Industry Findings: Regulatory consolidation in Indonesia has shifted procurement risk assessments for SaaS, particularly where cross-border processing and algorithmic use are material. The Personal Data Protection Law (Law No. 27 of 2022) concluded its statutory transition period and became fully enforceable in Oct-2024, imposing comprehensive controller/processor duties, breach-notification requirements, and portability obligations. That single regulatory milestone compelled procurement teams to demand certified processing maps, DPIA results, and clear cross-border transfer safeguards before approving SaaS deployments. Architects responded by partitioning regulated records into local enclaves and by introducing policy-driven telemetry to support regulator audits. Buyers now prioritise suppliers that publish PDP-compliance artefacts and documented transfer mechanisms; vendors lacking demonstrable DPIA evidence saw pilots paused pending legal sign-off, while those that presented ready-made compliance playbooks shortened contracting timelines.
Industry Player Insights: Some of the players operating in the Indonesia industry are GoTo, Telkom Indonesia, Alibaba Cloud, and Telkomsigma etc. Our assessment finds local platform and telco–cloud partnerships accelerated adoption for regulated customers. GoTo launched Dira, a Bahasa Indonesia voice-assistant in Jul-2024 and extended its generative-AI integrations, which increased enterprise appetite for localized conversational automation and pressured competitors to surface deployability and data-segmentation options. Telkomgroup and Telkomsigma formalised cloud and partner programmes during 2024–2025, and Telkom’s strategic cloud partnerships with global providers enabled larger public-sector and healthcare tenders to proceed with localised architectures; buyers rewarded vendor consortia that combined local delivery scale with cloud-native integration templates.