Why data location has become a question

More corporate clients, banks and large companies especially, now send a vendor questionnaire before they appoint a law firm, tax consultant or audit firm. One question almost always appears: where will our data be stored?

"In the cloud" no longer answers it. Three sets of Indonesian rules are relevant: the Personal Data Protection Law on transfers abroad, the electronic system operator (PSE) rules administered by Komdigi, and sector rules such as those from OJK. Beyond the rules, there is a practical risk too: a service that suddenly cannot be reached from Indonesia.

This guide is general information, not legal advice.

The PDP Law: transfers abroad (Article 56)

The PDP Law does not forbid storing personal data outside Indonesia. Article 56 allows transfers to a controller or processor abroad, subject to layered conditions:

  1. Make sure the recipient country offers protection equal to or higher than the PDP Law.
  2. If it does not, make sure there are adequate and binding safeguards, for example by contract.
  3. If neither applies, you must obtain the individual's consent.

Note the word "processor" in Article 56(1). Keeping client files with a cloud service whose servers are abroad means sending data to a processor outside Indonesia. That falls within this article; it is not only about sending files to a partner office overseas.

Breaching Article 56(2) to (4) can attract administrative sanctions under Article 57. The detailed mechanism is left to a government regulation (Article 56(5)). PP No. 33 of 2026, the implementing regulation of the PDP Law, was promulgated in July 2026 and, according to Kompas, takes effect six months later. Check its official text for the technical conditions on transfers.

GR 71/2019: public scope and private scope

Government Regulation 71 of 2019 distinguishes two kinds of electronic system operator:

  • Public scope (state bodies and institutions they appoint). Article 20(2) requires systems and data to be managed, processed and stored in Indonesia, unless the technology is not available locally.
  • Private scope (individuals, businesses and the public). Article 21(1) allows storage in Indonesia and/or abroad. Where it is abroad, Article 21(2) and (3) require the operator to keep supervision and law enforcement effective and to provide access for those purposes.

Law firms, tax consultants and audit firms are generally private scope. But if your client is a government body, that client is bound by Article 20, and the obligation may be passed on to you by contract.

The same regulation requires every operator to keep an audit trail of all its electronic system activity (Article 22). That is worth asking vendors about.

PSE registration and the risk of blocking

Ministerial Regulation 5 of 2020, as amended by Ministerial Regulation 10 of 2021, requires private-scope operators to register before their system is used (Article 2). It applies to domestic and foreign operators whose services are used in Indonesia. The sanction for failing to register is access blocking (Article 7).

This is not a paper threat. Some examples from the ministry's own announcements:

What does this mean for a firm? If the document service you rely on is unregistered and gets blocked, your team loses access to client files, possibly without warning. Ask about a vendor's PSE registration before you move your archive onto it.

Sector rules: the OJK example

Some sectors have their own data location rules. The one that comes up most often: POJK 11/POJK.03/2022 requires commercial banks to place their electronic systems in data centres and disaster recovery centres in Indonesia. Placement abroad is allowed only under set criteria and with OJK's prior permission.

The rule binds banks, not your firm. But if you handle a bank's customer data or internal documents, the engagement contract will usually pass similar conditions on to you. Read the confidentiality and data location clauses in your client contracts before you choose a vendor.

How to document data that leaves Indonesia

The Article 56 conditions only help if you can show they were met. For every vendor or service that processes client data abroad, record five things in your processing register:

  1. What data leaves. All matter files, say, or only email, or only the passages an AI reads.
  2. Which country it goes to. Include backup and support locations if the vendor discloses them.
  3. Which Article 56 route you rely on. A country with equivalent protection, a binding agreement, or client consent.
  4. The evidence. A data processing agreement, the data protection clauses in the contract, or a signed consent form.
  5. The next review date. Vendor policies change, and PP 33/2026 may add technical conditions.

If you rely on client consent, remember it can be withdrawn (Article 9). For a service that holds long-term archives, a basis that depends on consent is the most fragile one.

A note for notaries: the Notary Law requires the original deed (minuta) to be kept as part of the notarial protocol. A digital copy in the cloud does not replace that duty, so treat it as a working copy and control access to it tightly.

Common misconceptions

  • "All personal data must be stored in Indonesia." Not for the private sector in general. The PDP Law and GR 71/2019 allow storage abroad, with conditions.
  • "A server in Singapore means we are in breach." Not necessarily. What matters is that the Article 56 conditions are met and that you can show it.
  • "The vendor says the data is in Indonesia, so we are fine." Ask which data. Files, databases, backups, logs, notification emails and support staff access can each sit somewhere different.
  • "If the data is in Indonesia, there is no transfer." The moment you connect an AI service that processes abroad, the content it reads leaves the country.

Questions to put to every vendor

Question Why it matters
In which country are our files stored? Decides whether Article 56 applies
Where are the database, backups and logs? File location alone is not the whole answer
Who are your sub-processors, and where? Article 51(5) requires your written approval
Are you registered as a PSE with Komdigi? Unregistered services can be blocked
Is there a data processing agreement? The basis for overseeing a processor (Articles 37 and 51)
Is our data sent to any AI service? Which? AI processing often happens abroad
Can we see access records? Supports your record of processing (Article 31)
How quickly will you tell us about an incident? You have your own 3 x 24 hour deadline (Article 46)
How do export and deletion work when the contract ends? So nothing is left behind with the old vendor

Get the answers in writing and keep them with your processing register. A vague answer, or "commercially confidential", on a location question is a reason to ask more.

How folders.id answers these questions

We try to answer the table as plainly as we would ask any other vendor to:

  • Files uploaded to folders.id are stored with an Indonesian object-storage provider.
  • The application and its database, including the text read out of documents for search, currently run in Singapore. So part of your data is processed outside Indonesia, and Article 56 of the PDP Law applies.
  • For the sub-processor list, ask us for the detail before you decide. The questions in the table apply to us too.
  • If you connect an AI, you choose which folders it may read. Every search, every document read and every refused request is recorded, so you know exactly what left and when.
  • NIK, NPWP, passport and bank account numbers are masked before they reach an AI, so clients' identity numbers are not sent with the text.

Data location is about more than a server's address. What you need is a written answer you can show when a client asks.