Indonesia

Indonesia has no binding statute or regulation dedicated to AI-transparency, output-labelling, or risk-classification duties for an AI system as such.

The Electronic Information and Transactions Law's electronic-agent provisions, in force since 2008 and unaffected by the Law's 2016 and 2024 amendments, allocate legal responsibility to whoever operates an automated system used to conduct an electronic transaction, a definition that reaches a chatbot or another AI-driven agent, and require certain electronic-agent operators to let a user correct information before a transaction completes.

Indonesia's Personal Data Protection Law gives a data subject a right to object to a decision based solely on automated processing, including profiling, that has a legal or significant effect; that duty attaches to the processing of personal data rather than to the use of AI as such and is documented under the privacy topic.

Two instruments describe AI-specific conduct without binding anyone: Ministry of Communication and Digital Affairs (Komdigi, formerly Kominfo) Circular Letter No. 9 of 2023 sets out seven non-binding ethical principles for AI use, and the Financial Services Authority (OJK) has issued and updated a non-binding sectoral Code of Ethics for AI use in financial technology.

Two draft Presidential Regulations, one on AI ethics and safety and one on a national AI roadmap, were reported in mid-2026 government drafting materials as still awaiting signature and are not yet law.

Indonesia's comprehensive private-sector data-protection law is Law No. 27 of 2022 on Personal Data Protection (Undang-Undang Pelindungan Data Pribadi, UU PDP), signed and promulgated 17 October 2022, with a two-year adjustment period reported to have ended 17 October 2024.

Article 4 distinguishes specific personal data, the sensitive category, from general personal data; the official elucidation to Article 4(2)(b) defines biometric data as data enabling unique identification from a person's physical, physiological, or behavioral characteristics, naming a facial image expressly and, more broadly, reaching a voice-derived identifier on the same general language.

The Act's substantive duties, including consent, sensitive-category handling, breach notification, cross-border adequacy, and data-subject rights, are themselves statutory and binding today, but nine mandated implementing regulations (Peraturan Pemerintah) remained unissued and the dedicated supervisory institution had not been formally established as of the date shown, so the procedural mechanics for several duties, including the fine-calculation procedure and the automated-decision objection procedure, are left to regulations that do not yet exist.

Article 12 grants a statutory right to sue for compensation, and Article 57 sets an administrative fine of up to 2 percent of annual revenue, with its own imposition procedure likewise awaiting the pending regulation.

Indonesia has no scraping-specific statute, so general law governs each dimension separately. The Electronic Information and Transactions Law's unauthorised-access offence reaches a computer or system accessed without right regardless of whether any security measure is defeated, with a higher penalty tier reserved for access that breaches a security system, and no reported case has tested whether reading a public, unauthenticated page counts as access "without right".

The Copyright Law grants an exclusive reproduction right requiring the rights holder's permission, carries only a narrow research and criticism exception conditioned on not harming the creator's reasonable interest, and creates no text-and-data-mining exception for AI training.

The same Act protects a database as a copyrightable compilation, expressly excluding a database from the personal-use copying exception that otherwise permits single copies of published works, but creates no sui generis database right independent of that compilation-copyright theory.

The Personal Data Protection Law's lawful-basis requirement applies to personal data collected from a public Indonesian website on the same terms as any other collection, since its exhaustive list of lawful processing grounds carries no basis keyed to information the data subject has made public.

No Indonesian statute or reported case establishes a scraping-specific unfair-competition, misappropriation or trespass doctrine, and none assigns legal weight to a robots.txt directive or imposes an AI-training-specific rule distinct from the copyright and personal-data findings above. No Indonesian court decision on the enforceability of a browsewrap or clickwrap terms-of-service against a scraper was located.

Indonesia's product-security and cyber-resilience posture for a private or government operator rests on Government Regulation No. 71 of 2019 on the Operation of Electronic Systems and Transactions (PP PSTE), signed by President Joko Widodo October 4, 2019, promulgated and effective October 10, 2019, and binding every Electronic System Operator (Penyelenggara Sistem Elektronik), whether a government body or a private business, without a sector or size gate.

Article 3 states the operator's general duty to run its Electronic System reliably and securely and to answer for its proper operation; Articles 23 and 24 operationalize that duty into a security-system requirement, secure the system's components and maintain procedures, means, and technical measures, such as antivirus, anti-spam, a firewall, intrusion detection or prevention, or an information security management system, to prevent and counter a threat or attack that causes disruption, failure, or loss; and Article 24(3) adds an incident-reporting duty triggered by a serious system failure or disruption caused by another party's act (an attack or intrusion), requiring the operator to secure the affected Electronic Information or Document and report immediately, at the first opportunity, to law enforcement and the relevant Ministry or Agency, with no numeric clock stated.

Articles 39 and 40, in the same Government Regulation's chapter on an Electronic Agent (a device within an Electronic System that carries out an action on Electronic Information automatically for a user, such as an automated transaction or e-commerce system), add a more specific security-control duty for that narrower class of operator: a standard operating procedure meeting six named principles, confidentiality, integrity, availability, authenticity, authorization, and non-repudiation, together with identity-authentication and authorization testing before completing a transaction.

A violation of Articles 23, 24, 31, 32, 39(2), or 40 can draw an administrative sanction from the Minister responsible for communications and informatics (today the Ministry of Communication and Digital Affairs), a written warning, an administrative fine of an amount this Government Regulation does not itself fix, temporary suspension, access termination, or removal from the operator registry, under Article 100; Article 100's own sanction list does not name Article 3 itself.

Indonesia has no enacted statute setting security requirements a connected device or software product must meet before or after it is placed on the market: the Directorate General of Resources and Postal and Informatics Devices (SDPPI) certification regime that reaches an IoT or telecommunications device tests radio-frequency and technical-standard compliance rather than cybersecurity, the same posture this profile has recorded for Japan's JC-STAR label and Singapore's Cybersecurity Labelling Scheme.

Ministerial Regulation No. 5 of 2020 on Private-Scope Electronic System Operators (Permenkominfo 5/2020) requires registration and a declaration that the registrant will meet information-security duties under prevailing law, but it states no security standard of its own beyond that cross-reference to PP PSTE, so it is not raised as a separate instrument here.

Presidential Regulation No. 82 of 2022 on the Protection of Vital Information Infrastructure (Perpres 82/2022) creates a critical-information-infrastructure regime, coordinated by the National Cyber and Crypto Agency (BSSN) and elaborated by BSSN's own 2023 regulations on identification, a protection framework, workforce capacity, and cybersecurity-maturity measurement, binding an operator the government individually designates as holding Vital Information Infrastructure across named strategic sectors (energy, transportation, tourism, finance, health, information and communication, food, defense, and others the President names); because that bound-party class turns on an individual government designation rather than on any activity this corpus's vocabulary can express, it is recorded here rather than raised against a declared activity, the same treatment this profile gives Japan's designated critical-infrastructure operators, Singapore's Cybersecurity Act classes, DORA's financial entities, and New York's Department of Financial Services Part 500 covered entities.

A dedicated Cybersecurity and Cyber Resilience Bill (RUU Keamanan dan Ketahanan Siber) has been under active deliberation in a House of Representatives working committee since June 2026, part of the 2026 National Legislation Program, but no enacted text exists, so it is named here as a pending development rather than treated as an instrument.

Indonesia's Personal Data Protection Law (UU No. 27/2022) carries its own data-security-safeguards clause and breach-notification duty, already this jurisdiction's privacy-topic finding rather than repeated here, and the Electronic Information and Transactions Law's unauthorized-access offense is already this jurisdiction's scraping-topic finding. No private right of action for the security duties described here was located; enforcement is administrative, through the Minister, under Article 100.

Indonesia's dedicated online child-protection instrument is Government Regulation No. 17 of 2025 on the Governance of Electronic System Operation in Child Protection, implementing Articles 16A(5) and 168(3) of the twice-amended Electronic Information and Transactions Law and in force since 27 March 2025.

It binds every Electronic System operator, public and private, that offers a product, service, or feature a child can use or access, sets five age bands from 3 to under 18, and requires disclosure of minimum age limits, an age-verification mechanism, and a complaint-reporting mechanism.

Ministerial oversight and administrative sanctions apply; the Regulation's specific sanction types are not described here, and detailed age-band and verification procedures are further delegated to an implementing Peraturan Menteri.

Indonesia has no press-publisher neighbouring right and no mandatory platform-to-publisher bargaining code; the Copyright Law's own exceptions are the only provisions reaching an aggregator's reproduction of news content.

Article 43(c) permits taking actual, current news, in whole or in part, from a news agency, broadcasting institution, newspaper, or similar source, provided the source is cited in full, without a headline-length or short-extract cap and without restricting the taking to the press industry itself.

Article 43(d) separately permits producing and disseminating copyrighted content through information and communication technology media where the activity is non-commercial, benefits the creator, or the creator has stated no objection to it. No reported Indonesian decision applies either exception to a systematic news aggregator as opposed to an individual taking or quoting a published work.

No statute or case law addresses whether a hyperlink is itself a communication to the public, or whether framing or inline display changes the answer, and no hot-news or misappropriation doctrine distinct from these copyright exceptions was located. The Act predates the concept of a machine-readable text-and-data-mining reservation, so no opt-out mechanism of that kind exists.