What Komdigi did
On 27 September 2026, Indonesia's Ministry of Communication and Digital Affairs (Komdigi) announced written warnings to seven private-scope electronic system operators (PSEs) that had not registered. According to Komdigi's own release, the seven were among 25 operators notified earlier in the month. Sixteen of the 25 had registered and two more, PT Pelita Air Service and Shopify Inc., had committed to do so. The seven still unregistered as of 22 September were given until 1 October 2026. If they missed it, Komdigi said it would take administrative enforcement steps "including termination of access to the electronic systems."
Bisnis.com's report names the seven. Six are domestic: PO Haryanto Online, PO Handoyo, Rosalia Indah Transport, Rotio, Sriwijaya Air, and Sudiro Tungga Jaya. One is foreign: Secret Industries Pty Ltd, the operator of FatSecret. That is a bus-ticketing and airline cluster plus a calorie counter. They are ordinary consumer services rather than platforms hosting political speech.
I could not confirm what happened after 1 October. The Komdigi pages I could read do not report an outcome, so this piece analyses the mechanism rather than a result.
The strongest case for the regime
Regulators have a real argument. Registration gives the state a contact point and a legal address. That matters in a country where fraud and online scams are a live enforcement problem, and Komdigi's Director General for Digital Space Supervision, Alexander Sabar, said the aim is that "the public obtains legal certainty" about the digital services they use. Registration is free, and the numbers suggest the ministry's approach is effective: 16 of 25 operators complied after a notice, before any penalty was applied. A graduated process of notice, warning letter, then sanction is also better than blocking without warning, and Komdigi has followed it here.
Where the design goes wrong
The problem is the sanction written into the rule. Under Permenkominfo No. 5/2020, Article 2(1) requires every private PSE to register, and Article 4 extends the duty to foreign operators whose services are used or offered in Indonesia. Article 7(2) sets the penalty for failing to register as "Pemutusan Akses", access blocking. Article 1(15) defines that term broadly as blocking access, closing accounts and/or deleting content.
Compare that with Article 7(3), which covers operators that fail to report changes or give wrong registration data. There the ladder has steps: a written warning, then temporary suspension, then blocking and revocation of the registration certificate only if the operator does not respond within seven days of the suspension. Failing to register at all jumps straight to the most severe remedy. In practice Komdigi adds its own warning letters, as it did here, but those are a matter of ministry discretion rather than a legal requirement. Bisnis quotes Sabar as saying a failure to register would "possibly" lead to temporary access termination, while Komdigi's release speaks of access termination without that qualifier. A rule that leaves the severity open to ministerial choice invites uncertainty.
The reason this matters is proportionality. Blocking a bus-ticketing app or an airline's booking site for a missing registration entry cuts off Indonesian users who did nothing wrong. It also harms the operator's customers more than it harms the operator. A fine or a temporary suspension tied to a short cure period would reach the same compliance goal at lower cost to users.
The track record shows the risk is not hypothetical
Komdigi has used the power. In June 2025, it cut access to three PSEs (Bath & Body Works's operator PT Dunia Luxindo, eBay and KLM), calling the step "a form of administrative sanction." In April 2026, Voice of Indonesia reported that Komdigi gave Wikimedia a final extension, with Wikipedia Indonesia and Wikimedia Commons at risk of blocking. Wikimedia has no Indonesian office, which complicates compliance. Registration is free, Komdigi stressed, and applies equally to non-profits.
The same registry is also what the 2020 rule uses to attach other duties. The regulation obliges registered private PSEs to give law-enforcement access to systems and data (Article 21(2)) and to act on takedown orders within 1x24 hours, or four hours for urgent requests (Article 15). Registration is therefore the entry point to a wider set of obligations. That is exactly why the penalty for skipping it should be proportionate and clearly staged. For a small foreign operator with no Indonesian presence, the choice between registering and being blocked is not much of a choice, and it is a choice made under a tight deadline.
What a better rule would look like
- Write the ladder into the text. Extend the Article 7(3) sequence of written warning, temporary suspension, short cure period, then blocking to non-registration under Article 7(2).
- Prefer targeted remedies. Where the unregistered service is not itself unlawful, use fines or restricted features rather than a full block.
- Publish outcomes. Komdigi publishes the warnings. It should publish whether each deadline ended in registration, an extension or a block, so operators can see how the rule is applied.
- Make registration easier for foreign non-profits and small operators, for example by accepting a designated representative rather than a local entity.
The September campaign shows that most operators will register when asked. That is a reason to keep the process predictable and the penalty proportionate, not to rely on the threat of blocking as the main tool.