A practical guide to the applicable KBLI 2025 classification, foreign investment and business licensing requirements, and Private-Scope Electronic System Provider (PSE Lingkup Privat) registration for data center operators entering the Indonesian market.

Executive Summary

Indonesia’s growing digital economy has driven increasing investment in data centers and other digital infrastructure. For investors planning to establish an Internet Data Center (“IDC”) in Indonesia, key market-entry considerations include selecting the appropriate KBLI 2025 classification, complying with foreign investment and business licensing requirements, and assessing the applicable Private-Scope Electronic System Provider (PSE Lingkup Privat) registration requirements.

Under KBLI 2025, data center colocation, computing infrastructure and hosting activities generally fall under KBLI 63102. Depending on the actual business model and electronic systems operated, additional business classifications and PSE registration requirements may also apply. Investors should also take into account the ongoing investment, industrial and PSE compliance obligations applicable after the IDC becomes operational.

Key Takeaways

·       KBLI 63102 is the principal KBLI 2025 classification for data center colocation, computing infrastructure, hosting and related data storage services.

·       Data processing activities performed for clients should be distinguished from infrastructure and hosting activities and may fall under KBLI 63101.

·       Foreign investors should establish an appropriate foreign investment company (PT PMA) and obtain the required business licensing through the OSS risk-based licensing system.

·       PSE registration is a separate regulatory requirement from the company’s general business licensing and must be assessed based on the Electronic System actually operated by the business. Where PSE registration applies, the registration must generally be completed before the Electronic System begins to be used by its users.

·       Following establishment and licensing, the IDC operator remains subject to applicable ongoing compliance obligations, including investment and Industrial Data reporting and, where applicable, continuing PSE compliance requirements.

1.      Selecting the Appropriate KBLI for an IDC Business

The first regulatory question for an investor entering Indonesia’s data center market is determining the appropriate KBLI classification for the proposed business activities. Indonesia adopted KBLI 2025 through Regulation of the Central Statistics Agency (Badan Pusat Statistik or “BPS”) No. 7 of 2025 on the Indonesian Standard Industrial Classification.

For an IDC business, the relevant KBLI classification will depend on the nature of the services actually provided. In particular, a distinction should be made between the provision of data center infrastructure, hosting and storage services under KBLI 63102, and substantive data processing activities performed for customers under KBLI 63101.

a.      KBLI 63102 – Computing Infrastructure Provision, Hosting and Related Activities

According to KBLI 2025, this classification covers the provision of computing infrastructure and hosting, together with related services supporting the management and digital distribution of data. The activities expressly covered include cloud computing infrastructure such as Infrastructure as a Service (“IaaS”) and Platform as a Service (“PaaS”), web hosting, application hosting and hosting for streaming services where the provider does not manage or curate the content.

Importantly for IDC investors, KBLI 63102 expressly includes the rental of server and network space within data centers (data center colocation), electronic storage of data and documents for limited-access purposes, and other computer data storage services. Accordingly, an IDC operator whose principal business is providing data center space, server infrastructure, computing infrastructure, hosting or electronic storage services would generally need to consider KBLI 63102 as its principal business classification.

b.     KBLI 63101 – Data Processing Activities

KBLI 63101 covers activities involving the processing and tabulation of various types of data, including big data and satellite or remote-sensing data. It includes data preparation, data entry, data migration, data cleansing and normalization, the development of algorithms for data storage and processing, and the processing of client-provided data to produce specific reports.

The distinction is important because KBLI 63102 itself expressly excludes data processing and data entry activities performed at the request of customers or clients and refers such activities to KBLI 63101. Therefore, an IDC operator that merely provides colocation, infrastructure, hosting or storage may principally rely on KBLI 63102. However, where the operator also provides substantive data processing services for customers, the business model should be reviewed to determine whether KBLI 63101 should also be included. In practice, the appropriate KBLI should be determined by reference to the actual services provided under customer contracts rather than simply describing the company generally as a “data center”.

2.      Foreign Investment and Establishment of the Indonesian Entity

Foreign investors intending to directly conduct an IDC business in Indonesia will generally establish a PT PMA. Indonesia’s current investment framework is principally governed by Presidential Regulation No. 10 of 2021 on Investment Business Fields, as amended by Presidential Regulation No. 49 of 2021. Under this framework, commercial business fields are generally open to investment unless they are expressly closed to investment, reserved for the Central Government, allocated to cooperatives or micro, small and medium enterprises, or subject to specific investment restrictions.

For an IDC investment, the investor should therefore review the selected KBLI against the applicable investment restrictions and OSS requirements before incorporating the PT PMA.

Under KBLI 2025, KBLI 63102 is the one-to-one successor of KBLI 63112 under KBLI 2020. As the current Positive Investment List under Presidential Regulation No. 10 of 2021, as amended, continues to refer to the KBLI 2020 classification, the foreign-investment treatment should be read together with the official KBLI conversion. The corresponding activity under KBLI 63112 is included within the digital-economy priority business fields and is not subject to a specific foreign shareholding limitation under the current investment framework. Accordingly, an IDC business falling within KBLI 63102 may generally be wholly foreign-owned through a PT PMA, subject to the general requirements applicable to foreign investment companies.

Foreign investors should also distinguish between the minimum investment value and the minimum capitalization requirements applicable to a PT PMA. Under the current investment regulations, PT PMA is generally required to have minimum placed and paid-up capital of IDR 2.5 billion per company, unless otherwise provided under applicable sectoral regulations. Separately, PT PMA is categorized as a large-scale business and is generally required to have a total investment value of more than IDR 10 billion, excluding land and buildings, per five-digit KBLI business activity per project location.

At the structuring stage, investors should also consider whether the Indonesian entity will only own the data center assets, directly operate the IDC business, provide cloud or hosting services, or perform multiple functions. This distinction may affect the KBLI classifications, business licensing requirements and other sector-specific approvals required for the project.

3.      Business Licensing under the OSS Risk-Based Approach

Business licensing in Indonesia is currently governed by Government Regulation No. 28 of 2025 on the Implementation of Risk-Based Business Licensing (“GR 28/2025”), which replaced Government Regulation No. 5 of 2021. Under the risk-based licensing system, the licenses required by a business depend on the risk level assigned to the relevant business activity. Business licensing is administered through the OSS system.

For KBLI 63102, the activity is classified as a medium-high risk business activity under the current risk-based licensing framework. Accordingly, the relevant business licensing generally involves a Business Identification Number (Nomor Induk Berusaha or “NIB”) and a Standard Certificate (Sertifikat Standar). For a medium-high-risk activity, the Standard Certificate is subject to verification of the applicable business standards. A Standard Certificate that has not yet been verified may be used for the preparation stage, while operational and/or commercial activities may be carried out after the relevant business standards have been fulfilled and the Standard Certificate has been verified.

The NIB serves as the basic business identity of the company, while the a verified Standard Certificate evidences the fulfilment of the applicable business standards for the relevant activity. Investors should also note that the OSS business license does not necessarily represent the complete set of approvals required to physically develop and operate a data center. Depending on the project structure, location and technical specifications, additional requirements may arise in relation to land use, buildings, environmental approvals, electricity infrastructure, fire safety and other operational matters. Accordingly, the licensing analysis for an IDC project should distinguish between: (i) corporate and business licensing for the IDC operator; and (ii) project-level permits and approvals required for the construction and operation of the physical data center facility.

As part of its ongoing compliance obligations, the IDC operator should also submit quarterly Investment Activity Reports (Laporan Kegiatan Penanaman Modal or “LKPM”) through the OSS system and periodic Industrial Data reports through the National Industrial Information System (Sistem Informasi Industri Nasional or “SIINas”), in accordance with the applicable investment and industrial-sector regulations.

4.      Is a Data Center Operator Required to Register as a PSE Lingkup Privat?

Obtaining the NIB and relevant OSS business licenses does not by itself complete the regulatory analysis for an IDC operator. The company must separately assess whether it constitutes a Private-Scope Electronic System Provider (PSE Lingkup Privat). Government Regulation No. 71 of 2019 on the Operation of Electronic Systems and Transactions (“GR 71/2019”) provides the general regulatory framework for Electronic System Providers in Indonesia.

The more specific registration requirements for private operators are set out in Minister of Communication and Informatics Regulation No. 5 of 2020 on Private-Scope Electronic System Providers, as amended (“MOCI Regulation 5/2020”). Under Article 2 of MOCI Regulation 5/2020, every PSE Lingkup Privat falling within the regulated scope is required to register. This includes Electronic System Providers regulated or supervised by a ministry or government institution under applicable laws and regulations, as well as certain providers operating portals, websites or online applications through the internet for specified activities.

The regulation therefore focuses on whether the relevant entity provides, manages and/or operates an Electronic System falling within the regulated scope. The fact that a company holds KBLI 63102 does not, by itself, replace this substantive assessment. For an IDC operator, the actual business model and Electronic Systems operated should therefore be reviewed. In particular, an operator whose activities are limited to providing physical colocation space and supporting infrastructure should be distinguished from an operator that itself provides, manages and/or operates Electronic Systems for its customers. MOCI Regulation 5/2020 expressly recognizes a Cloud Computing Provider as a PSE Lingkup Privat. Accordingly, where an IDC operator also provides cloud-computing services, the applicable PSE registration requirements should be addressed as part of the market-entry process. Where registration is required, Article 2(3) of MOCI Regulation 5/2020 requires the PSE Lingkup Privat to complete registration before its Electronic System begins to be used by users.

5.      Tanda Daftar PSE (TD PSE) Registration Process

Registration of a PSE Lingkup Privat is submitted to the Minister responsible for communications and informatics and, in principle, is carried out through the OSS system pursuant to Article 3 of MOCI Regulation 5/2020. Under the current risk-based licensing framework, TD PSE registration is processed as a Business License to Support Business Activities (Perizinan Berusaha untuk Menunjang Kegiatan Usaha or “PB UMKU”) pursuant to Minister of Communication and Digital Regulation No. 15 of 2025. For a PSE Lingkup Privat that has obtained its NIB and relevant business licensing, the application for the PB UMKU TD PSE is submitted through the OSS system and is subject to verification by the relevant technical directorate.

The registration requires the operator to provide accurate information regarding the operation of its Electronic System, including the identity and sector of the system, relevant website or network information, the applicable business model and system functions, information regarding Personal Data processing, the location where the Electronic System and Electronic Data are managed, processed and/or stored, and the required declaration concerning regulatory and law-enforcement access.

The registration form also covers the operator’s obligations relating to information security, Personal Data protection and the feasibility of its Electronic System in accordance with applicable laws and regulations. Upon completion and verification of the applicable registration documents, the operator obtains the Tanda Daftar PSE or “TD PSE” and is included in the official PSE Lingkup Privat register.

For an IDC operator, particular attention should be given to ensuring consistency between the PSE registration information and the company’s actual technical architecture. Information concerning server locations, data storage, Personal Data processing and system functions should be verified internally before submission.

6.      Registration Is Not a One-Time Compliance Exercise

PSE registration should not be treated merely as a one-off licensing step at the beginning of an IDC project. Article 5 of MOCI Regulation 5/2020 requires changes to specified registration information to be reported to the Minister. Therefore, where relevant information regarding the registered Electronic System changes, the PSE should assess whether the registration information must be updated.

This may become particularly relevant for IDC and cloud businesses because their technical architecture may change over time. For example, the operator may add new systems, modify the function of an existing platform, change the location where Electronic Data is processed or stored, or change other information previously submitted during registration.

In addition, a registered PSE Lingkup Privat remains subject to substantive obligations applicable to the operation of Electronic Systems. These include obligations relating to information security and Personal Data protection, as well as requirements to provide access to Electronic Systems or Electronic Data in circumstances permitted by Indonesian law for regulatory supervision and law enforcement. A PSE Lingkup Privat is also required to appoint at least one contact person (Narahubung) domiciled in Indonesia to facilitate requests for access from the competent authorities. Where the operator also qualifies as a Cloud Computing Provider, it must maintain governance arrangements addressing the respective rights and obligations of the provider and its users, as well as responsibility for Electronic Information and/or Electronic Documents stored through the cloud service. MOCI Regulation 5/2020 also provides administrative sanctions for failure to register, failure to report changes to registration information, or the submission of inaccurate registration information, which may ultimately include access blocking and revocation of the TD PSE in the circumstances prescribed by the regulation. PSE compliance should therefore form part of the operator’s ongoing regulatory compliance program rather than being treated solely as an incorporation-stage requirement.

7.      Practical Market Entry Roadmap for IDC Investors

From a practical perspective, an overseas investor planning to build and operate an IDC in Indonesia should consider the regulatory steps in sequence.

a.      Define the proposed business model

The investor should determine whether the Indonesian entity will provide only data center colocation, or whether it will also provide hosting, cloud infrastructure, data storage, data processing or other digital services.

b.      Select the appropriate KBLI classification

For a conventional IDC colocation and hosting model, KBLI 63102 will generally be central to the licensing analysis, while KBLI 63101 should be considered where substantive client data processing activities are also provided.

c.      Establish the Indonesian investment vehicle and obtain the required business licensing

The investor should establish the appropriate Indonesian investment vehicle and complete the relevant foreign investment and OSS business licensing procedures, including obtaining the NIB and the required verified Standard Certificate for the applicable business activities.

d.      Assess and complete PSE Lingkup Privat registration, where applicable

The investor should separately assess the Electronic Systems operated by the business and determine whether PSE Lingkup Privat registration is required. Where registration applies, the operator should prepare the relevant technical and corporate information and complete TD PSE registration before the Electronic System begins to be used by users.

e.      Maintain ongoing regulatory compliance

After the IDC becomes operational, the company should maintain an internal compliance process to ensure that changes to its Electronic Systems, business model, data processing activities or system architecture are reflected in its regulatory registrations where required, and that applicable ongoing reporting obligations, including LKPM and Industrial Data reporting through SIINas, are duly fulfilled.

Conclusion

Entering Indonesia’s data center market requires careful consideration of the applicable KBLI classification, foreign investment and OSS licensing requirements, as well as PSE registration, where applicable, and the relevant ongoing compliance obligations. For foreign investors, these requirements should be assessed together at an early stage to ensure that the investment structure, licensed business activities and actual operations are properly aligned with Indonesian regulatory requirements. Starry Indonesia Law Firm would be pleased to assist you with the assessment and implementation work, including market-entry structuring, business licensing and PSE registration.