Indonesia Outbound Compliance: UU PDP and OJK

Quick answer

Outbound calling in Indonesia is governed by Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi, the personal data protection law known as UU PDP, alongside Kementerian Komunikasi dan Digital for marketing SMS and Otoritas Jasa Keuangan for financial-services calling. The consent model is explicit consent for stated purposes under UU PDP Pasal 20(2)(a), and there is no national Do Not Call register to scrub against: what exists is an operator-level refusal option for marketing SMS and, in financial services, a per-firm consent and withdrawal duty. The only published calling window is the financial-sector one, Monday to Saturday excluding national holidays, 08:00 to 18:00 local time for marketing and 08:00 to 20:00 for collections.

Indonesia is the market where most published telemarketing advice is wrong in a specific way: it describes a national opt-out list that does not exist, and it publishes a single national calling window that no instrument contains. The rules that do bind you are split across three places. A data protection statute that applies to everyone, a telecoms ministerial regulation that covers marketing SMS and not voice, and a financial-services conduct regulation that is far stricter than either and that binds the firm rather than the operator.

At a Glance

Item	Position in Indonesia
Regulator	Kementerian Komunikasi dan Digital, known as Komdigi, renamed from Kementerian Komunikasi dan Informatika in 2024. Financial-sector conduct sits with Otoritas Jasa Keuangan, OJK. The UU PDP supervisory body is the lembaga to be established under Pasal 58
Law and date	UU Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi, promulgated 17 October 2022, Lembaran Negara 2022 No. 196. Peraturan Menteri Kominfo Nomor 5 Tahun 2021, promulgated 1 April 2021. POJK Nomor 22 Tahun 2023, effective 22 December 2023
Licence needed	No telemarketing licence or registry exists in Indonesian telecoms law. In financial services the duty falls on the PUJK itself, and an outsourced collections provider must hold a collections certification
Calling hours	Financial services only. Marketing calls Monday to Saturday, outside national holidays, 08:00 to 18:00 waktu setempat. Collections calls Monday to Saturday, outside national holidays, 08:00 to 20:00 waktu setempat. Outside financial services, no hours rule was found in UU PDP or PM Kominfo 5/2021
Time zone	The rule says waktu setempat, the consumer's own local time. Indonesia spans WIB, WITA and WIT, so a single national dialling window is the wrong shape for this market
Consent model	UU PDP Pasal 20(2)(a) explicit valid consent for one or more stated purposes, as the first of six lawful bases. POJK 22/2023 Pasal 39(1) separately forbids a financial firm from marketing through a personal communication channel without consent
Do Not Call list	None. No national register appears in UU PDP, PM Kominfo 5/2021 or POJK 22/2023. The substitutes are an operator-level refusal option for marketing SMS and a per-firm consent record in financial services
Caller ID rule	No reserved telemarketing prefix or range was found. POJK 22/2023 Pasal 39(4)(b) requires the caller to state the firm's name and explain the purpose before offering anything. SMS sender-ID masking is permitted but must be reported to the Direktur Jenderal every three months
Recording rule	Compulsory in financial services. POJK 22/2023 Pasal 39(5) requires voice or video recording of an offer made through a personal communication channel, Pasal 39(7) requires it to be documented where the offer is accepted, and Pasal 39(8) gives the consumer access to it
Data protection law	UU PDP, with a two-year transition under Pasal 74 that closed on 17 October 2024. Breach notification is 3 x 24 hours to the data subject and to the lembaga under Pasal 46
Penalties	UU PDP administrative fine up to 2 per cent of annual revenue or receipts attributable to the violation variable. Criminal exposure up to 5 years and IDR 5 billion, with corporations fined up to ten times the maximum. POJK sanctions run to dismissal of management and an administrative fine capped at IDR 15,000,000,000
Consent validity period	Not published. UU PDP sets no expiry, and the form and storage of consent evidence are delegated to an implementing regulation that was not located
Frequency caps	Not published as a number. POJK 22/2023 Pasal 62(2)(d) requires only that collections not be continuous in a way that disturbs the consumer

Who Regulates Outbound Calling in Indonesia

Three authorities matter, and none of them licenses telemarketers. Komdigi is the telecoms and digital ministry, renamed from Kominfo in 2024, and its operative instrument here is Peraturan Menteri Kominfo Nomor 5 Tahun 2021 tentang Penyelenggaraan Telekomunikasi. OJK is the financial services authority, and POJK 22/2023 is the conduct regulation that governs how a financial firm may market and collect. UU PDP creates a supervisory body, referred to in the Act simply as the lembaga, which Pasal 58 says is established by the President through a Peraturan Presiden.

Read the Komdigi regulation carefully before assuming it covers you. Its marketing chapter, BAB XIV, is addressed to mobile network operators and content service providers rather than to the business buying the calls, and every operative article in Pasal 176 to 186 is framed around layanan pesan pendek yang bersifat penawaran or marketing, which is marketing SMS. Outbound voice marketing is simply not regulated by that instrument.

In financial services the position inverts. POJK 22/2023 binds the PUJK, the Pelaku Usaha Jasa Keuangan, and its marketing and collections rules apply whether the firm dials itself or hands the work to a third party, with an outsourced collections provider needing a collections certification. Everyone else falls under UU PDP alone: any organisation deciding the purposes of processing is a Pengendali Data Pribadi, obliged by Pasal 20(1) to hold a lawful basis, with no registration and no notification to a regulator.

Consent and Opt-Out

UU PDP lists six lawful bases in Pasal 20(2). The first is valid explicit consent from the data subject for one or more specified purposes previously disclosed to them. The others are performance of a contract, a legal obligation, vital interests, a public task, and other legitimate interests balanced against the data subject's rights. Marketing to a cold list rarely survives any basis other than consent.

Pasal 21(1) prescribes what must be disclosed before that consent is taken: the legality of the processing, the purpose, the type and relevance of the personal data, the retention period of the documents containing it, the details of the information collected, the processing period, and the rights of the data subject. That is a longer notice than most outbound scripts carry, and it has to be given before the consent, not after the sale.

Withdrawal is not a soft preference. Where the data subject withdraws consent, Pasal 43(1) obliges the controller to delete the personal data, and Pasal 45 obliges it to tell the person the deletion or destruction has happened. Purpose exhaustion, a data subject request, and unlawful acquisition trigger the same duty.

Financial services adds a stricter layer. POJK 22/2023 Pasal 39(1) prohibits a PUJK from offering products or services to a prospect or customer through a personal communication channel without that person's consent. Pasal 39(2) forbids making that consent a condition of using the product or service. Pasal 39(3) requires the firm to stop offering the moment the person withdraws. And Pasal 39(4)(c) requires the caller to state the source of the person's data where it was obtained from a third party, which is the rule that makes a bought list unusable in Indonesian financial telemarketing unless you are willing to name where you bought it on the call.

Do-Not-Call

There is no national Do Not Call register in Indonesia. No such register appears in UU PDP, in PM Kominfo 5/2021, or in POJK 22/2023. There is nothing to scrub against, and no list-checking duty on the business buying the calls, because the duty sits elsewhere.

For marketing SMS the duty sits on the operator, and it is stricter than an opt-out on its face. Pasal 177 and 178 require mobile network operators and content service providers to give subscribers a way to refuse marketing SMS and to publicise that choice. Pasal 179 bars sending to anyone who has refused. Then Pasal 180 bars sending to anyone who has not chosen to refuse. Read literally, silence is not permission, and the default position is no marketing SMS at all.

Pasal 182 carves out service messages about what the subscriber already holds, such as MSISDN and data-package expiry, on condition that no marketing is inserted into them. Pasal 183 requires a complaint centre for marketing SMS, accessible at minimum on every working day, and Pasal 181(2) provides that violations are published on the ministry's website.

For voice, your do-not-call list is your own. Build it from withdrawals under UU PDP Pasal 43(1) and, in financial services, from withdrawals under POJK 22/2023 Pasal 39(3), and treat it as a hard block at dial time rather than a periodic list refresh.

Calling Hours and Days

This is the point where a single national window would be a mistake. The only published Indonesian calling hours are in POJK 22/2023, and they apply to financial services.

For marketing, Pasal 39(4)(a) permits communication only on Monday to Saturday, outside national holidays, from 08:00 to 18:00 waktu setempat, except with the prospect's or customer's own agreement or at their request. For collections, Pasal 62(2)(f) permits calls only on Monday to Saturday, outside national holidays, from 08:00 to 20:00 waktu setempat, and Pasal 62(3) allows calling outside those hours or that place only on the consumer's prior agreement.

Waktu setempat means local time, and the regulation ties the window to the consumer's local time rather than to Jakarta. Indonesia spans three zones, WIB, WITA and WIT, so an 08:00 start in Jayapura is two hours ahead of an 08:00 start in Medan. A dialler that schedules Indonesia on one national clock will be calling Papua before the window opens or stopping in Sumatra before it closes.

Outside financial services, no calling-hours rule was found in UU PDP or PM Kominfo 5/2021. Do not treat the OJK window as a national rule, and do not treat its absence elsewhere as permission to dial at midnight. Frequency caps are the same story: POJK 22/2023 Pasal 62(2)(d) requires only that collections not be continuous in a way that disturbs the consumer, with no stated count.

Caller ID and Number Presentation

Indonesia has no reserved telemarketing prefix. No dedicated range for marketing voice calls was found in PM Kominfo 5/2021 or in the other instruments, and no rule on withheld or spoofed CLI presentation for commercial calls was located. That is an absence from the instruments read rather than a positive permission, so confirm with Komdigi before relying on it.

What Indonesia regulates instead is the spoken identification. POJK 22/2023 Pasal 39(4)(b) requires a financial-services marketing call to state the name of the PUJK and to explain the purpose and objective before offering any product or service. Combined with Pasal 39(4)(c) on disclosing the source of the data, the opening thirty seconds of an Indonesian financial-services call are effectively scripted by regulation.

On the messaging side, sender-ID masking is legal but supervised. Pasal 186 requires the use of identity masking for marketing SMS to be reported every three months to the Direktur Jenderal by the mobile network operator or the content service provider. That report is not yours to file, but your sender IDs are what appears in it.

Call Recording and Notices

Indonesia is unusual: in financial services, recording the sales call is compulsory rather than merely permitted. POJK 22/2023 Pasal 39(5) obliges the PUJK to make a voice or video recording when offering products or services through a personal communication channel that uses voice or video. Pasal 39(7) obliges it to document the recording where the prospect or customer accepts the offer. Pasal 39(8) gives a consumer who takes the product a right of access to their own recording.

Pasal 39(6) closes the loop by requiring the recording itself to be made in accordance with the prevailing laws, which means UU PDP applies to the recording as personal data: a lawful basis, a stated purpose, a disclosed retention period, and erasure when the basis falls away.

Two things are not published. POJK 22/2023 names no retention period for those recordings, saying only that they are documented and accessible. And no separate spoken recording-notice duty, the familiar announcement that a call is being recorded, is stated as such; what is stated is the Pasal 39(4)(b) identification and purpose disclosure. Treat an announcement as good practice rather than as a cited rule, and confirm the retention expectation with OJK.

Messaging Rules for SMS and WhatsApp

Marketing SMS is the one channel Indonesian telecoms law addresses directly, and the duty chain runs through the operator and the content service provider rather than through you. The practical consequences are that the subscriber must have been given a refusal option, the default under Pasal 180 is no send, service messages must stay clean of marketing, a complaint route must exist, and masking is reportable.

Over-the-top channels are not named. PM Kominfo 5/2021 addresses layanan pesan pendek, short message service, not WhatsApp or similar. That does not leave them unregulated: UU PDP applies to the personal data whatever the channel, and POJK 22/2023 Pasal 39 speaks of sarana komunikasi pribadi, personal communication channels, which the regulation does not define by channel. Assume the consent, identification and stop-on-withdrawal duties follow the contact rather than the technology, and confirm the point with OJK before running a financial-services campaign on a messaging app.

Data Protection and Retention

UU PDP was promulgated on 17 October 2022 with a two-year transition under Pasal 74. That window closed on 17 October 2024, so full compliance has been due since. There is no grace period left to plan around.

Cross-border transfer is a three-step cascade in Pasal 56. First, the controller must ensure the country where the receiving controller or processor sits has a level of personal data protection equal to or higher than UU PDP. Failing that, it must ensure there is adequate and binding protection in place. Failing both, it must obtain the data subject's consent. Detail is delegated to a Peraturan Pemerintah, and no such implementing regulation was located, so the self-assessment is yours to document.

There is no Indonesian adequacy whitelist to rely on. The test is a self-assessment of the recipient country's level of protection, so every offshore contact centre, cloud region and recording archive needs either binding protection or the data subject's consent, evidenced before go-live rather than after an audit.

Retention is purpose-bound rather than fixed. Erasure under Pasal 43(1) is triggered by purpose exhaustion, consent withdrawal, a data subject request, or unlawful acquisition, and destruction under Pasal 44(1) by expiry of the archive retention period, a data subject request, the absence of live legal proceedings, or unlawful acquisition. The retention period itself must have been disclosed at the point of consent under Pasal 21(1)(d), which makes your own notice the operative ceiling.

Breach notification is fast. Pasal 46 requires written notification within 3 x 24 hours to the data subject and to the lembaga, covering the data exposed, when and how it happened, and the remediation.

Penalties and Enforcement

UU PDP Pasal 57 provides administrative sanctions: a written warning, temporary suspension of the processing activity, erasure or destruction of the personal data, and an administrative fine of up to 2 per cent of annual revenue or annual receipts against the violation variable. Breaches of Pasal 20(1), 21, 43(1), 44(1), 45, 46, 47 and 56 all attract it.

The criminal exposure is separate and larger. Unlawfully obtaining or collecting another person's personal data for gain, causing loss, carries up to 5 years and IDR 5,000,000,000. Unlawful disclosure carries up to 4 years and IDR 4,000,000,000. Unlawful use carries up to 5 years and IDR 5,000,000,000. Falsifying personal data carries up to 6 years and IDR 6,000,000,000. Under Pasal 70 a corporation pays only a fine, but up to ten times the maximum, which puts the Pasal 67(1) corporate ceiling at IDR 50 billion and falsification at IDR 60 billion, alongside confiscation of proceeds, freezing of the business in whole or part, and permanent prohibition of specified acts. Directors, controlling shareholders, order-givers and beneficial owners can be charged personally.

In financial services the sanctions bite the licence. POJK 22/2023 Pasal 39(9) for marketing and Pasal 62(4) for collections provide a written warning, restriction of products, services or business activity in whole or part, freezing of them, dismissal of management, an administrative fine, revocation of the product or service licence, and revocation of the business licence. The escalation need not start with a warning. The fine is capped at IDR 15,000,000,000 under Pasal 39(11) and Pasal 62(6).

What Changed in 2025 and 2026

The most consequential item is not a change but an absence. UU PDP Pasal 58 provides for a supervisory lembaga established by the President and answerable to him, with detail set by a Peraturan Presiden. Whether that Peraturan Presiden has been issued and the body is operating could not be confirmed. Plan on the assumption that the statutory duties bind you now and that supervision may be stood up at any time, because the Pasal 74 transition has already closed.

The implementing Peraturan Pemerintah under Pasal 56(5) for cross-border transfer and under Pasal 57(5) for the sanction procedure was likewise not located, so two of the Act's most operationally important mechanisms still lack their detail.

No 2025 or 2026 Komdigi instrument on telemarketing was found. The most recent ministerial circular, Surat Edaran Menteri Komunikasi dan Digital Nomor 4 Tahun 2026 of 26 August 2026, concerns leftover data quota and has nothing to do with marketing. PM Kominfo 5/2021 remains the operative telecoms instrument and POJK 22/2023 the binding rule for financial-services and collections dialling. Whether OJK issued any 2025 or 2026 circular elaborating Pasal 39 and Pasal 62 could not be confirmed, so check the OJK regulation index before a launch.

How the Platform Supports Each Rule

DialerBee provides compliance-supporting controls that help you meet the obligations above. Indonesia does not ship as a jurisdiction pack, so calling hours, do-not-call handling and consent are configured per tenant. The legal responsibility stays with the operator of the campaign.

Indonesian rule	Control that supports it
08:00 to 18:00 marketing window, waktu setempat	Calling windows configured per tenant and per campaign, applied before the call is originated
08:00 to 20:00 collections window, waktu setempat	Separate windows per campaign, so collections and marketing do not share one schedule
Monday to Saturday, outside national holidays	Day-of-week and holiday exclusions set per tenant calendar
Three local time zones across the archipelago	Time-zone-aware pacing so the window follows the contact rather than the campaign owner
Explicit consent for stated purposes	Consent created, updated and revoked as auditable records
Withdrawal stops the offering and triggers erasure	A revocation takes effect on the next attempt, not the next list refresh
No national register, so your own list is the list	Your do-not-call list is imported once, then searched and checked on every attempt
State the firm name and purpose before offering	Scripts and AI voice agents built per campaign from a reviewed template library
Compulsory recording of financial-services offers	Recording with configurable retention, signed-URL playback, legal hold and per-tenant isolation
Consumer right of access to their own recording	Auditor export of recordings and an audit trail on every rule override
Bahasa Indonesia contacts reached in their own language	Language-aware AI across 11 languages, Indonesian included
Calls placed over Indonesian carriers you already use	BYOC SIP trunking with caller-ID pools owned exclusively per tenant

Indonesia Outbound Compliance Checklist

Decide which regime you are in before you dial: financial services under POJK 22/2023, or UU PDP alone.
Record a lawful basis under UU PDP Pasal 20 for every contact record in the campaign.
Give the full Pasal 21(1) disclosure before taking consent, including the retention period.
Schedule financial-services marketing to 08:00 to 18:00 and collections to 08:00 to 20:00, Monday to Saturday, outside national holidays.
Apply the window in the contact's own local time across WIB, WITA and WIT rather than on one national clock.
Open financial-services calls by naming the firm and explaining the purpose.
Disclose the source of the contact data whenever it came from a third party.
Record voice offers made through personal communication channels in financial services, and document the recording where the offer is accepted.
Give a customer access to their own recording on request.
Stop offering immediately on withdrawal, and erase the personal data as Pasal 43(1) requires.
Keep your own suppression list as the do-not-call list, since no national register exists to scrub against.
Document the Pasal 56 transfer assessment before any offshore contact centre, cloud region or recording archive goes live.
Be ready to notify a breach within 3 x 24 hours to the data subject and to the supervisory body.
Re-check the Komdigi and OJK regulation indexes before launch, since the UU PDP implementing regulations are still outstanding.

Sources

Undang-Undang Republik Indonesia Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi, promulgated 17 October 2022, Lembaran Negara 2022 No. 196, Tambahan LN No. 6820.
Peraturan Menteri Komunikasi dan Informatika Nomor 5 Tahun 2021 tentang Penyelenggaraan Telekomunikasi, promulgated 1 April 2021. Komdigi JDIH
Peraturan Otoritas Jasa Keuangan Nomor 22 Tahun 2023 tentang Pelindungan Konsumen dan Masyarakat di Sektor Jasa Keuangan, effective 22 December 2023. OJK regulation PDF
Surat Edaran Menteri Komunikasi dan Digital Nomor 4 Tahun 2026, 26 August 2026. Komdigi JDIH index

Frequently Asked Questions

What are the legal calling hours in Indonesia?

Only financial services has a published window. POJK 22/2023 Pasal 39(4)(a) allows marketing communication on Monday to Saturday, outside national holidays, from 08:00 to 18:00 local time, and Pasal 62(2)(f) allows collections on Monday to Saturday, outside national holidays, from 08:00 to 20:00 local time. Outside those hours you need the consumer's own agreement. No general Indonesian calling-hours rule was found in UU PDP or in PM Kominfo 5/2021.

Does Indonesia have a Do Not Call register?

No. There is no national Do Not Call register in Indonesia, and none appears in UU PDP, PM Kominfo 5/2021 or POJK 22/2023. What exists is an operator-level option for subscribers to refuse marketing SMS, and in financial services a per-firm consent and withdrawal duty. Your own suppression list, built from withdrawals, is the list you have to enforce.

Do I need consent to call Indonesian numbers?

You need a lawful basis under UU PDP Pasal 20, and for marketing to a cold list that basis is normally explicit consent for stated purposes under Pasal 20(2)(a). In financial services POJK 22/2023 Pasal 39(1) is explicit: a firm may not offer products or services through a personal communication channel without the person's consent, and it may not make that consent a condition of using the product.

Is call recording mandatory in Indonesia?

In financial services, yes. POJK 22/2023 Pasal 39(5) requires a PUJK to make a voice or video recording when offering products or services through a personal communication channel that uses voice or video, Pasal 39(7) requires the recording to be documented where the offer is accepted, and Pasal 39(8) gives the consumer access to it. No retention period is named in the regulation.

Is there a telemarketing caller-ID prefix in Indonesia?

No reserved prefix or dedicated number range for telemarketing voice calls was found in PM Kominfo 5/2021 or the other instruments reviewed. What is required instead is spoken identification: POJK 22/2023 Pasal 39(4)(b) obliges a financial-services caller to state the firm's name and explain the purpose before offering anything. Confirm the numbering position with Komdigi before relying on the absence.

Why can I not use one national calling window for Indonesia?

Because the regulation ties the window to waktu setempat, the consumer's own local time, and Indonesia spans three time zones: WIB, WITA and WIT. An 08:00 start in the eastern zone is two hours earlier in clock terms than an 08:00 start in the west, so a single national schedule will either dial before the window opens in the east or stop early in the west.

What happens if I market to Indonesian consumers without consent?

Under UU PDP Pasal 57 the administrative sanctions run from a written warning to suspension of processing, erasure of the data, and a fine of up to 2 per cent of annual revenue or receipts against the violation variable. In financial services POJK 22/2023 adds licence-level consequences including restriction or freezing of business activity, dismissal of management, and an administrative fine capped at IDR 15,000,000,000.

Has Indonesia's data protection regulator started supervising?

UU PDP Pasal 58 provides for a supervisory lembaga established by the President through a Peraturan Presiden, and whether that instrument has been issued and the body stood up could not be confirmed. The duties themselves are already binding: the two-year transition under Pasal 74 closed on 17 October 2024, so compliance is due regardless of the supervisory position.

Indonesia Outbound Calling Compliance: UU PDP and OJK (2026)