Electronic Signatures in Indonesia: Two Ways to Sign a PDF, and When the Difference Bites

There are two ways to put an electronic signature in Indonesia on a PDF, and Indonesian law recognises both. The free route takes two minutes: open the file in any PDF reader, drop your signature in, save a new copy. The certified route runs through a provider on the government register — about 15 minutes of identity checks once, then anything from Rp0 for a small quota to Rp54.000 a month. The gap between them only shows up when somebody disputes the document. Every rule, price and name below was read from a primary source on 3 October 2026.

The mechanics are not the hard part. Knowing which of the two a given document deserves is.

The two kinds, and what the law says about each

Government Regulation 71 of 2019 (PP 71/2019), Article 60(2), splits electronic signatures into certified and uncertified. Both are valid. The official elucidation of that same article settles the difference in one line: the type you use affects the strength of the evidence. Not whether the signature counts — how hard it is to argue with.

One wrinkle worth knowing early. When the signature represents a company rather than a person, PP 71/2019 Article 59(2) calls it an electronic seal, and it is the company that gets registered, not an individual. Deciding who in your organisation may seal what is a governance question before it is a technical one, which is why it usually moves faster with an IT consultant in Sidoarjo and your legal people in the same room.

Signing a PDF the free way

This is the route most Indonesian offices already use for delivery notes, internal memos and meeting minutes.

1. Open the file in a PDF reader. Acrobat Reader on Windows, Preview on a Mac, the built-in reader on a phone. All of them already have the feature.
2. Find the signature tool. Acrobat Reader calls it Fill & Sign; Preview hides it behind the markup icon.
3. Create the signature once. Draw it on a trackpad, photograph it off paper, or type it. It is stored and reused after that.
4. Save a new file, do not overwrite. Keep the signed version separate so the revision trail stays readable later.

Signing it the certified way

More setup, but only at the start.

1. Pick a provider off the official register. It lives at tte.komdigi.go.id under Daftar PSrE. There were eleven names on it on 3 October 2026.
2. Register and verify your identity. An Indonesian ID card, a selfie, usually a short liveness capture. This is the slow part — roughly 10 to 15 minutes, done once.
3. Upload the PDF and place the signature. With several signers, the platform sends each person a link and waits for the set to complete.
4. Download the result and keep the verification record. The file carries the electronic certificate inside it. That certificate, not the picture of a signature, is what a reviewer checks.

Who is allowed to issue certificates in Indonesia

Indonesia runs a single-root system: every provider has to be recognised by the minister and chain up to the government-operated root. That keeps the list closed and short. Here it is as it stood when checked.

If a signed document reaches you and you are not sure it is genuine, Komdigi runs a checker at tte.komdigi.go.id/verifyPDF: upload the PDF and it names the issuing provider. Almost nobody does this, which is a shame, because forged company paperwork now arrives as a file far more often than as a break-in — one of the first habits we push when we take on cybersecurity work for a client.

The six conditions that make an electronic signature valid

Article 11(1) of the 2008 Electronic Information and Transactions Law lists six, and its elucidation calls them minimum requirements — not a menu. PP 71/2019 Article 59(3) repeats them word for word. In plain terms:

1. The signature creation data belongs only to the signer.
2. At the moment of signing, that data is in the signer’s control alone.
3. Any later change to the signature itself can be detected.
4. Any later change to the document it is attached to can be detected.
5. There is some means of identifying who the signer was.
6. There is some means of showing the signer agreed to the contents.

Read the third and fourth again while picturing a signature image pasted into a PDF. The image objects to nothing. Anyone who opens the file can change a figure, save it, and the signature still sits there looking untouched. The certified route closes that hole by binding the document’s contents to the certificate: alter one character and verification fails.

So which documents are worth the certified route

In our experience most day-to-day company paperwork is not. Delivery notes, internal memos, minutes — the free route is fine, and forcing certified signing on everything just creates work. Four categories do earn it: agreements with outside parties, anything going to a bank or an insurer, project handover records, and anything likely to be read one day by someone who does not trust you.

The certified route carries a cost nobody selling it mentions: the other side has to register and hand over identity data too. A contractor in Candi, Sidoarjo, abandoned it for twelve small vendors when five of them refused to upload their ID cards to an app they had never heard of. The courier run they were trying to replace cost Rp30.000 a trip and three days of waiting, so the saving evaporated. They ended up signing the master contract the certified way and the work orders under it the free way. That is a sensible compromise, not a failure.

If the signing has to happen inside your own system — an approve button in a purchasing app that emits a signed PDF on the spot — most providers on that register expose a programming interface for it. Budget two to four weeks, and get help from a software house that has wired one up before: the part teams get wrong is rarely the integration itself, it is key storage and the audit trail.