonesia.
- You operate or plan a fintech or payment business.
- You process personal data and need to comply with the Personal Data Protection Law.
- You are integrating your systems with banks, payment providers or other partners.
02What we handle
Licensing & launch
- Registration as an electronic system operator
- Fintech and payment licensing
- Privacy policy, user agreement and terms and conditions
Data protection
- Acting as your Data Protection Officer
- Gap assessments, ROPA and DPIA
- Data transfer agreements
Integration & reporting
- System integration agreements with business partners
- Marketplace and aggregator arrangements
- Mandatory reports to the communications ministry, Bank Indonesia and OJK
03How we work with you
- 1
Assess
We review your product, data flows and business model against the applicable regulations.
- 2
Plan
We set out the licences, documents and controls you need, in the order you need them.
- 3
Implement
We prepare the documents, file the registrations and support integration with your partners.
- 4
Maintain
We handle mandatory reporting and keep your compliance up to date as the rules change.
04What to prepare
- Company documents and business licences
- A description of your product and how it works
- A map of the personal data you collect and where it goes
- Existing privacy policy and user terms
- Agreements with technology and payment partners
05Common questions
Does the Personal Data Protection Law apply to my company?
Law No. 27 of 2022 applies to organisations that process the personal data of people in Indonesia, including many companies based abroad. Its obligations have been fully in force since October 2024.
Do we need a Data Protection Officer?
A DPO is required when processing is carried out for public services, involves large-scale systematic monitoring, or large-scale processing of specific personal data. Our certified DPO can fill this role for you.
Do we need to register as an electronic system operator?
Most private companies that run websites, apps or platforms used in Indonesia must register as an electronic system operator (PSE) when they launch.
Every matter deserves a considered first conversation.
Tell us about your situation. A partner will get back to you within one business day.
Discuss your matter