Tax, payment, hosting and data-protection changes from the four hubs, merged into one timeline, newest first, each with the document it comes from.
By Matthews WongResearched on
Key takeaway
Indonesian rules that reach software change several times a year, and the change usually lands on a fixed date: a new tax rate, a new invoice format, a new payment fee or a new compliance deadline. Each entry below gives that date, what it means for a build, and the regulation, press release or provider notice it comes from.
Showing 38 / 38 dated changes
7 dated changes
Each SPT correction now replaces the previous return, and a normal SPT Masa PPN cannot be filed while the prior period's is missing unless that period is under audit. VAT return exports become full-period snapshots.
Source:DJP briefing on PER-12/PJ/2026, amending PER-11/PJ/2025 (pajak.go.id)Small, medium and large merchants pay 0% on QRIS transactions up to Rp100,000, down from 0.7%, while micro merchants keep 0% up to Rp500,000. Expected-fee checks in reconciliation need the new threshold.
Source:Bank Indonesia: Indonesia Credit Card and 0% MDR Policy (28/159/DKom)A domestically processed credit card, issued by eight providers at launch, is spent through QRIS by scan or tap, so it reaches merchants through their existing QRIS acceptance.
Source:Bank Indonesia: Indonesia Credit Card and 0% MDR Policy (28/159/DKom)Hukumonline reports it takes effect on 16 January 2027. The text was not yet on peraturan.go.id or JDIH BPK when this page was researched, so its details are unconfirmed here.
Source:Hukumonline (news): Pelindungan data pribadi dalam penegakan hukum di bawah PP 33/2026The converter and templates are versioned and keep changing. Record the template version each export targets, and re-test the serialiser when DJP publishes a new one.
Source:DJP: Template XML dan Converter Excel ke XML (pajak.go.id)Decision 137/PUU-XXIII/2025 rejects the petition against Article 56 in full, leaving its tiered test for transfers abroad unchanged.
Source:Mahkamah Konstitusi: Putusan Nomor 137/PUU-XXIII/2025Only low-risk services may run there for now, after BSSN security testing from July to December 2025. Higher-risk systems wait on ISO certification and BSSN's recommendations.
Source:Antara (national news agency, secondary source): Kemkomdigi operates PDN 1 on a limited basis, 26 January 202611 dated changes
A technical unit in Kabupaten Bekasi under the Directorate General of Digital Government Technology now manages the PDN for central and regional agencies, under the SPBE mandate of Perpres 95/2018.
Source:JDIH Komdigi: abstract of Permenkomdigi No. 18 Tahun 2025, Balai Layanan PDNImport PPh 22 is 2.5% of import value with an API and 7.5% without, with fixed rates for listed goods. It is not final, so post it to prepaid income tax rather than inventory.
Source:PMK No. 51 Tahun 2025, full text (copy hosted by Klikpajak)Decision 151/PUU-XXII/2024 reads the Article 53 criteria as alternatives, so meeting any one of them obliges a controller or processor to appoint a data protection officer.
Source:Mahkamah Konstitusi: Putusan Nomor 151/PUU-XXII/202417-digit code and serial, the serial assigned on approval, upload and approval by the 20th of the following month, and whole-rupiah rounding with 0.50 rounding up.
Source:DJP: full text of PER-11/PJ/2025 (pajak.go.id)Microsoft's first cloud region in Indonesia, with three availability zones; the launch event followed on 27 May 2025. Check the per-region product list before planning around a specific Azure service.
Source:Microsoft Indonesia newsroom: general availability of Indonesia Central cloud regionFrom 1 January to 31 March 2025, non-luxury invoices showing 11% or 12% of the selling price were treated as correct. After that, invoices had to show 12% × 11/12 × selling price; an overcharged buyer could ask for the 1% back through a replacement invoice.
Source:DJP written statement KT-01/2025 on PER-1/PJ/2025BI set this date for launching QRIS Tap, NFC payment without scanning, and for moving BLU and PSO merchants' QRIS pricing from 0.4% to 0%.
Source:Bank Indonesia: Siaran Pers Hasil RDG Februari 2025 (27/36/DKom)Normal invoices may come from the desktop client, with exclusions; their numbers gain a 9 at the fifth digit in Coretax. Returns, cancellations and the SPT Masa PPN stay in Coretax.
Source:DJP announcement PENG-13/PJ.09/2025 on tax invoices via e-Faktur Client DesktopSpecial bases that sat in separate regulations now use 12% × 11/12 × DPP, or a set formula × 12% × 11/12 × DPP. Each special case is a row in the rate table, not a code path.
Source:DJP press release SP-4/2025 on PMK-11/2025Tax invoices are created and signed in Coretax. At launch it accepted XML uploads of up to 100 invoices per submission, and DJP's first fixes included company role access (impersonation) and a PIC for invoicing.
Source:DJP written statement KT-02/2025 on the Coretax implementationThe tax engine needs two bases: the full price for PPnBM goods and 11/12 of it for everything else. For luxury goods sold to end consumers, the 11/12 base applied through January 2025 and the full base from 1 February 2025.
Source:Kemenkeu JDIH: PMK No. 131 Tahun 2024 on PPN treatment4 dated changes
The ministry that regulates electronic system operators and runs the PDN is now the Kementerian Komunikasi dan Digital. Point references and contacts at Komdigi, whose regulations are published at jdih.komdigi.go.id.
Source:BPK JDIH: Perpres No. 174 Tahun 2024 tentang Kementerian Komunikasi dan DigitalTwo years after promulgation, the Article 74 deadline for bringing personal data processing into line with the law passes.
Source:JDIH BPK: UU No. 27 Tahun 2022 tentang Pelindungan Data PribadiTax ID columns move to 16-digit strings plus a 22-digit NITKU per location. Other parties could keep the 15-digit NPWP until 31 December 2024 if their systems were not ready.
Source:DJP announcement PENG-26/PJ.09/2024 on using the NPWP and NITKU (pajak.go.id)Brain Cipher encrypted the data in Data Center 2, affecting 239 tenants as of 26 June. Backup was a separate service tenants requested, so off-site copies you control and have restored are the requirement, not an extra.
Source:Telkom Indonesia disclosure to OJK, 26 June 2024: ransomware attack on the PDNS cloud service4 dated changes
Customers of participating institutions scan QRIS or NETS QR codes with their existing mobile banking apps in either country.
Source:Bank Indonesia: Launch of Cross-border QR Payments Linkage between Indonesia and Singapore (25/310/DKom)Users of population data must hold a certified information-security standard and may not pass the data to third parties; the shared-platform provisions are deleted.
Source:JDIH BPK: Permendagri No. 17 Tahun 2023, amending Permendagri 102/2019 on access to population dataASPI now runs the SNAP Developer Site, verification and updates to the standard, so the current specification documents are published there rather than on bi.go.id.
Source:Bank Indonesia: Mulai 1 September 2023 Pengelolaan SNAP Dilakukan oleh ASPI (25/240/DKom)Customers of participating institutions can pay by scanning QRIS or DuitNow QR codes in either country.
Source:Bank Negara Malaysia: Commercial launch of the Indonesia-Malaysia cross-border QR payment linkage3 dated changes
Enacted and promulgated the same day, starting a two-year period for controllers, processors and other parties to bring their processing into line (Article 74).
Source:JDIH BPK: UU No. 27 Tahun 2022 tentang Pelindungan Data PribadiPermenkominfo 10/2021 tied the deadline to six months after risk-based OSS licensing took effect; the ministry set it at 20 July 2022, with access blocking for unregistered systems.
Source:Antara (news): Kominfo minta platform digital segera mendaftarEffective three months after promulgation, replacing POJK 38/POJK.03/2016. Article 35 requires a commercial bank's data centre and disaster recovery centre in Indonesia, with exceptions only by OJK permission.
Source:peraturan.go.id: POJK Nomor 11/POJK.03/2022, full text3 dated changes
Real-time interbank credit transfers run 24/7, starting with individual transfers, which matters for refunds and payouts that leave by bank transfer.
Source:Bank Indonesia: BI Launches Bank Indonesia Fast Payment (23/334/DKom)A three-zone AWS region in Indonesia. It must be enabled explicitly in the account before resources can be created there.
Source:AWS News Blog: now open, AWS Asia Pacific (Jakarta) RegionPayment providers had to move existing APIs onto SNAP by 30 June or 31 December 2022 and integrate their service users by 30 June 2024, so bank payment APIs now share one signing and response-code contract.
Source:Bank Indonesia: PADG 23/15/PADG/2021 on the national payment Open API standard2 dated changes
Defines which platforms register through OSS, puts the personal data processed and its storage location on the form, and sets takedown windows of 1 x 24 hours, or 4 hours for urgent requests.
Source:JDIH Komdigi: Permenkominfo No. 5 Tahun 2020 tentang Penyelenggara Sistem Elektronik Lingkup PrivatThe first Google Cloud region in Indonesia, with three zones from the start, so a multi-zone Google Cloud deployment could stay in the country.
Source:Google Cloud blog: new Google Cloud region in Jakarta now open3 dated changes
Every electronic system operator must register before users start using the system, keep an audit trail and run security procedures; private-scope operators may store data abroad if supervision stays effective.
Source:JDIH BPK: PP No. 71 Tahun 2019 tentang Penyelenggaraan Sistem dan Transaksi ElektronikIn force from 10 October 2019, replacing PP 82/2012. Public-scope operators must keep systems and data in Indonesia; private-scope operators may host abroad if supervision and access stay effective.
Source:BPK JDIH: PP No. 71 Tahun 2019, status and full textEvery payment QR code had to follow QRIS from 31 December 2019, so one code is payable from any registered issuer's app.
Source:Bank Indonesia: Quick Response Code Indonesian Standard (QRIS)1 dated changes
In-country hosting from a global public cloud became an option. Alibaba Cloud pitched it at customers with latency or data-residency requirements; its Jakarta region is ap-southeast-5.
Source:Alibaba Cloud press release via Business Wire China: first data centre in Indonesia commences operationThe other hubs, the reference pages and the calculators in this section.