PSE Registration for Foreign Digital Companies: Komdigi Compliance 2026

A SaaS company with no office, no employees, and no legal entity anywhere in Indonesia woke up one morning to find its platform inaccessible to every user in the country. Nothing about the product had changed. What had changed was a deadline the company never knew existed, because nobody on its team believed a business with zero physical presence in Indonesia could owe that country anything at all. That belief is exactly what gets foreign platforms blocked, and it has already happened to companies with far more resources and legal counsel than most.

The mechanism responsible is PSE registration, and the confusion around who actually has to do it, and how, has not gone away just because the ministry that runs it changed its name.

The Ministry Renamed Itself, the Obligation Did Not

Indonesia’s Ministry of Communication and Informatics, long known by its acronym Kominfo, has been operating under a new name, the Ministry of Communication and Digital Affairs, or Komdigi, since the government’s 2025 ministry restructuring. The rebrand shows up constantly in older compliance documentation, older contracts, and older advice still floating around online, all of which still say Kominfo. The underlying legal obligation these documents describe has not moved. It still traces back to Government Regulation No. 71 of 2019 on Electronic Systems and Transactions, operationalized through Minister of Communication and Informatics Regulation No. 5 of 2020 on Private Scope Electronic System Operators, as amended by Regulation No. 10 of 2021, with Government Regulation No. 5 of 2021 and Ministerial Regulation No. 3 of 2021 layering in the risk-based licensing standards that now govern how the registration itself gets processed.

What has not changed, and what trips up more foreign companies than any renaming ever could, is that this obligation carries no minimum size threshold. A platform with a hundred Indonesian users and a platform with ten million face the identical registration requirement. Komdigi has been explicit that even smaller platforms must register if they meet the underlying criteria, and the underlying criteria are broader than most foreign teams assume.

Public and Private Scope, and Why Almost Every Foreign Company Lands in One Bucket

Every Penyelenggara Sistem Elektronik, or Electronic System Operator, falls into one of two categories, and knowing which one applies determines the entire compliance path from that point forward.

PSE Lingkup Publik

This category covers electronic systems operated by state institutions or entities they appoint, the kind of system that typically lives on a .go.id domain. It is not the category a private foreign digital company needs to think about, and it is worth mentioning mainly so that it can be ruled out quickly.

PSE Lingkup Privat

This is the category that captures nearly every commercial digital business, and it applies under any one of three independent triggers, meeting a single one is enough:

• Offering services within Indonesia, regardless of where the company itself is legally domiciled
• Operating and conducting business in Indonesia, which can include maintaining local partnerships, marketing activity, or revenue generation tied to Indonesian customers
• Being used or offered within Indonesian territory, which covers the simple case of a platform being accessible to and used by people physically in the country

A foreign company does not need to satisfy all three. Any one of them is sufficient to trigger the obligation, which is precisely why companies with no formal Indonesian footprint at all still end up squarely inside PSE scope.

Explore Our Services Business Licensing in Indonesia

Registering Without a Local Entity Is Still Possible, and Still Required

One of the more persistent myths in this space is that PSE registration requires an Indonesian legal entity first. It does not. Komdigi has confirmed that foreign platforms operating entirely from abroad, with no PT PMA and no local office, are still expected to comply, and the registration itself runs through the OSS RBA (Online Single Submission, Risk-Based Approach) system regardless of entity status.

That said, companies that do establish a formal Indonesian presence gain real operational advantages once they do, since PSE registration data increasingly cross-references against other filings a locally incorporated entity would already be making. The mechanics of getting an entity through OSS RBA in the first place, including the account setup steps a foreign shareholder needs before anything else can happen, are covered separately in XPND’s step by step OSS RBA registration guide, and once an entity exists, the resulting NIB becomes a reference point across nearly every subsequent filing, a relationship explained in more depth in the site’s breakdown of what the NIB actually controls once it is issued.

What Komdigi Actually Reviews During Registration

PSE registration is not a technical security audit, and treating it like one leads companies to over-prepare in the wrong areas while missing what the reviewer is genuinely looking for. The review focuses on a handful of specific points.

• A description of the electronic system itself, covering how the service functions, which modules it uses, and where data processing actually takes place
• Confirmation of the operator’s legal status, typically an NIB for companies with an Indonesian entity, or equivalent documentation establishing the entity’s legitimacy for those without one
• The company’s approach to personal data processing, which increasingly gets read against Indonesia’s Personal Data Protection Law, Law No. 27 of 2022, fully in force since 17 October 2024

That last point deserves its own emphasis. PSE registration and PDP Law compliance are two separate obligations that increasingly get evaluated together in practice, even though satisfying one does not automatically satisfy the other. A company that registers as a PSE while treating user data casually is solving half the problem and leaving the more consequential half untouched.

The Cost of Getting This Wrong Has a Public Track Record

This is not a theoretical risk. When Kominfo first enforced a nationwide registration deadline in mid-2022, roughly 8,700 domestic and 200 foreign private electronic system providers registered ahead of the cutoff, and the ministry followed through on blocking those that did not. Yahoo and Valve Corporation’s Steam platform were both blocked and only restored after completing registration, a sequence that made international headlines precisely because neither company expected enforcement to actually happen against operators of their scale.

That willingness to act has not softened with time. In October 2025, Komdigi issued formal warnings to twenty five major global and domestic digital service providers over compliance gaps, a reminder that enforcement sweeps did not end when the initial 2022 deadline passed. A smaller platform serving a fraction of that user base carries no special protection from the same scrutiny. If a global gaming platform can be blocked over a missed registration, a niche booking tool or regional SaaS product is not operating below anyone’s radar.

Sector-Specific Layers Stack on Top of Base Registration

For a large share of foreign digital companies, PSE registration is the floor, not the ceiling. Certain sectors carry an additional licensing layer that only becomes available once base PSE registration is complete, since the sector-specific system checks against it directly. Health tech is a clear example. A digital pharmaceutical platform operating in Indonesia’s growing e-Pharmacy space needs a PSEF (Pharmaceutical Electronic System Operator) license from the Ministry of Health, and that application cannot proceed until the underlying PSE registration record has synchronized into the relevant government system. The specific requirements, technical documentation, and common causes of rejected submissions for that sector are covered in full in XPND’s guide to PSEF license requirements and registration.

A separate, frequently confused layer applies to companies selling digital goods or services directly to Indonesian consumers or businesses. PSE registration and PMSE VAT collector designation are two different obligations administered by two different parts of government, and a company can hold one without the other despite both applying to the same underlying platform. How that VAT collection obligation actually works under the current Coretax-integrated framework is explained separately in the site’s coverage of PER-12/PJ/2025 and VAT on digital services, which is worth reading alongside this piece for any company that both operates a platform and sells directly into the Indonesian market.

A Practical Checklist Once the Legal Groundwork Is Clear

With the scope question settled, most companies benefit from working through a short, ordered sequence rather than tackling every requirement at once.

• Confirm private versus public scope, and identify which of the three private-scope triggers applies
• Determine whether an Indonesian legal entity already exists or whether registration will proceed without one
• Prepare a clear, accurate description of the electronic system, its functions, and where data processing occurs
• Draft a personal data processing statement that can withstand scrutiny under the PDP Law, not just the PSE review itself
• Identify whether any sector-specific license, such as PSEF for health tech, will eventually depend on this registration being complete
• Establish a reliable local point of contact for compliance communication, even without a full local entity in place

None of these steps are individually difficult. What causes real damage is skipping the sequence entirely and discovering the obligation only after a blocking notice arrives.

XPND’s regulatory team works through this exact scope determination for foreign platforms before registration is filed, checking which trigger actually applies, whether a sector-specific layer is coming next, and whether the company’s data processing approach will hold up once PDP Law scrutiny follows. Getting blocked costs a platform its Indonesian user base overnight. Getting registered correctly the first time costs considerably less, and it never depends on how large the platform happens to be.