Electronic Signatures That Hold Up in Indonesia

For Indonesian electronic contracts, choose a signing process that can show identity, consent, and document changes. Certified signatures provide technical evidence, not a guarantee of winning a dispute. Uncertified signatures still need to meet the ITE Law conditions. For high-risk transactions, check the requirement for signatures secured by an electronic certificate.

This matters to anyone who signs contracts by email: vendors, freelancers, software houses, small firms buying from them. Some such contracts are "signed" with an image of someone's signature pasted onto a PDF. That usually works fine, right up until the day someone says "I never signed that".

What does Indonesian law actually require?

The rules sit in three places.

The conditions in PP 71/2019 Article 59(3) are worth reading in plain words, because they are the whole game:

1. The data used to create the signature is linked only to the signer.
2. At the moment of signing, that data is under the signer's control alone.
3. Any change to the signature after signing can be detected.
4. Any change to the signed document after signing can be detected.
5. There is a specific way to identify who the signer is.
6. There is a specific way to show the signer agreed to the document.

Notice what is missing. Nothing in that list says "must be certified". The law does not reject a simple e-signature. It asks whether you can show these conditions were met.

Certified or uncertified: what is the real difference?

Think of two ways to hand someone a signed letter. In the first, you sign at home and post it. It is your signature, but if you later deny it, the other side has to dig up evidence that you wrote it. In the second, you sign at a counter where an officer checked your ID card, watched you sign, and sealed the envelope with a stamp that breaks if anyone opens it. Both letters are signed. The second provides additional process evidence; electronic certification uses certificates and cryptographic checks rather than a literal witness.

That witness is the electronic certification provider, called a PSrE (Penyelenggara Sertifikasi Elektronik). PP 71/2019 Article 60(3) says a certified signature must:

• meet the six conditions above,
• use an electronic certificate issued by an Indonesian PSrE, and
• be made with a certified signature-creation device.

Hukumonline's October 2025 piece on certified signatures puts the practical risk bluntly: documents with uncertified signatures can be rejected by official digital systems because their legality cannot be verified.

One trap catches many companies. A signature through a global platform such as DocuSign or Adobe Acrobat Sign is still an uncertified signature under Indonesian law, unless the platform issues it with a certificate from an Indonesian PSrE. PP 71/2019 ties certification to Indonesian providers. The global brand does not change that.

Is a scanned signature enough?

A signature image alone does not show who placed it or whether the PDF changed. The legal assessment depends on the whole process and evidence; do not assume every scan is automatically invalid.

Emails, consent records, timestamps, and payment can support the record. Keep the original file and that trail. Its evidential strength can still be challenged.

Choose a workflow from document requirements and risk. Scan or click-to-accept is not automatically sufficient just because the amount is small. For large values, long obligations, or transfers of rights, consider certified signatures and check specific requirements with the person responsible for the contract.

The IP clause is the one people regret most. If your contract says the code transfers to the client on final payment (as discussed in who owns the code), the signature on that clause should be the one you can prove without a fight.

What changed in the 2024 amendment?

The second amendment to the ITE Law, UU 1/2024 signed on 2 January 2024, made three changes that touch signatures.

High-risk transactions use signatures secured with an electronic certificate. Article 17(2a) of UU 1/2024 uses that wording. Its explanation includes financial transactions without physical face-to-face contact. Do not replace this with an assumption that every high-value contract has the same classification; check implementing rules and the actual transaction workflow.

PSrE services got wider. New Article 13A lists what providers may offer beyond signatures: electronic seals for companies, trusted timestamps (proof a document existed at a certain time), registered electronic delivery, website authentication, long-term preservation of signatures, and digital identity.

The exceptions moved. The 2008 text excluded documents that had to be in writing and deeds made by notaries or land officials. The amended Article 5(4) now says the rule does not apply "where another law says otherwise". In practice, notarial deeds and land deeds still follow their own laws, so a company deed or a land transfer is not something you sign through an app.

Who counts as a recognised provider?

Komdigi runs the root of Indonesia's certificate chain (PSrE Induk), the top-level authority every provider's certificate traces back to. Below it sit recognised providers, each with a Komdigi decree. Several commercial names are well known: Privy, VIDA, Peruri, Tilaka and Digisign among them. Government agencies use BSrE, run by BSSN, the national cyber and crypto agency.

The list changes as recognitions are granted and expire. Before choosing a platform, check its decree number on Komdigi's TTE portal rather than trusting a sales deck. A platform that "partners with" a PSrE is not the same as being one; ask whose certificate ends up inside your PDF.

Does an e-meterai make a signature valid?

No. The two are often confused.

Meterai is a stamp duty, a tax on the document. Under UU 10/2020 the duty is a flat Rp10,000 from 1 January 2021, covering agreements and documents stating amounts above Rp5 million, with an electronic version (e-meterai) for digital files. It does not make a contract valid, and a missing stamp does not void one. Duty can be paid later through pemeteraian kemudian before the document is used as evidence.

So a contract can be fully signed and still owe stamp duty, or carry an e-meterai and still have a weak signature. Treat them as two separate checkboxes.

How do you wire this into your contract workflow?

A few working habits make the difference between a signature that holds and one that looks fine until it is tested:

1. Decide the tier per document type once, write it down, and stop deciding per contract.
2. Add an electronic-signature clause to your master agreement: both parties accept e-signatures, name the platform, and agree that signed PDFs are originals.
3. Keep the original signed file. Do not print and rescan it, and do not run it through a tool that flattens or re-saves the PDF. Re-saving may alter signed content and disrupt verification; preserve the received original and check any permitted-change status.
4. Check the signature when you receive it, using the PSrE's verification page or the signature panel in your PDF reader. A broken or unknown signature is easier to fix today than in court.
5. Put signed contracts in the handover pack. When a project changes hands, the signed scope, acceptance and IP documents belong with the source code, as covered in the software handover guide.

Certified signing is billed per signature or per package, and prices vary by provider and volume. Compare the price with the evidence requirements and value at risk.

This is a practical guide, not legal advice. For a contract that is already in dispute, talk to a lawyer before you talk to the other side.