CyberInsight Asia

Southeast Asia

Indonesia

Last updated:

CyberInsight Asia assessment Seed score

Risk score
~58
Country risk level
Medium-high
U.S. coercion and market-exclusion risk
Medium-low
Maturity
52CMM level: Level 3 Defined · Developing
Composite risk index
1.12Capability under pressure
Quadrant
Nurture
Last verified

Scores and risk labels are our own assessment, based on public sources as of the date shown. They are opinions, not findings or statements of fact about any government, organisation or group.

Scores start from a seeded CyberInsight assessment and move as new evidence is recorded. A dimension with no new evidence keeps its last valid contribution.

These dimensions have no evidence yet and are held unchanged: Critical-infrastructure exposure, Regulatory enforcement capability (inverse), Enterprise practice, Geopolitics and great-power risk, Historical incident severity, International cooperation, Laws and regulations, Regulatory capability, Strategy, Threat activity

automated calibration: not run · See the Methodology page for how scores are produced

Trend

A trend needs at least two monthly points; there is only one so far.

Automated coverage

Limited automated coverage

  • Automated coverage is limited: some official sources cannot currently be read, so the content below may be incomplete.
  • Last run (2026-10-12): 1 of 6 tier-1 sources readable.
  • Register areas only partly verified: cybersecurity, personal data, cybercrime, finance sector rules, regulator
  • Register areas not yet verified: critical infrastructure, telecom security, telecom sector rules

This means some official sources cannot currently be read automatically, so this page may be incomplete. It does not mean the related laws or events do not exist.

Threat landscape

Threat items are not yet attributed to this jurisdiction.

Industry focus

Industry focus will be generated once sourced material exists.

Compliance points

cybersecurity

Verification state: Partly verified

  • Government Regulation No. 71 of 2019 on the Operation of Electronic Systems and Transactions (unofficial English translation of the name)
    Government Regulation No. 71 of 2019 on the Operation of Electronic Systems and Transactions (unofficial English translation of the name) (Peraturan Pemerintah Nomor 71 Tahun 2019 tentang Penyelenggaraan Sistem dan Transaksi Elektronik): in force, As of 2026-10-12 · Source
  • OJK Regulation No. 11/POJK.03/2022 on the Implementation of Information Technology by Commercial Banks (unofficial English translation of the name)
    OJK Regulation No. 11/POJK.03/2022 on the Implementation of Information Technology by Commercial Banks (unofficial English translation of the name) (Peraturan Otoritas Jasa Keuangan Nomor 11/POJK.03/2022 tentang Penyelenggaraan Teknologi Informasi oleh Bank Umum): in force, As of 2026-10-12 · Source

personal data

Verification state: Partly verified

  • Law No. 27 of 2022 on Personal Data Protection (unofficial English translation of the name)
    Law No. 27 of 2022 on Personal Data Protection (unofficial English translation of the name) (Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi): in force, As of 2026-10-12 · Source

cross-border data

Verification state: Verified

  • Law No. 27 of 2022 on Personal Data Protection (unofficial English translation of the name)
    Law No. 27 of 2022 on Personal Data Protection (unofficial English translation of the name) (Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi): in force, As of 2026-10-12 · Source

incident reporting

Verification state: Verified

  • Law No. 27 of 2022 on Personal Data Protection (unofficial English translation of the name)
    Law No. 27 of 2022 on Personal Data Protection (unofficial English translation of the name) (Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi): in force, As of 2026-10-12 · Source
  • Government Regulation No. 71 of 2019 on the Operation of Electronic Systems and Transactions (unofficial English translation of the name)
    Government Regulation No. 71 of 2019 on the Operation of Electronic Systems and Transactions (unofficial English translation of the name) (Peraturan Pemerintah Nomor 71 Tahun 2019 tentang Penyelenggaraan Sistem dan Transaksi Elektronik): in force, As of 2026-10-12 · Source

cybercrime

Verification state: Partly verified

  • Law No. 1 of 2024, second amendment to the Electronic Information and Transactions Law (unofficial English translation of the name)
    Law No. 1 of 2024, second amendment to the Electronic Information and Transactions Law (unofficial English translation of the name) (Undang-Undang Nomor 1 Tahun 2024 tentang Perubahan Kedua atas Undang-Undang Nomor 11 Tahun 2008 tentang Informasi dan Transaksi Elektronik): in force, As of 2026-10-12 · Source

finance sector rules

Verification state: Partly verified

  • OJK Regulation No. 11/POJK.03/2022 on the Implementation of Information Technology by Commercial Banks (unofficial English translation of the name)
    OJK Regulation No. 11/POJK.03/2022 on the Implementation of Information Technology by Commercial Banks (unofficial English translation of the name) (Peraturan Otoritas Jasa Keuangan Nomor 11/POJK.03/2022 tentang Penyelenggaraan Teknologi Informasi oleh Bank Umum): in force, As of 2026-10-12 · Source
  • OJK Board Member Regulation No. 1 of 2026 on the Implementation of Information Technology by Commercial Banks (unofficial English translation of the name)
    OJK Board Member Regulation No. 1 of 2026 on the Implementation of Information Technology by Commercial Banks (unofficial English translation of the name) (Peraturan Anggota Dewan Komisioner OJK Nomor 1 Tahun 2026 tentang Penyelenggaraan Teknologi Informasi oleh Bank Umum): in force, As of 2026-10-12 · Source

regulator

Verification state: Partly verified

No record can be shown from the Law Register yet.

Notes for ICT equipment suppliers

This section is based on publicly available sources only.

Suggested checks

  • cybersecurity

    Check what Government Regulation No. 71 of 2019 on the Operation of Electronic Systems and Transactions (unofficial English translation of the name) requires of ICT equipment suppliers and operators.

    Source
  • cross-border data

    Check what Law No. 27 of 2022 on Personal Data Protection (unofficial English translation of the name) requires of ICT equipment suppliers and operators.

    Source
  • incident reporting

    Check what Law No. 27 of 2022 on Personal Data Protection (unofficial English translation of the name) requires of ICT equipment suppliers and operators.

    Source

Latest updates

No recent updates yet.