Following the end of its two-year transition period, Indonesia's Personal Data Protection Law, known as UU PDP, entered the full enforcement phase on October 17, 2024. The law classifies phone numbers as personal data and brings cross-border companies that process Indonesian residents' phone numbers for A2P SMS within its regulatory scope, setting clear compliance requirements for data collection, user consent, and opt-out response in SMS operations.
Under the law, obtaining user consent must meet specific, informed, and explicit standards. Consent for transactional notification SMS and marketing SMS must be collected separately, and permission cannot be obtained through bundled consent. Once a user withdraws consent to receive SMS, companies must cease the relevant data processing and SMS delivery within 72 hours. This requires companies to build a real-time opt-out response system, as opt-out management cannot rely on a weekly batch-processing model.
Indonesia's data protection authority, the DPA, is scheduled to be officially established in 2026. Before the authority is in place, the Ministry of Communication and Digital, known as Komdigi, is responsible for compliance supervision. From 2024 through mid-2025, Komdigi reviewed approximately 350 digital platforms in total. The findings showed that 41% of websites and 34% of mobile applications had potential personal data protection violations.
