Indonesia’s Tech Firms Need PSE Certification

Read Time: 1.5 minutes

Identifying the market's regulations is essential for investors and businesses as Indonesia's digital economy skyrockets.

Tech companies conducting business in Indonesia must obtain a PSE certificate, which stands for "Penyelenggara Sistem Elektronik" or "Electronic System Provider" and is provided by the Ministry of Information and Communication (Menkominfo or "MOI").

The MOI issues the PSE certificate to ensure a company's electronic system is secure and compliant with Indonesian data protection standards, enhancing public trust in internet usage. With the rise in cybersecurity threats, PSEs are now also required to implement stringent information security governance standards, such as the ISO/IEC 27001 certification. Crowe can assist companies in obtaining ISO/IEC 27001 certification, ensuring that their electronic systems meet international security standards and are resilient against potential cyberattacks.

The following companies need PSE certificates to operate in Indonesia if they:

• Offer goods or services to the public through websites or applications
• Facilitate online transactions
• Process information regarding fund deposits
• Store or process data related to trade and/or financial transactions
• Firms whose computers send paid digital things to customers' gadgets

Upon MOI approval, companies will be issued one of the following PSE certificates

• Five-Year PSE Certificate: Granted to companies holding a valid information security certificate, such as ISO/IEC 27001, which is aligned with international standards and reflects a high level of security governance. Crowe’s expertise can help your business achieve this certification, ensuring compliance and long-term operational stability.
• One-Year Temporary PSE Certificate: Granted to companies lacking certification. These companies must obtain certification within one year to upgrade to the five-year PSE. If certification is not achieved, the temporary PSE will be canceled, requiring a new application.

MOI does not charge for issuing PSE certificates, but consulting firms may charge fees for their services. If a company lacks an information security certificate during the PSE application process, it must complete an MOI questionnaire to determine the required certification.

• Low-risk companies will need a KAMI Index rating and certificate from BSSN
• Medium to high-risk companies must obtain ISO 27001 certification
• High-risk companies may also face additional regulatory requirements specific to their industry, such as those from OJK or BI for financial services

As a government certified ISO/IEC 27001 consultant, Crowe aims to assist tech firms toward PSE compliance while also ensuring your business and reputation are protected against cybersecurity threats and meets all necessary regulatory requirements. 

Source: Crowe Global