Indonesia's digital economy is set to exceed US$130 billion by 2025, underscoring its pivotal role in driving the nation's economic growth. Micro, Small, and Medium Enterprises (MSMEs) and tech start-ups are at the heart of this transformation, contributing significantly to the country's economic output. According to a study by Google, Temasek, and Bain & Company, MSMEs made up about 57% of Indonesia’s GDP in 2020. This study also revealed that 80% of these businesses are already utilizing digital tools like e-commerce platforms and social media to reach customers and streamline operations.

As the digital economy expands, data privacy and protection have become increasingly important. In response, the Indonesian government has enacted two key regulations: Government Regulation (GR) 71/2019 on the Organization of Electronic Systems and Transactions, and the Personal Data Protection (PDP) Law. While these measures aim to protect personal data, they also raise concerns regarding data localization, which requires electronic system operators (ESOs) to store personal data within Indonesia's borders.

Data Localization and its Implications
Currently, GR 71/2019 mandates only Public ESOs, such as government entities, to retain data domestically. However, reports suggest that future revisions could extend this requirement to the private sector, a move that may challenge MSMEs and tech start-ups. These businesses are key contributors to Indonesia's job creation and consumer problem-solving and often rely on cross-border data processing. The PDP Law further restricts the flow of data across borders, adding another layer of complexity for businesses.

Although data localization aims to enhance security and sovereignty, it could increase operational costs and limit access to global technologies. This is particularly concerning for early-stage start-ups with limited resources, which may struggle to compete on a global scale due to restrictions on data transfer and increased expenses.

A Global Perspective
Internationally, regulations like the EU’s General Data Protection Regulation (GDPR) are regarded as benchmarks for data protection. The challenge for Indonesia is to balance the right to data protection with the freedom to conduct business. For MSMEs and start-ups, stringent data localization policies could restrict their ability to access best-in-class technologies from overseas providers, undermining the broader goals of Visi Indonesia Digital 2045, which seeks to position Indonesia as a global digital leader.

SPUN: A Case Study in the Immigration Tech Space
SPUN, an Indonesian start-up specializing in immigration technology, provides an example of how data localization measures could impact MSMEs. SPUN simplifies visa and permit processes for Indonesians, many of whom face significant barriers when traveling internationally. While data localization aims to protect sensitive information, it also raises questions about the feasibility of scaling businesses like SPUN on a global level.

The Path Forward
As Indonesia's digital economy continues to thrive, creating a regulatory framework that supports both data protection and business growth is essential. A one-size-fits-all approach to data localization may not be the most effective solution, given the diverse needs of MSMEs and tech start-ups. A more flexible and risk-based approach could help Indonesian businesses innovate and compete globally.

By fostering international cooperation and aligning with global best practices, Indonesia can empower its digital economy to grow while ensuring robust data protection. This balance is crucial as the nation looks ahead to a future where technology drives economic prosperity and improves the quality of life for its citizens.