PSE Registration in Indonesia: Which Company Websites Must Register, and How

PSE registration in Indonesia is filed through OSS — the PB-UMKU menu at oss.go.id — not through the Komdigi PSE portal, and the filing itself is free from start to certificate. Before you file, check whether you are in scope at all. A company website that only shows a profile, an address, a gallery and a phone number usually is not. The obligation attaches to electronic systems used for six specific purposes, and meeting one of them is enough. Every step below was read off the official source on 1 October 2026.

Some vocabulary, because the acronyms do the work here. PSE stands for Penyelenggara Sistem Elektronik, electronic system operator. The private-scope register is run by Komdigi, the ministry formerly known as Kominfo, and the certificate it issues is a TDPSE.

The six criteria that put a company website in scope

These are transcribed from the official criteria page. You must register if your portal, site or application is used for any one of the following:

• offering and/or trading goods or services;
• providing, managing or operating financial transaction services;
• delivering paid digital content — downloads, email delivery, or delivery through another application to a user device;
• providing communication services: messaging, voice and video calls, email, online chat, networking platforms, social media;
• search engine services, or supplying electronic information in the form of text, audio, images, animation, music, video, film or games;
• processing personal data for operational activities serving the public in connection with electronic transactions.

One is enough. There is no visitor threshold, no small-business carve-out, and the filing is supposed to happen before the system is put in front of users.

That first row is the one people misread. A pure company profile really does sit outside the six criteria — but the moment you add a single contact form that stores a prospect's mobile number, the site moves down a row. Which is why the PSE question belongs in the feature planning, not in the week after launch. If you are commissioning a new site in East Java, raise it with whoever builds it; our own web development team in Sidoarjo treats it as part of the scoping conversation.

PSE registration in Indonesia, stage by stage

Four official stages, three of which happen inside OSS:

1. Clear the prerequisites. An active NIB, the relevant business licence completed, and an OSS account in the company's name. On KBLI codes, Komdigi's published answer is that every KBLI is already enabled for PSE filing in OSS, so there is no particular code to chase.
2. File through OSS. Log in at oss.go.id, open the PB-UMKU menu — Perizinan Berusaha Untuk Menunjang Kegiatan Usaha, business licensing that supports business activity — and select Tanda Daftar Penyelenggara Sistem Elektronik.
3. Describe the electronic system. The long part: system name, sector, URL, DNS or server IP address, business model, system functions and business process, the personal data you process, and where that data is managed and stored.
4. Confirm by email, then download the TDPSE. Click the confirmation link, log back in to oss.go.id, and download the electronically signed certificate.
5. Verify the listing. Your system should appear in the public register. Check it yourself through the Cari PSE search at pse.komdigi.go.id.

The official step-by-step guide, along with the BSSN system categorisation form and the personal data protection assessment tool, is downloadable at s.komdigi.go.id/pendaftaranpseprivat. The guides are in Indonesian only.

The fields that stall the filing

Beyond the system description, the form asks for three undertakings: that you guarantee information security, that you carry out personal data protection, and that you conduct system feasibility testing, each in accordance with prevailing regulation. They are easy to tick and heavy to honour, so treat them as a to-do list rather than a formality — if nobody has ever reviewed this side of your stack, start with a basic assessment alongside a cybersecurity team before you file.

The legal basis is three instruments: Government Regulation 71/2019, Minister of Communication Regulation 5/2020, and its amendment, Permenkominfo 10/2021. If anyone offers you a paid fast track, check the offer against those three first.

Cost and timing

Filing costs nothing at all. Komdigi states that the entire process through to issuance of the TDPSE carries no charge of any kind. A complete and confirmed application issues the electronically signed certificate automatically; for the financial sector, verification takes at least one working day.

What takes time is assembling the answers, not the system. Budget half a working day to write the business model description, list the personal data you collect, and confirm where your servers physically are. With those three ready, the form itself is a matter of hours.

What happens if you skip it

Administrative sanctions apply in four situations: failing to register; holding a registration but not updating its information; supplying information that is not accurate; or a request from another ministry or agency on the basis of a regulatory breach. The heaviest form is access termination — the site stops resolving from inside Indonesia.

The numbers are not hypothetical. As of 1 October 2026, the Komdigi statistics page records 18,447 registered operators covering 28,124 electronic systems, and 12 per cent of those systems carry a temporarily suspended status. Recovery runs through a normalisation request to [email protected] once the underlying information has been corrected.

Our own view, from doing this with clients in Sidoarjo and Surabaya: most genuinely profile-only websites do not need to register, and filing "just to be safe" is not a free move. Once you are on the register you are bound to update it whenever the URL, the server location or the categories of data you collect change, and failing to update is itself one of the listed grounds for sanction. But if your site already has a form, a catalogue with an order button, or payment, do not sit on it. The filing is free and the downside is one-sided.

Foreign operators are a separate track. A company with no Indonesian legal entity has no OSS account, so it files as a PSE Asing and also has to show that it serves users in Indonesia, does business in Indonesia, or offers its system here. If you are a foreign group whose Indonesian subsidiary runs the site, the subsidiary files through OSS as a domestic operator. Our IT consulting team maps which of the two applies in a single session, at no cost for the first conversation.