LKPP Regulation 2/2026 Introduces a New E-Catalogue Framework That Reshapes Participation and Purchasing in Government Procurement
Indonesia’s National Public Procurement Agency (Lembaga Kebijakan Pengadaan Barang/Jasa Pemerintah or “LKPP“) has issued LKPP Regulation No. 2 of 2026 on Electronic Catalogue in Government Procurement of Goods or Services (“Regulation“), introducing a revised framework for participation and transactions in the government’s E-Catalogue system. Effective from 1 September 2026, the regulation replaces LKPP Regulation No. 9 of 2021 and reinforces e-purchasing as the primary procurement method where required goods or services are available through the E-Catalogue.
The Regulation introduces a formal product curation system, subjecting catalogue listings to greater review and scrutiny. It also introduces performance security for the first time for e-purchasing contracts involving goods, construction work or other services exceeding IDR200 million, subject to an exception for certain services. New price controls require procurement officials to prepare an owner’s estimate (harga perkiraan sendiri or HPS), or a price reference for transactions of up to IDR100 million, to assess the reasonableness of catalogue prices.
The Regulation also integrates the previously separate online shop into the E-Catalogue, primarily for domestic products and products supplied by micro and small enterprises and cooperatives, with transactions capped at IDR50 million. It further introduces a requirement to prioritise local businesses for e-purchasing of construction work, although the detailed mechanism will be governed by separate LKPP rules.
The E-Catalogue’s scope is also expanded to certain self-managed procurement activities and subject to administrator access, non-governmental entities. Businesses participating in government procurement should therefore review their product listings, supporting documentation, pricing, performance-security arrangements and procurement strategies to address the more structured compliance and governance framework.
For more information, click here to read our Legal Update.
Indonesia Establishes its International Financial Centre: An Introduction to the PFII Law
Indonesia has established a framework for one or more Indonesia International Financial Centres (Pusat Finansial Internasional Indonesia or “PFII“) through the PFII Law, representing a significant step in the country’s efforts to attract international capital, financial institutions, family offices, fintech businesses, and multinational companies. The new regime introduces a specialised legal, regulatory, and dispute resolution framework that differs from Indonesia’s conventional onshore system and is intended to position Indonesia as a regional financial hub.
The PFII framework creates a dedicated institutional architecture, including a PFII Board, a PFII management body, a standalone financial services regulator (Lembaga Pengawas Jasa Keuangan or LPJK PFII), a specialised arbitration institution, and a dedicated PFII court. Businesses operating within the PFII may therefore become subject to a separate licensing, supervisory, and dispute resolution regime distinct from the existing framework administered by the Financial Services Authority (Otoritas Jasa Keuangan or OJK) and the Indonesian courts.
The PFII is designed to accommodate a broad range of activities, including banking, insurance, capital markets, fintech, carbon trading, investment management, family offices, commodity trading, and professional services. The PFII Law also permits flexible investment structures and introduces a foreign currency operating environment, English as the working language, and the potential incorporation of international legal principles and common law concepts through future PFII regulations.
To attract investors and financial institutions, the PFII Law provides extensive tax and non-tax incentives, including long-term income tax facilities, customs and value-added tax (VAT) incentives, immigration benefits, and residency-related incentives. However, the framework also ring-fences PFII activities from Indonesia’s domestic financial system by restricting certain fundraising and lending activities outside the PFII. Many practical aspects, including licensing requirements, supervision, incentive eligibility, and the interaction with existing financial regulations, remain subject to implementing regulations that must be issued within six months of enactment.
For more information, click here to read our Legal Update.
PDP Law Updates: The PDP Implementing Regulation Is Out, and It Clarifies Some Key Questions Under Indonesia's PDP Law
Indonesia has taken a major step in implementing its personal data protection regime through Government Regulation No. 33 of 2026 on the Implementation of the Personal Data Protection Law (“GR 33“), which provides long-awaited clarification on several key aspects of Law No. 27 of 2022 on Personal Data Protection (“PDP Law“). It came into force on 16 July 2026 and provides a six-month transition period, after which non-compliance may be subject to administrative sanctions.
GR 33 clarifies a number of practical issues that had created uncertainty under the PDP Law. Regarding personal data breaches, the regulation confirms that the 72-hour notification period only begins once a breach has been reasonably and definitively established based on supporting evidence. Organisations must also maintain records of breaches and adopt internal incident-response policies.
The regulation provides further guidance on lawful bases for processing, particularly contractual necessity and legitimate interests, and requires controllers relying on legitimate interests to conduct and document a legitimate interests assessment (LIA). It also elaborates on cross-border data transfers by confirming that future adequacy assessments will be conducted by the Data Protection Authority (DPA), while transfers may also rely on Standard Contractual Clauses, Binding Corporate Rules, or limited consent-based exceptions.
GR 33 further strengthens accountability obligations by introducing detailed requirements for data protection officers (DPOs), records of processing activities (ROPA), data protection impact assessments (DPIAs), privacy notices, and data subject rights procedures. The regulation also establishes specific rules for handling personal data in corporate transactions such as mergers and acquisitions. Finally, it confirms that administrative fines of up to 2% of annual revenue may apply for various PDP Law violations, including failures relating to lawful processing, breach notification, data subject rights, cross-border transfers, and compliance governance measures.
For more information, click here to read our Legal Update.
Indonesia and Singapore Sign MOU on Carbon Credits Cooperation –
On 6 July 2026, Singapore and Indonesia signed a Memorandum of Understanding (“MOU“) for collaboration on carbon credits under Article 6 of the Paris Agreement. Under the MOU, both countries will exchange information and technical expertise on carbon markets, work towards an Implementation Agreement, and identify high-integrity carbon credit projects to support their respective Nationally Determined Contributions (NDCs).
For more information, click here to read our Legal Update.
Consumer Protection under the Amended P2SK Law (Law 4/2026): Expanded Scope, Stronger Enforcement
Indonesia’s Law No. 4 of 2026 on Amendments to Law No. 4 of 2023 on the Development and Strengthening of the Financial Sector (“Amended P2SK Law“) introduces several important consumer protection reforms for the financial sector while largely retaining the existing consumer protection framework. The reforms are particularly significant for financial institutions, fintech companies, and crypto asset businesses, reflecting the government’s broader effort to strengthen oversight, governance, and enforcement in the financial services industry.
A key development is the formal inclusion of crypto assets and digital asset services within Indonesia’s financial sector consumer protection regime. Consumer protection obligations now expressly apply to crypto asset traders, exchanges, custodians, clearing and settlement institutions, and other entities designated by the Financial Services Authority (Otoritas Jasa Keuangan or “OJK“). The amendments also expand OJK’s powers to suspend or block non-compliant crypto asset transactions and trading activities, including those involving foreign parties.
The Amended P2SK Law also broadens the liability of crypto and digital asset institutions for consumer losses. Liability may now arise from misconduct, negligence, or regulatory violations committed not only by management and third parties acting on behalf of the institution, but also by controlling shareholders and controlling parties. As a result, businesses should reassess governance structures, outsourcing arrangements, and risk allocation mechanisms.
Another significant reform is the expansion of the mandate of the cross-sectoral task force established under the P2SK framework. The task force may now address consumer protection issues such as improper debt collection practices, misuse of consumer data, misleading conduct, and other breaches of consumer protection rules. The amendments also introduce a restorative justice mechanism for certain financial-sector offences, allowing disputes to be resolved through compensation-based settlements, although further implementing regulations are still awaited.
For more information, click here to read our Legal Update.
Please note that whilst the information in this Update is correct to the best of our knowledge and belief at the time of writing, it is only intended to provide a general guide to the subject matter and should not be treated as a substitute for specific professional advice
