At the Digital Transformation Indonesia Conference & Expo (DTI-CX) in Jakarta on August 5-6, three of Indonesia's senior digital-policy officials made an argument that cuts against the usual trade-agreement triumphalism: signing a good pact is the easy part. Coordinating Minister for Economic Affairs Airlangga Hartarto, Communication and Digital Ministry Director General Edwin Hidayat Abdullah, and National Cyber and Crypto Agency (BSSN) head Nugroho Sulistyo Budi each framed physical and institutional readiness—energy, connectivity, cybersecurity—as the actual precondition for Indonesia capturing gains from the ASEAN Digital Economy Framework Agreement (DEFA), the bloc's first comprehensive region-wide digital economy pact, ahead of its planned signing in November 2026.
What DEFA Actually Commits ASEAN To
ASEAN concluded DEFA negotiations at the second meeting of the 57th Senior Economic Officials Meeting held May 27-29, 2026, and now targets signing at the 49th ASEAN Summit in November, with member states given roughly 180 days after signature to ratify domestically. The agreement covers digital trade and cross-border e-commerce, "trusted" cross-border data flows, cybersecurity standards, digital ID and payment interoperability, and emerging areas including AI, fintech, and source-code protection. A Boston Consulting Group study cited around the deal's conclusion projects it could help expand the region's digital economy from roughly $1 trillion toward $2 trillion by 2030 if implemented in full.
That is a real number worth taking seriously, and it is why Jakarta's framing matters: DEFA is a rulebook for interoperability, not a delivery mechanism for the infrastructure interoperability requires.
The Case Indonesia's Officials Are Making
Hartarto's argument was blunt: "A digital economy can only exist if the energy infrastructure is in place." He pointed to Indonesia's geothermal, hydropower, and solar capacity as underused assets that need to reach outer islands before data centers and AI workloads can scale there—a fair point, since cross-border data flow commitments are meaningless if the servers on one side of the border run on unreliable power.
Abdullah, representing the ministry now branded Komdigi, described a four-layer stack—physical infrastructure, virtual infrastructure, platforms, applications—and warned against stopping at the first layer: "If we only build physical infrastructure, it is like constructing a road with no traffic." He cited Indonesia's own Government Service Integration Platform (SPLP), which he said has processed more than 10 million data-exchange transactions, as evidence the higher layers are where value actually accrues.
Budi's cybersecurity framing was the sharpest: "Cybersecurity is no longer optional. It is a mandatory investment for Indonesia's national digital transformation." He located most incidents in internal failures—leaked credentials, malware, human error—rather than exotic external attacks, and pushed "security-by-design" as a leadership decision rather than an IT afterthought.
Where the Pro-Innovation Case Pushes Back
The steelman for this sequencing argument is solid: a cross-border data flow commitment adopted by a country with patchy grid reliability, thin last-mile connectivity, and weak baseline cyber hygiene is a paper right, not a usable one. Regulators who ignore infrastructure gaps and declare victory on legal text alone have, in other jurisdictions, produced frameworks nobody can actually use.
But the infrastructure-first framing carries its own risk, and it's the more important one for DEFA specifically: readiness rhetoric can quietly become a justification for delay or for domestic carve-outs once the 180-day ratification clock starts. DEFA's central innovation is trusted cross-border data flows—language chosen specifically to avoid hard data-localization mandates while still allowing privacy safeguards. Indonesia's own Personal Data Protection Law and sectoral rules have flirted with localization requirements before; if Jakarta ratifies DEFA's text while continuing to tighten domestic data-residency rules in practice, the pact's cross-border promise erodes exactly where it matters most, regardless of how many geothermal plants or fiber runs get built. Infrastructure gaps are viable, fundable engineering problems with known solutions and long runways. Regulatory backsliding on data flows during a 180-day ratification window is a policy choice, made faster, and far harder to walk back once compliance regimes are built around it.
Budi's cybersecurity mandate deserves the same scrutiny in reverse: treating security as "mandatory investment" is right in principle, but a security-by-design mandate applied uniformly, without proportionality to firm size or actual risk exposure, becomes a compliance tax that falls hardest on the SMEs DEFA is explicitly supposed to empower. ASEAN's own scope language for DEFA name-checks digital-talent and SME provisions alongside cybersecurity; Indonesia's implementing rules should keep those in balance rather than let cyber compliance costs quietly cancel out DEFA's market-access gains for smaller firms.
What to Watch Before November
DEFA's text still faces legal scrubbing and domestic consultation in each member state before signature, and the real test comes after: whether Indonesia's implementing regulations treat "trusted cross-border data flows" as a floor to build on or a slogan to work around. The infrastructure Hartarto, Abdullah, and Budi described at DTI-CX is necessary. It is not sufficient, and it should not become the story that lets slower, quieter regulatory choices escape the same scrutiny.