No. Provisions on software are broadly set out in the electronic information and transactions regulatory regime, which includes:

• Law No 11 of 2008 on Electronic Information and Transactions, as lastly amended by Law No. 1 of 2024 (“EIT Law”);
• Government Regulation No. 71 of 2019 on the Provision of Electronic Systems and Transactions (“GR 71”);
• Minister of Communications and Information Technology (“MCIT”) Regulation No. 20 of 2016 on Personal Data Protection in Electronic Systems (“MR 20”);
• MCIT Regulation No. 5 of 2020 on Private Electronic Systems Operators, as amended by MCIT Regulation No. 10 of 2021 (“MR 5”);
• Cyber and Crypto National Agency (BSSN) Regulation No. 8 of 2020 on Security in the Operation of Electronic Systems.

Additionally, certain aspects concerning software are also stipulated in sectoral regulations, such as: (i) Minister of Finance Regulation No. 190/PMK.04/2022 on the Release of Imported Goods for Use (procedures for software importation); and (ii) Law No. 28 of 2014 on Copyright (“Copyright Law”) (software copyright protection).

These are protected by copyright under the Copyright Law. Software is defined as a computer program (a set of instructions expressed as language, code, schematics, or an order intended to make a computer perform a certain function or achieve a certain result), which is included as an object of copyright protection. The creators are afforded automatic copyright protection for 50 years from first announcement (as registration is not a pre-requisite for copyright protection).

In the absence of an agreed contractual provision, the software developer, consultant, or other party will be entitled to ownership of the propriety rights in the newly created software. This is based on the Copyright Law, which mandates that the creator of a work is the automatic owner of copyrighted work created by them, unless agreed otherwise.

Yes, these are governed under the EIT Law and GR 71. The following are prohibited in relation to the operation of software/computer systems:

1. intentionally and illegally broadcasting, displaying, distributing, transmitting, and/or making accessible electronic information or documentation with content that violates decency, promotes gambling, is offensive or defamatory, or can extort/threaten people;
2. intentionally attacking the dignity or reputation of another person by accusing something, with the intention to make such matter be publicly known in the form of electronic information and/or electronic documents carried out through the electronic systems;
3. intentionally and illegally distributing and/or transmitting electronic information and/or electronic documents with the intention to unlawfully benefit themselves or others, forcing a person with threats of violence, threats of defamation or threats to reveal secrets to: (i) provide goods, which partly or wholly belong to that person or belong to another person, or (ii) provide loan, make acknowledgment of a debt, or write off receivables;
4. intentionally and illegally distributing and/or transmitting false or misleading news, resulting in consumer losses in electronic transactions;
5. intentionally and illegally spreading information intended to incite hatred or hostility towards certain individuals or groups of people based on their race, nationality, ethnicity, skin color, religion, belief, gender, mental disability or physical disability;
6. intentionally disseminating electronic information and/or electronic documents which they know contain false notification that cause riot in the society;
7. intentionally and illegally sending electronic information or electronic documentation that contains threats of violence or intimidation directly to the victim;
8. intentionally and illegally or unlawfully accessing in any way a computer or electronic system: (i) that belongs to another person, (ii) in order to obtain electronic information or documentation, or (iii) by violating, breaching, bypassing, or hacking a security system;
9. intentionally and illegally or unlawfully (i) intercepting or tapping electronic information or documentation held in a computer or electronic system that belongs to another party, or (ii) intercepting the transmission of non-public electronic information or documentation from, to, and in a computer or electronic system that belongs to another party, that may or may not alter, delete, or terminate electronic information or documentation being transmitted;
10. intentionally and illegally or unlawfully in any way: (i) changing, adding to, reducing, transmitting, damaging, omitting, moving, or concealing electronic information or documentation that belongs to another party or is owned by the public, or (ii) moving or transferring electronic information or documentation to an electronic system of an unauthorized person;
11. intentionally and illegally or unlawfully take action that disrupts an electronic system or renders an electronic system inoperable;
12. intentionally and illegally or unlawfully producing, selling, procuring for use, importing, distributing, providing, or owning: (i) computer hardware or software that is designed or specifically developed to facilitate the actions referred to in points (a) to (h) above, or (ii) a computer password, access code, or the like, that is intended to provide access to an electronic system in order to facilitate the action referred to in points (a) to (h) above;
13. intentionally and illegally or unlawfully manipulating, creating, altering, omitting, or damaging electronic information or documentation in such a way that it appears to be genuine;
14. intentionally and illegally or unlawfully committing an act referred to in points (a) to (i) above that causes losses to another person;
15. intentionally committing a prohibited act referred to in points (a) to (k) outside Indonesian territory against an electronic system located within Indonesian jurisdiction.

Further, the recently issued Law No. 1 of 2023 (“New Criminal Code”) stipulates that the following conduct will be subject to criminal sanction:

1. to unlawfully listen to, record, divert, modify, inhibit, or take note of the transmission of electronic information or documentation that is confidential, either by using a wired or wireless communications network;
2. to broadcast or disseminate the results of a discussion, or recording the above;
3. intentionally and illegally or unlawfully accessing the computer or electronic system of another person in any way;
4. intentionally and illegally or unlawfully accessing a computer or electronic system in any way for the purpose of obtaining electronic information or documentation;
5. intentionally and illegally or unlawfully accessing a computer or electronic system in any way by violating, bypassing, exceeding, or hacking its security system;
6. without permission, using or accessing a computer or electronic system in any way, with the intention of obtaining, altering, damaging, or eliminating information on national defense or international relations that may result in interference or harm the state or its relationship with the subjects of international law;
7. without permission, carrying out action that damages transmissions from programs, information, codes or orders protected by the state;
8. without permission or exceeding authority, using or accessing a computer or electronic system, either from within or outside the country, to obtain information from a computer or electronic system that is protected by the state;
9. without permission, using or accessing a government-owned computer or electronic system;
10. without permission or exceeding authority, damaging a state-protected computer or electronic system;
11. without permission or exceeding authority, damaging a computer or electronic system that is dedicated for community use;
12. affecting or disrupting the operation of a government computer or electronic system;
13. disseminating, trading, or utilizing an access code or similar input that can bypass computers or electronic systems, with the intention of misusing a government-used or -protected computer;
14. harming international relations via public messages by damaging a computer or other electronic system that is protected by the state and located within Indonesian jurisdiction;
15. without permission or exceeding authority, using or accessing a computer or electronic system in order to misuse for personal gain financial information from the central bank, a banking institution or financial institution, credit card issuer, payment card or a report containing personal financial data of a customer;
16. without permission, misusing data or accessing in any way credit card or payment card data belonging to other persons in electronic transactions for personal gain;
17. without permission or exceeding authority, misusing or accessing a protected computer or electronic system of the central bank, or a banking or financial institution for personal gain; or
18. disseminating, trading, or utilizing access codes or similar information that may be used to bypass a computer or electronic system with the intention of causing disruption that affects the electronic systems of the central bank, a banking or financial institution, and commercial activity within and outside the country; or
19. illegally using or accessing a computer or electronic system in any way, with the intention of obtaining, altering, damaging, or deleting government-owned information that must remain confidential or be protected.

Please note that the New Criminal Code is still under a 3-year grace period, thus, it would be in full force and effect in January 2026.

No: in essence, the use (and misuse) of software/computer systems is mainly subject to the provisions of the EIT Law and New Criminal Code (upon the lapse of the grace period).

Generally, the provision of software between a vendor and customer is subject to the laws and regulations cited in (1) above, except for sector-specific regulations (which are determined by the customer’s business activities).

Yes, in practice, this is typical. The market standard level of cap depends on type of software, license/subscription fee, and the purpose of the software. It is very common that the limitation would be based on the license/subscription fee paid by the customer to the software provider.

Confidentiality breaches, data protection breaches, breaches of applicable law, wilful or deliberate breaches are typically excluded from a financial cap on a software vendor’s liability to a customer, or is subject to a separate, enhanced cap in a separate, negotiated software transaction.

Currently, this is not yet the norm in Indonesia. However, this arrangement is not restricted under Indonesian laws.

No, there are none.

Other than the law cited in (1) above, IT outsourcing transactions are subject to sectoral laws (which are determined by a customer’s business activities). For instance, IT outsourcing in the financial services sector is subject to several requirements under the Financial Services Authority, “OJK”) and Bank Indonesia (“BI”) regulations, which are:

• OJK Regulation No. 11/POJK/03/2022 on Implementation of Information Technology by Commercial Banks;
• OJK Circular Letter No. 21/SEOJK.03/2017 SEOJK on the Implementation of Risk Management in the use of Information Technology in Public Banks (“SEOJK 21”);
• OJK Regulation No. 4/POJK.05/2021 on the Implementation of Risk Management in Using Information Technology by Non-Bank Financial Services Institutions (partially revoked by OJK Regulation No. 10/POJK.05/2022 on Peer-to-Peer Lending); and

BI Regulation No. 23/6/PBI/2021 on Payment Systems Providers.

Generally, individual staff are protected by Article 1367 Indonesian Civil Code, which provides that an individual will be responsible for damage that they have caused, as well as the action of those they supervise, or matters that are under their supervision. This includes employers and those assigned to manage the affairs of other individuals, who must take responsibility for damage caused by their subordinates in the course of duties assigned to them.

Telecommunications networks and services are covered under the following laws:

Currently the Indonesian Government is formulating the technical standards governing Internet of Things (IOT) (which may include the technical standards on mobile communications and newer connected technologies) devices. Considering the industry is emerging and the SSO is yet to be established, in principle, mobile communications and newer connected technologies are governed under electronic information and transactions and the personal data protection regulatory regime. Additionally, we have noted that the government has adopted industry-acknowledged ISO standards for IOTs into Indonesian National Standards (SNI), such as SNI ISO/IEC 30141:2018, SNI ISO/IEC 21823-1:2019, and SNI ISO/IEC 19637:2016.

The current technical standards on mobile communications and newer connected technologies is referring to SNI ISO/IEC 21823-1:2019. However, this standard has not been set as a mandatory standard. Thus, we have not seen significant impact on this aspect.

None that we are aware of.

Currently, the MCIT is the responsible body for data protection. However, Law No. 27 of 2022 on Protection of Personal Data (“PDP Law”) mandates the establishment of an independent Data Protection Authority (“DPA”) under the supervision of the President, with extensive regulatory, monitoring, enforcement, dispute resolution, and investigative authority. To date, the DPA has yet to be established.

In addition to the above general regulations, additional personal data protection provisions under sector-specific regulations apply to specific fields of business (e.g., e-commerce, banking, financial services, and medical services).

The sanctions that can be imposed on non-compliance with data protection law encompass:

• administrative sanctions: verbal warning, suspension of activities, access blocking, culminating in a fine of up to 2% of the annual income/revenue (but not yet clear whether this refers to worldwide annual revenue or only that generated in Indonesia); and
• criminal sanctions: imprisonment of up to 5 years and/or a fine of up to IDR 50 billion (for corporations), as well as additional criminal sanctions such as dissolution (of a corporation).

In addition, the PDP Law allows data subjects to submit a civil claim against a data controller/processor if they suffer damages as a result of unlawful processing of their personal data (the maximum value of which has not yet been stipulated).

No, reference to external data protection regimes would only be included if the contract contains any elements that would trigger any of such external data protection regimes (e.g., involving foreign data controller/processor or involving the processing of foreign data subjects’ personal data). Other than that, in our observations, technology contracts in Indonesia only refer to Indonesian data protection laws and regulations.

The MCIT is essentially responsible for AI-related matters.

Indonesia has yet to introduce a law or regulation specifically on AI-related matters. However, generally, the EIT Law and its implementing regulations (GR 71, MR 20, MR 5), PDP Law and intellectual property law apply to various aspects of AI.

Several institutions have also published guidelines on the use of AI:

Indonesia has yet to introduce a law/regulation that specifically addresses the use of Large Language Models and/or generative AI. However, the soft laws under Question 21 above also covers general guidelines on natural language processing, deep learning programs, and generative AI.

As currently there are no specific AI laws/regulations in Indonesia, no mandatory provisions that need to be inserted in the technology contracts regarding AI risk. However, the MCIT has issued Circular Letter No. 9 of 2023 on the Ethics of AI, which encourages the operator of AI to observe the safety of using AI to ensure privacy, personal data protection, and the user’s rights.  In our observation, the practice to insert such AI risk provision is more common – for example inserting the limitation on AI usage in technology vendors’ contract.

As above, currently no mandatory provisions that need to be inserted in the technology contracts regarding AI risk. It is also becoming more common to insert intellectual property-related provisions in using AI – for example usage of protected intellectual property in AI systems.

a. Search Engines

b. Marketplace

1. Privacy: as the grace period of the PDP Law will lapse in October 2024, it is expected that the MCIT will publish regulations or guidelines for implementation of the PDP Law – the Draft GR on implementation of the PDP Law has been circulated. This would help to clarify privacy compliance requirements for any party that processes personal data.
2. Cybersecurity: in light of increased data security threats, ransomware attacks and phishing, including the recent cyberattack damaging the government’s national database, it is expected that the Indonesian government would be increasing scrutiny and more strict requirements in this field.
3. Artificial Intelligence: as AI (especially widespread use of generative AI) starts to proliferate worldwide, the Indonesian government is becoming acutely aware of the crucial need to regulate AI for everyone’s benefit and protection.

Not that we are aware of. Nevertheless, it should be anticipated that the practice would be more common in the future.

As a background, Indonesia has submitted to United Nations Framework Convention on Climate Change (UNFCCC) its Long-Term Strategy for Low Carbon Resilience (LTS-LCCR) 2050, which aims to achieve Net Zero Emissions in 2060. From 2021 to 2025, the Ministry of Energy and Mineral Resources will issue a number of regulations, including on non-renewable energy (NRE), early retirement of coal-fired power plants, expansion of co-firing at coal-fired power plants, and conversion of diesel plants to running on gas and NRE power. These developments signifies the increasing in awareness of environmental sustainability by the State. Accordingly, it should be anticipated that provisions on sustainability, net-zero obligations, or similar environmental commitments would be more commonly adopted in practice.