PSE Registration Guide for Indonesian Business Websites (2026)

PSE registration in Indonesia is often discovered after a website or app is already live — even though the "required or not" question should be answered before go-live. Many business owners assume that selling on Shopee or Instagram covers every digital obligation. That holds for pure marketplace sellers, but it changes once you operate your own customer accounts, mobile app, or online payment flow that collects user data on infrastructure you control.

This guide explains when your business qualifies as a Private Scope Electronic System Provider (PSE), what documents to prepare, and the technical steps teams often miss — from TDPSE footer implementation to aligning privacy policies with Indonesia's Personal Data Protection Law (UU PDP).

1. What PSE means and why it matters for digital products

An Electronic System Provider (Penyelenggara Sistem Elektronik, PSE) is any person or entity that provides, manages, and/or operates an electronic system for users. The framework is grounded in Government Regulation No. 71 of 2019 on Electronic Systems and Transactions and Minister of Communication and Informatics Regulation No. 5 of 2020 (as amended) on Private Scope PSE.

Registration is not mere paperwork. Authorities want every platform that processes user data or transactions to appear on the official registry at pse.komdigi.go.id, so the public can verify legitimacy. For B2B sales, the Electronic System Provider Registration Certificate (TDPSE) number is increasingly requested before corporate clients share data — especially alongside UU PDP compliance reviews.

If you are still planning your own digital channel, the sequencing in our digital transformation guide for Indonesian MSMEs helps place NIB and operational foundations before support permits such as PSE.

2. When registration is mandatory

You must register if the electronic system you operate meets at least one of these categories (under Permenkominfo 5/2020):

• Providing, managing, or operating offers and/or trade of goods or services — including your own online store, catalog with checkout, or booking application.
• Providing user-to-user communication services — chat rooms, forums, or buyer-seller messaging on your platform.
• Operating a search engine or portal indexing third-party content.
• Providing personal data processing services on systems you control — forms that persist customer databases, member accounts, or external-facing CRM.
• Providing financial services — your own payment gateway, e-wallet, or payment system processing user transactions.
• Providing public services based on electronic systems as defined in regulation.

Common triggers: a WooCommerce or headless storefront with customer login, Android/iOS apps with user accounts, service booking portals with client databases, or B2B SaaS hosted on your domain.

3. Scenarios that usually do not require your own registration

Not every digital presence makes you a PSE. Understanding this saves administrative time:

A frequent mistake is assuming "we are too small." Regulation does not exempt MSMEs on technical criteria — it cares about what system you operate. Our article on why Indonesian SMEs still need a website beyond marketplaces applies here: once you build an owned channel, compliance scope expands.

4. Documents and technical foundations before applying

Before logging into OSS (oss.go.id), prepare these administrative and technical items:

Administrative:

• Active NIB through OSS with appropriate KBLI codes (e.g., software services, e-commerce, or codes matching your business model).
• Responsible person identity (director or owner ID).
• Business and platform description — what the system does, who uses it, what data is collected.

Technical and legal on website/app:

• Privacy policy aligned with actual system behavior — not a copied template. This ties directly to our UU PDP practical guide for web apps.
• Published, publicly accessible terms of service.
• Live domain URL consistent with what you will register.
• Information security summary — how data is stored, who can access it, baseline encryption and backup practices.

If your site processes payments, document integrations with Midtrans, Xendit, or other providers: what you store on your servers versus what appears only as transaction status. This mirrors the discipline in our payment gateway integration guide.

5. Registration flow through OSS and the PSE portal

The official process runs through OSS under Business Activity Supporting Licenses (PB-UMKU):

1. Log in to oss.go.id with the account linked to your business NIB.
2. Select Electronic System Provider Registration Certificate (TDPSE) application.
3. Complete the electronic system information form: platform name, URL, service type, matching PSE category, and responsible contact.
4. Upload supporting documents as prompted — privacy policy, terms, technical description.
5. Wait for verification. Once approved, download the electronically signed TDPSE.
6. Confirm your entry appears in the Domestic PSE list at pse.komdigi.go.id.

Processing time varies. Delays often come from legal documents that do not match live features, or URLs that are unreachable during verification. Apply when staging reflects production — not while the site still shows "Coming Soon."

6. Technical implementation after TDPSE is issued

The TDPSE number is not a legal folder artifact — users must see it:

• Display it in the footer of every website page, with clear formatting and a verification link to the PSE portal when possible.
• In mobile apps, show it on About, Legal, or Settings screens — consistent with the web version.
• When changing domains (e.g., from .com to .id), TDPSE is bound to the registered URL. Domain changes require updates or re-registration — do not show an old number on a new domain without the official process.
• When shipping major features — membership, user chat, wallets — reassess whether your PSE category changes.

From an engineering standpoint, treat TDPSE like product metadata: store it in environment configuration, not hard-coded across dozens of templates. A single source of truth simplifies multi-environment deploys.

7. How PSE relates to UU PDP and security operations

PSE and UU PDP complement each other but do not replace one another:

Teams that already follow our website security checklist for Indonesian businesses will find PSE forms easier — questions about encryption, data access, and incident procedures are already documented.

For businesses enrolling in Sapa UMKM for marketplace incentives, NIB and business legality are also prerequisites. See our Sapa UMKM integration guide. PSE is an additional layer for systems you operate, not for seller accounts on third-party platforms.

8. Decision table: own PSE or marketplace-only?

Use this quick filter before engaging legal counsel:

If two or more "strong" signals match your product, treat PSE registration as a high-priority backlog item — on par with SSL and privacy policy, not as a "when we are bigger" task.

Conclusion

PSE registration for Indonesian business websites and apps is the natural next step when you move from "selling on a marketplace" to operating your own system that collects data and processes transactions. Obligation is determined by system function, not revenue or headcount. Prepare your NIB, an honest privacy policy, and footer TDPSE implementation before user scale makes remediation more expensive.

If you are planning an online store, member app, or service portal and want legal-technical foundations right from the start, we help map product features to compliance obligations and an efficient stack. Start a conversation with a short description of the system you are building — domain, login features, payments, and target go-live — so we can suggest a realistic work sequence for your team.