Indonesia Blocks Unregistered Apps: What to Check

If your business runs booking, payment, or customer-facing digital services, check PSE registration duties before users begin using them. PSE means Electronic System Operator; its registration certificate is a TDPSE. Identify the responsible operator, check registration status, and match the listed domains and service details. Access blocking can disrupt customers even when the application works.

The duty follows regulated functions and scope rather than automatically covering every site with a login. Ministerial Regulation 5/2020, Article 2, amended by 10/2021, lists the categories to assess. Licensing advisers or legal counsel can help with unclear boundaries.

First checks for business owners

Lessons from September 2026 enforcement

The Ministry of Communication and Digital Affairs (Komdigi) sent notification letters on 16 September 2026 to 25 private-scope operators that run services for Indonesian users without being registered. ANTARA reported the deadline as 22 September, quoting Teguh Arifiyadi, the ministry's director for certification and electronic transaction oversight: operators that miss it face warning letters and then an administrative sanction of access blocking, meaning access through Indonesian networks may be restricted.

Komdigi’s official 27 September update reports written warnings to seven PSEs that had not met the duty by 22 September. The September deadline was not a new deadline for every business, and this article does not assume all operators on the initial list remain unregistered.

Twenty-three of the 25 were domestic, two foreign. Warta Ekonomi published the list on 17 September: the high-speed rail operator Kereta Cepat Indonesia China, airlines including Lion Mentari, Super Air Jet, Sriwijaya Air and Pelita Air, intercity bus companies such as Rosalia Indah and Haryanto Motor, shipping lines, a property firm, and Shopify Inc. on the foreign side.

Read that list again. Almost none of those companies sell software. They sell seats, cabins and houses. Their electronic system is a booking page.

Why is the list suddenly full of local companies?

Because enforcement moved. The wave that got attention in November 2025 was all global infrastructure and platforms: CNBC Indonesia reported letters to Cloudflare, Dropbox, OpenAI, Duolingo and the Wikimedia Foundation on 19 November 2025. Three weeks later Katadata reported that Cloudflare and OpenAI were still unregistered and the minister described talks in progress.

The next wave tilted. Letters went out on 26 June 2026 with a 3 July deadline to 15 foreign and 10 domestic operators covering 57 unregistered sites and apps, Strava and Qatar Airways among them. By September the ratio flipped to 23 domestic against 2 foreign.

The pattern is worth taking seriously if you run a mid-size Indonesian business. Global platforms have legal teams that answer ministry letters. A bus company with a booking site built by a vendor three years ago has nobody watching that mailbox.

Does a small business really count?

It can, when the system’s functions fall within the regulated scope. The obligation comes from Government Regulation 71/2019, Article 6: registration happens before users start using the electronic system, not after the first complaint. Ministerial Regulation 5/2020, amended by 10/2021, sets out the mechanics. Individuals are covered too, not only companies — a sole trader running a paid app is in scope.

Six categories pull a site or app into scope: selling goods or services, running financial transactions, delivering paid digital content, providing communication services, operating search or information services, and processing personal data to run user transactions.

The gap most businesses fall into is not the main product. It is the third app. The company registered its main marketplace years ago, then shipped a loyalty app, a campaign microsite and a kiosk ordering screen — each one a separate electronic system, none of them added to the registration.

What does registration actually take?

Two layers, in order. The business identity first: an active NIB, the business registration number issued through the OSS licensing portal, carrying business-activity classification codes, known as KBLI, that match what your system actually does. Picking those codes badly creates friction later, which is why choosing KBLI codes for a technology business deserves its own hour rather than a guess during signup.

Then the registration itself, filed as a supplementary permit in OSS and published through pse.komdigi.go.id. You declare the system name, sector, domain or app identity, business model, the categories of data you process, and where that data is stored.

That last field is the one that bites. What you declare becomes a public record, and it is read alongside your personal data obligations — the same obligations that carry the penalties under Indonesia's personal data law. Declaring "data stored in Indonesia" while your object storage bucket sits in Singapore is a mismatch somebody will eventually open two tabs to check.

Registration is also not a one-time errand. New domain, new app, a changed data flow, a new processor — each is a change you are required to report. Under Article 7 of Regulation 5/2020, an unregistered system faces access blocking directly, while a registered operator that files inaccurate data or ignores a warning moves down a ladder: written warning, temporary suspension, then blocking and removal from the register if there is no response within seven days after the temporary suspension.

Registered under whose name — yours or your vendor's?

This is the question I ask first on any handover, and it is answered wrong often enough to be a pattern. A company hires a software house to build its booking app. The vendor owns the domain, the cloud account, the app store listing, and files the registration under its own entity because that was the account already open in OSS. Two years later the vendor has moved on, the contract is finished, and the operator has no way to update a registration that is not theirs.

The registration belongs to whoever operates the service and holds the customer relationship. Put it in the handover checklist next to the other ownership items, the same way you would treat source code and account ownership at the end of a project: registration number, the OSS account it lives under, the domain, and one named person responsible for filing changes.

What if a service you depend on gets cut instead?

Run the risk the other way around. Your own paperwork can be perfect while a third party your stack calls at runtime is the one that gets blocked. The November 2025 list included Cloudflare and Dropbox — one of them sitting in front of a large share of Indonesian websites as a CDN, the layer that delivers pages and assets on behalf of the origin server.

Check whether your vendor contract covers regulatory access restrictions. Your provider is healthy, its status page is green, and your users still cannot reach it, because the block happens at the network in between. The applicable exclusions and remedies depend on the contract.

So inventory what your application needs from the public internet while it is serving a request: CDN, authentication, maps, payment, object storage, push notifications, an AI API. For each one, answer whether the app degrades or dies if that hostname stops resolving in Indonesia. Anything in the "dies" column is the same class of problem as any other single point of failure in a business system, and it is cheaper to find on a Friday afternoon than during a block.

A checklist for this week

1. List every public-facing site and app operating under your company name, including microsites, kiosk apps and anything a vendor built.
2. For each one, find the registration — or confirm there is none.
3. Check the registrant entity is yours, not your vendor's.
4. Check the NIB is active and the KBLI codes still describe what you do.
5. Compare the declared data location against where the data actually sits.
6. Name one person who files changes when a domain or data flow changes.
7. Inventory the third-party hostnames your app needs at runtime and what breaks if one is blocked.
8. Start the registration path before a letter arrives. The last two waves gave five to seven days, and you cannot file anything until the NIB is active.

The part that stays true after this deadline

Access blocking is an unusual outage. Your own servers may keep running, and internal checks may stay green. Local reachability checks can still detect the disruption, while resolving it may require action by the operator or regulator. Your monitoring shows green while your customers see a dead page, and the fix is a form somebody should have filed before launch.

Paperwork is cheap. Being unreachable during the week your competitor is bookable is not.