Southeast Asia's largest digital economy gets binding data-protection rules on 16 January 2027. This is how XcellHost enters: partner-led, personal data kept in Indonesia, and backed 24×7 from Mumbai.
Cloud · Cyber Security · Data Protection · Digital Trust · AI · Training. Every market number and legal status on this page is sourced and dated, as of 7 November 2026.
The case on one screen: what the market is worth, why the timing works, how to enter and what we aim to reach in 18 months.
Cloud, cyber security and online education in Indonesia, 2025, summed from three analyst estimates235. That is about . Treat it as an upper bound.
From today to 16 January 2027, when the PDP Law's implementing regulation applies. Other dated triggers follow it. See the trigger calendar.
A Jakarta DC partner plus Indonesian SI/MSP resellers first. Open a PT PMA (foreign-owned company) between month 6 and 12.
Analysts differ, sometimes widely. Where they do, we show both figures. INR equivalents use ₹95.17 per US$, the close on 26 Oct 202642. Rupiah figures are converted at IDR 18,132 per US$, the same day43. Both are shown for orientation only.
Sources: 2, 3, 4, 5, 6
Source: e-Conomy SEA 2025 via Google Indonesia blog, 13 Nov 2025 (1)
Sources: Cushman & Wakefield (8) · BMI (7) · TFGI (10) · Mordor via W.Media (9)
Sources: Mordor (2, 3). Interpolation is ours.
TAM is the sum of three separate 2025 estimates: cloud (Mordor), cyber security (Mordor, the lower of two) and online education (IMARC). They overlap, for example security sold as SaaS, so treat TAM as an upper bound. No AI market size was found, so AI is left out. SAM and SOM are our assumptions. You can change them in the revenue model.
Pick a vertical. Each one shows why it matters, with sourced facts, then its regulatory drivers, who buys, the ten XcellHost services to lead with and the events that open a deal. Every service links to its XcellHost page.
XcellHost service pages describe the Indian offer, with INR pricing and Indian compliance. For Indonesia, each service will be re-scoped with partners for in-country hosting, PDP Law processor terms, Bahasa Indonesia support and IDR or USD billing. Priority waves are our judgement.
Indonesian compliance deadlines, platform end-of-life dates and certificate-lifetime cuts give sales a calendar. Undated triggers, such as a ransomware incident, an OJK audit finding or a new plant, are listed under each vertical above.
A neutral summary of laws we checked against law-firm and official sources. Not legal advice: confirm each point with Indonesian counsel before contracting. The digital ministry is the Ministry of Communication and Digital Affairs (Komdigi, formerly Kominfo)35; BSSN is the National Cyber and Crypto Agency.
| Law / instrument | Status & dates | Key obligations | Implication & XcellHost response |
|---|---|---|---|
| Personal Data Protection Law (UU PDP)Law No. 27 of 2022 | In forceFully applicable since 17 Oct 202426. | Controllers and processors must have a lawful basis, keep processing records, appoint a DPO where triggered, run DPIAs and notify breaches. Administrative fines reach 2% of annual revenue2548. | Implication: as a processor, XcellHost is audited by its customers, and any access from Mumbai is a cross-border transfer. Response: in-country hosting by default and privacy operations adapted to the PDP Law. |
| GR 33/2026 on Personal Data ProtectionGovernment Regulation No. 33 of 2026 · State Gazette No. 88 of 202625 | Signed · applies soonSigned 16 Jul 2026 · applies from 16 Jan 2027, after a six-month transition2425. | Breach notice to data subjects and the authority within 72 hours. DPO duty if any one trigger is met. DPIA for seven triggers, including AI, IoT and cross-border transfers. Transfers abroad need an adequacy decision or safeguards such as standard clauses or binding corporate rules, which await the PDP authority; consent works only for limited, one-off transfers after a risk assessment25. Controllers keep transfer records for audit24. | Implication: routine transfers of personal data to India have no ready legal tool yet. Response: a GR 33/2026 gap assessment as the door-opener, data kept in Jakarta, and DLP plus SOC for 72-hour reporting. |
| PDP authority (Lembaga PDP)Independent supervisor under the PDP Law | PendingThe Presidential Regulation to set it up was under deliberation on 21 Jul 202626. It was not yet established in Sep–Oct 20262425. | Komdigi enforces in the interim25. The deputy minister said in Jul 2026 that the authority would report to the President through Komdigi12. We could not confirm a date for its creation. | Response: track the authority's first instruments, such as standard clauses and adequacy lists, and revisit the Mumbai data model once they exist. |
| GR 71/2019 on electronic systems + ESO registrationGovernment Regulation No. 71 of 2019 (PP PSTE) | In forceSince Oct 201948. | Splits operators into public and private scope. Private operators register with the ministry before serving Indonesian users, and the registration system only takes Indonesian entities. Private operators may store data offshore, subject to sector rules48. Ministerial registration rules (MR 5/2020, as amended): not re-verified. | Implication: customer-facing platforms we run need a registered Indonesian operator. Response: register through the partner first, then the PT PMA. |
| MOCDA Regulation 5/2025 on public electronic system providersImplements GR 71/2019 for state bodies | In forceDated 18 Mar 2025. A one-year transition ended in Mar 202627. | Public ESPs re-register, disclosing infrastructure and data flows. An appointed provider must hold a private-scope registration, be an Indonesian legal entity and operate a data centre in Indonesia. Indonesian-language service instructions. Sanctions run from warnings to blocking27. | Implication: government systems stay in Indonesia, run by Indonesian entities. Response: serve the public sector only through Indonesian primes, with Government Cloud patterns in a local DC. |
| Perpres 82/2022 on vital information infrastructurePresidential Regulation No. 82 of 2022 | In forceSince 24 May 202228. | Eight strategic sectors: government, energy and minerals, transport, finance, health, ICT, food and defence. Incidents are handled by national, sectoral and organisational CSIRTs. BSSN coordinates and reports to the President28. | Implication: operators in these sectors need their own CSIRT capability. Response: managed SOC as the organisational CSIRT's engine, plus DFIR retainers. |
| Cybersecurity and Cyber Resilience Bill (RUU KKS)Draft law | DraftStill being drafted by the government and the DPR in Aug 2026, with no passage date30. | As drafted: BSSN as the central authority, CSIRTs at three levels, annual audits and backups for critical-infrastructure operators, and incident reports within 24 hours (critical) or 72 hours (others)29. Administrative sanctions are among its ten main topics30. Details may change. | Implication: a likely step-up in audit and reporting duties. Response: build 24-hour reporting runbooks now. Watch for any provider-certification clause. |
| POJK 11/2022 on bank ITOJK Regulation No. 11 of 2022, commercial banks | In forcePromulgated 7 Jul 2022 · effective 7 Oct 202232. | Electronic systems sit in a data centre and DR centre in Indonesia. Offshore placement needs OJK approval and must meet six criteria. Cloud is allowed if the facilities are in Indonesia. An annual cyber-maturity self-assessment, regular VAPT, and an annual scenario test such as red teaming, reported within 10 working days31. | Implication: bank workloads must run in an Indonesian DC. Response: BFSI Cloud in a Jakarta partner DC, plus red-team and VAPT services for the annual cycle. |
| OJK Regulation 1/2026 on bank IT governanceImplements POJK 11/2022; replaces OJK Circular 21/SEOJK.03/2017 | In forceEffective 1 Mar 202633. | Banks may use IT service providers abroad under the same policies as domestic ones, as long as OJK supervision is not impeded. Due diligence, written agreements, materiality reassessment, and standard formats for initial IT-incident notices and reports33. | Implication: foreign providers are allowed for services, with full due diligence. Response: a bank vendor-assurance pack and third-party risk services for banks' other suppliers. |
| BI Regulation 2/2024 on cyber resilienceBank Indonesia Regulation No. 2 of 2024 | In forcePromulgated and effective 22 Apr 202434. | Payment system providers, money and FX market players and other BI-supervised parties. Cyber-risk profiles, maturity measurement, periodic audits, continuous vulnerability scans and incident simulations. Initial incident notice within 1 hour, full report within 3 days34. | Implication: fintechs need round-the-clock detection. Response: 24×7 SOC with a 1-hour BI notice playbook, and attack simulation. |
| Electronic certification (PSrE)EIT Law and GR 71/2019 | OperatingCertified e-signatures come from Komdigi-licensed electronic certification providers (PSrE)35. | A certified signature has the same legal effect as a handwritten one and needs eKYC. Uncertified signatures are admissible but carry no presumption of validity. Examples of PSrE: PrivyID and PERURI. International platforms work through a local PSrE35. | Implication: XcellHost is not a PSrE. Response: partner with a licensed PSrE for signatures. Lead with private CA, Cloud HSM, CLM and PQC services. |
| AI ethics circular + draft AI Presidential RegulationsCircular Letter 9/2023 · draft Perpres on an AI roadmap and AI ethics | DraftThe circular is soft, non-binding guidance10. Komdigi said drafting was complete on 27 Jul 2026, still under deliberation11. Expected by end-202610. | The drafts take a risk-based approach modelled on the EU AI Act, with self-assessment for developers, users, companies and public bodies1012. Until then, the EIT Law and the PDP Law apply, and GR 33/2026 lists AI as a DPIA trigger25. | Implication: customers need an AI inventory and DPIAs now. Response: vCAIO advisory, ISO/IEC 42001 and AI security assessments. |
| Perpres 46/2025 on public procurement (TKDN)Second amendment to Perpres 16/2018 | In forceEffective 30 Apr 202536. | Domestic products get priority in four layers: first, at least 25% local content (TKDN) and 40% TKDN plus company-benefit value; then 25% TKDN; then lower TKDN; then products registered in SIINas. Consultancy services can be bought through the e-catalogue36. How TKDN applies to cloud and software: not re-verified. | Implication: imported services rank last in public tenders. Response: bid through Indonesian primes that hold TKDN certificates. |
| Entity & taxPT PMA · CIT · VAT · withholding tax | CurrentAs summarised by A&O Shearman (27 Oct 2025), DDTC (17 Aug 2025) and PwC (reviewed 11 Jun 2026)373940. | PT PMA: IDR 2.5bn paid-up capital and an investment plan above IDR 10bn per five-digit KBLI per location (BKPM Reg 5/2025)37. Many tech lines are open up to 100% foreign ownership; confirm each KBLI in OSS38. CIT 22%40. VAT 12%, but 11% in effect for non-luxury goods and services39. 20% withholding on payments to non-residents, 10% under the India treaty for service fees41. | Response: see pricing & tax. Get Indonesian tax advice for each contract structure. |
AWS, Microsoft and Google all run regions in Jakarta, and Indonesian telecom and colocation groups hold the local capacity. We list the facts neutrally. Most local providers are partner candidates as much as competitors.
| Provider | Type | What we verified | Our stance |
|---|---|---|---|
| AWS | Hyperscaler | Asia Pacific (Jakarta) region launched 12 Dec 2021, with a planned US$5B investment over 15 years18. Mordor reports the US$5B plan was confirmed in Feb 20262. | Co-sell through Managed AWS |
| Microsoft Azure | Hyperscaler | Indonesia Central region live with three availability zones in May 2025, part of a US$1.7B plan for 2024–202819. Mordor reports a US$4B expansion with a second Jakarta region in May 20262. | Co-sell through Managed Azure. XcellHost is a Microsoft Gold Partner. |
| Google Cloud | Hyperscaler | First Indonesian cloud region, in Jakarta, launched 24 Jun 202017. | Co-sell through Managed Google Cloud |
| Alibaba Cloud | Hyperscaler | Announced in Jul 2020 a third Indonesian data centre for 202120. Current zone count not re-verified. | Neutral |
| Oracle | Hyperscaler | Mordor reports a US$6.5B campus in Batam2. Not re-verified with Oracle. | Co-sell through Managed Oracle Cloud |
| Telkom (NeutraDC) | State telecom group, DC arm | Signed an MoU with state utility PLN on 11 Aug 2026 for up to 200 MW of hyperscale capacity in Cikarang, with colocation, GPU compute and connectivity offers22. | DC partner candidate |
| DCI Indonesia | Colocation operator | 119 MW across three locations, including the 36 MW JK6 building in Cibitung, launched 3 Jun 202521. | Colocation partner candidate |
| Indosat (Lintasarta) | Telecom group, IT services | Lintasarta's GPU Merdeka is a GPU-as-a-service "sovereign AI cloud" on servers with 8× NVIDIA H100 GPUs23. | Neutral: GPU partner or competitor |
| Digital Realty + Bersama Digital Infrastructure | DC joint venture | Mordor reports a US$499M Jakarta joint venture2. | Colocation partner candidate |
| Domestic DC operators as a group | Colocation | Held about 10% of operating capacity in early 2026, according to BMI7. | Partner candidates |
We compare the options on speed, cost, compliance fit and control. Ratings are our judgement from the laws above. Localisation rules for banks and the public sector, and registration rules that favour Indonesian entities, push us toward local partners first and a PT PMA soon after.
| Entry model | Time to revenue | Upfront cost | Compliance fit | Control & margin | Verdict |
|---|---|---|---|---|---|
| Partner-led via local SI / MSP | Fast | Low | StrongPartners hold ESO registration, Indonesian contracts, TKDN and Bahasa support | Lower | Start here |
| Jakarta / Batam DC partner + resale | Medium | Low–mediumReserved racks or capacity | StrongMeets OJK and public-sector DC location rules and avoids personal-data transfers | Medium | Start here, combined with the above |
| Direct entity (PT PMA) | Medium | MediumIDR 2.5bn paid-up capital; IDR 10bn+ investment plan per KBLI and location | StrongOwn ESO registration, IDR invoicing, no 20% withholding on local revenue | High | Open at month 6–12 |
| Acquisition or JV with an Indonesian MSP | Slow | High | StrongExisting certifications, TKDN, references and public-sector access | Shared | Phase 3 option, decided on traction |
XcellHost has no published partner-programme page yet. Margins and tiers are for leadership to set. Partner enquiries: contact us.
| Role | Base | From |
|---|---|---|
| Country lead (Bahasa Indonesia) | Jakarta | Month 0 |
| Partner managers ×2 | Jakarta + Surabaya | Month 1–6 |
| Solutions architect | Mumbai / remote | Month 0 |
| Privacy & compliance lead | Mumbai + Indonesian counsel | Month 0 |
| Presales + customer success | Jakarta | Month 9–12 |
| Delivery: NOC/SOC L2/L3 | Mumbai 24×7 | Existing team |
| KPI | M6 | M12 | M18 |
|---|---|---|---|
| Active partners | 4 | 6 | 7 |
| Readiness assessments sold | 5 | 11 | 18 |
| Paying accounts | 5 | 18 | 38 |
| Qualified pipeline (US$) | 0.5M | 1.6M | 3.2M |
| Annualised revenue (US$) | 0.1M | 0.5M | 1.18M |
| Gross margin on managed services | Track from month 1; set the target after pilots | ||
Standard clauses and adequacy decisions await a PDP authority that does not exist yet, and consent covers only small, one-off transfers.
Mitigation: keep personal data in Indonesian partner DCs, and give Mumbai only telemetry and tooling access.AWS, Microsoft and Google run Jakarta regions, and Telkom, Indosat and DCI hold local capacity.
Mitigation: lead with managed security, digital trust and AI skills, not raw compute.The PDP authority, the cyber bill and the AI Presidential Regulations are all pending in late 2026.
Mitigation: a quarterly legal review with Indonesian counsel, and refreshes to this page.The 2024 National Data Centre ransomware attack disrupted 282 public services, and BSSN logged 130 ransomware events in 2024.
Mitigation: harden our own Indonesian footprint first, and sell detection with tested recovery drills.20% withholding on cross-border fees (10% with treaty papers), and a PT PMA needs IDR 2.5bn of capital.
Mitigation: open the PT PMA by month 12 and take tax advice per contract.Enterprise and public buying happens in Bahasa Indonesia, and skilled security staff are scarce.
Mitigation: a native country lead, localised content, and partner engineers trained by XcellHost.The rupiah traded above IDR 18,000 per US$ in Oct 2026, and partners carry credit risk.
Mitigation: a USD price book, prepaid or quarterly billing, and partner credit limits.Public tenders rank products by TKDN, so imported services come last.
Mitigation: sell public and SOE deals only through TKDN-certified primes.Segments × target accounts × win rate × annual contract value (ACV). Every default is an assumption for discussion, not a forecast. Change any cell and the totals, the TAM/SAM/SOM block and the goals at the top update.
| Vertical | Target accounts | Win rate % | ACV (US$) | Won | Revenue (US$) |
|---|---|---|---|---|---|
| Total | 0 | — | — | 0 | 0 |
Illustrative. TAM = sum of 2025 estimates for cloud (Mordor), cyber security (Mordor) and online education (IMARC), sources 2, 3, 5. Not a financial forecast.
Switch the view. Service fit counts how many of a vertical's top-10 services fall in each pillar, from our own mapping. Regulatory pull counts the laws in the table above that drive that pillar in that vertical. Both are our assessment, not market data. Click a cell to see its services.
The strategy above sets out a partner-led delivery model. Agree responsibilities, hosting locations and evidence requirements with each customer before deployment.
Record the agreed hosting and backup locations for each workload in the Indonesian partner delivery plan.
Document access controls, monitoring and recovery procedures, and agree the evidence required by the customer and local partners.
Define monitoring, escalation, backup and recovery responsibilities in the customer agreement.
Context: India–Indonesia trade reached US$28.15B in FY2024-25, and Indian firms have invested in 7,292 projects in Indonesia since 200015. Indian groups with Indonesian operations are a natural first customer segment. Jakarta appears on the Global Cloud page as a location not yet confirmed.
Short answers based on the laws and sources above. Not legal or tax advice.
Not for phase 1. The plan sells through Indonesian DC partners and SI/MSP partners first, who hold the operator registration and local contracts. A PT PMA now needs IDR 2.5 billion of paid-up capital and an investment plan above IDR 10 billion per business line and location, under BKPM Regulation 5/2025. We plan to open one between month 6 and 12, because private-operator registration only accepts Indonesian entities and public-sector providers must be Indonesian legal entities.
Not by default. GR 33/2026 allows transfers abroad with an adequacy decision or safeguards such as standard clauses, but both depend on a PDP authority that has not been set up. Consent works only for limited, one-off transfers after a risk assessment. Banks must also keep their data centre and DR centre in Indonesia unless OJK approves, and public-sector systems must run in Indonesian data centres. So personal and regulated data stays in a Jakarta or Batam partner DC, and Mumbai runs tooling, monitoring and second-line support without personal data.
Our sources show no licence for cyber security service providers in force today. Operators of vital information infrastructure must run CSIRTs under Perpres 82/2022, banks face OJK testing duties, and payment providers face BI's 1-hour incident notice, all of which flow down to providers by contract. The draft cyber bill (RUU KKS) could add audit and reporting duties, so ask Indonesian counsel before signing each contract.
Today, Komdigi's Circular Letter 9/2023 on AI ethics is soft guidance, and the EIT and PDP laws apply. GR 33/2026 lists AI and machine learning as triggers for a DPIA. Komdigi said on 27 July 2026 that drafts of a Presidential Regulation on an AI roadmap and AI ethics were complete. They take a risk-based approach with self-assessment and are expected by end-2026. Customers need an AI inventory and DPIAs now, which is a natural opening for governance advisory and AI literacy cohorts.
Certified e-signatures, which carry the weight of a handwritten signature, come from electronic certification providers (PSrE) licensed by Komdigi, such as PrivyID and PERURI. XcellHost is not one, so we would partner with a licensed PSrE. PKI, HSM, certificate-lifecycle management, crypto-posture and post-quantum readiness services do not need that status.
Indonesian customers withhold 20% under Article 26 on payments to non-residents. PwC lists a 10% rate for service fees under the India treaty, which needs treaty paperwork. VAT is 12% on paper but 11% in effect for non-luxury goods and services, and how it applies to imported services needs advice. A PT PMA pays corporate income tax at 22%. Get advice for each contract structure.
Analysts define markets differently. For data centres, BMI counts about 340 MW operating in Jakarta alone, a government figure puts Indonesia at about 600 MW, and Mordor puts the market at 1.44 GW in 2025. For cyber security, Mordor says US$1.35 billion and IMARC US$1.4 billion for 2025. For cloud we found one recent estimate, US$2.46 billion from Mordor, and a broader IT-services figure of US$6.14 billion from the US ITA. We show both ends with sources and do not average them.
No. The 18-month goals and the revenue model use assumptions for target accounts, win rates and contract values, chosen to start a discussion. Change them in the revenue model. Only the market-size, legal and macro figures come from cited third parties.
Accessed 7 Nov 2026. The dates shown are publication or review dates where the source gives one.
This is an internal and partner strategy briefing, not a public offer. It is not legal, tax, investment or financial advice. Market figures come from the cited third parties, which may use different scopes and methods. Law summaries are based on law-firm and official commentary available on 7 Nov 2026. Indonesian rules are changing: the PDP authority, the cyber bill and the AI Presidential Regulations were all pending at that date, so check every point with qualified Indonesian counsel and tax advisers before any investment or contracting decision. Goals and revenue-model values are assumptions for discussion, not forecasts. XcellHost service pages describe the Indian offer; Indonesian delivery, hosting and pricing will be set with partners. Third-party names are used for identification only and do not imply partnership or endorsement.
Each briefing uses the same structure: sourced market size, ten verticals, laws, entry model and an editable revenue model.