Uncovering Opportunities from the US-Indonesia Data Deal

Imagine millions of personal data: names, cell phone numbers, home addresses, shopping histories, even medical records. All moving across oceans, from servers in Jakarta to data centers in Silicon Valley. Fast, almost without a trace, in the name of efficiency, innovation and investment.

This is one of the most crucial, and least visible, impacts of the Framework Agreement on Reciprocal Trade - which Indonesia and the United States formalized on July 22.

In an official statement issued by the White House, in addition to the billion dollar deal, it was revealed that Indonesia will allow the personal data of its citizens to flow freely to the United States, or what is often referred to as Cross Border Data Transfer (CBDF).

"Indonesia will also provide certainty regarding the ability to move personal data out of its territory to the United States through recognition that the United States is a country or jurisdiction that provides adequate data protection under Indonesian law," the White House statement read yesterday.

Which personal data?

In his explanation, Coordinating Minister for Economic Affairs Airlangga Hartarto revealed that the personal data referred to in the Indonesia-US cooperation agreement is mostly data uploaded by people themselves:

Sign up for accounts on platforms such as Google and Bing,
Shop online or use e-commerce,
Creating emails, and other digital activities.

"When it comes to personal data, actually some personal data is the practice of the community when registering on Google, Bing, doing e-commerce and others, when creating e-mail, accounts, it is uploading its own data," said Airlangga in a press conference, Tuesday (22/7/2025).

He also emphasized that such data has long been exchanged across countries, especially in digital transaction services.

"So far, when using digital transactions such as Mastercard, Visa Card, data is exchanged between one country and another," he said.

The personal data exchanged is used for, among other things:

Identity verification or Know Your Customer (KYC),
Fraud and fraud prevention,
As well as additional security systems such as OTP (One-Time Password).

Airlangga explained the importance of strong protocols to protect data in various digital transactions, especially in the midst of the rapid use of cloud computing and artificial intelligence (AI) technology.

"This is what requires a strong protocol to protect data in transactions, whether it is used through cloud computing or in the future there will be more and more use of AI. Because AI is data mining or scrolling of all data in digital," he explained.

Furthermore, he said that the exact form of data that will be regulated and included in the agreement will still be finalized in further technical discussions.

"When it is finalized, we will only talk about what form it will take. Once the form is this, signing, that," he concluded.

"America sees the importance of data centers in the Indonesian region. Therefore, data centers are one of the biggest investments, apart from downstreaming," Airlangga explained.

This policy is considered crucial to maintain the smooth flow of data across countries, which is the backbone of digital trade.

"We have had discussions with several countries, including the European Union and also in the OECD forum. Almost all ministers in the OECD support WTO reform, including this moratorium," said Airlangga.

With this moratorium, digital content such as software, movies, music, and data sent across countries will not be subject to import duties, so that costs for digital businesses are maintained.

Airlangga also emphasized that this agreement is one of the important foundations for strengthening Indonesia's trade digitalization. In addition to keeping the cost of digital trade low, the government is also encouraging the development of a national digital ecosystem.

"America sees the importance of data centers in the Indonesian region. Therefore, data centers are one of the biggest investments, apart from downstreaming," he explained.

As an illustration, the value of investment in Indonesia's digital sector in 2024 was recorded at USD 4.8 billion, a slight decrease of around 5% compared to the previous year (based on Southeast Asia Internet Economy Report data).

The government hopes that through the relaxation of cross-border data transfer rules, digital investment can grow again to reach USD 6 billion by 2026.

This is because the potential of Indonesia's digital economy is large. The Ministry of Investment and Downstream projects that the value of Indonesia's digital economy will reach USD 130 billion by 2025, equivalent to 44% of the total projected digital economy of Southeast Asia.

Meanwhile, by 2023, the value of investment in the digital economy sector has reached USD 22 billion, placing Indonesia in second place as a digital investment destination in the region, after Singapore, which pocketed USD 141 billion. This figure also far exceeds Vietnam (USD 18 billion) and Malaysia (USD 17 billion).

According to Airlangga, there are 12 companies from the United States that have established data centers in Indonesia, such as Amazon Web Services in West Java, Microsoft, Google Cloud, to Equinix and Oracle.

The presence of this data center supports secure cross-border data flow, while supporting the needs of e-commerce businesses, digital payments, and artificial intelligence (AI)-based services.

He also ensured that the government will oversee the management of personal data of Indonesian citizens in accordance with national laws, and has collaborated with a number of global technology companies that build data centers in Indonesia.

In addition, Indonesia and the US are also discussing rules of origin arrangements so that digital products and components made in Indonesia can compete more competitively in the US market.

This includes efforts to encourage several strategic products, such as palm oil, coffee, cocoa, and medical device components produced in free trade zones, to obtain lower tariffs, even close to 0 percent.

With this policy, the government hopes to strengthen Indonesia's position as a major player in the digital economy in ASEAN, while boosting the digital sector's contribution to national economic growth.

Who benefits?

Then, who will benefit? Not only tech giants. Digital UMKM players will find it easier to use foreign cloud services, analytics tools, or cross-border payment systems that have been hindered by regulations.

"Certainly, the digital economy will get legal certainty to operate in Indonesia, and there will also be benefits (for digital businesses-ed)," said Mochamad Firman Hidayat, Member of the National Economic Council.

According to the Ministry of Cooperatives and SMEs, there are 25.5 million UMKM that have been digitized. They are the backbone of e-commerce, which last year reached a transaction value of IDR 474.5 trillion (approximately USD 30 billion).

"Those who benefit should not only be the upper layers, UMKM that have been digitized must be involved, the government must be able to invite not only big businesses, UMKM that already have hubs, so that the benefits also flow here, not only to large corporations," said Prof. Didin Damanhuri, Economist of Paramadina University.

One of the important points in the agreement between Indonesia and the United States is the commitment of both countries to support a permanent moratoriumon customs duties on electronic transmissions. This policy is considered crucial to maintain the smooth flow of data across countries, which is the backbone of digital trade.

Data is the 'oil' of the 21st century

Chairman of the Indonesia Cyber Security Forum (ICSF) Ardi Sutedja said data is not just numbers. It is the new gold, the "oil" of the 21st century, competitiveness, a source of innovation, as well as a source of power.

According to him, there are a series of critical notes that must be considered so that this agreement does not backfire on digital sovereignty, national security, and the economy.

"What is important is not just whether or not cross-border data flows are allowed, but under whose terms the data is regulated," said Ardi.

First, he said, is the risk of data security. When sensitive data on citizens and vital infrastructure is more accessible to foreigners, the opportunity for misuse increases. Cyber attacks, data theft, and ransomware are increasingly real threats.

"Data is not just about privacy, but about strategic assets. If everything moves outside, we lose control," Ardi explained.

With the dominance of foreign technology giants, Indonesia is prone to losing its independence in managing digital infrastructure. Business policies can also be "driven" by outside interests.

He said that if the raw data of Indonesian citizens is free to flow out, added value such as innovation in artificial intelligence, analytics, and new services will occur abroad, not in Indonesia. Plus, the potential loss of tax revenue because profits and servers are abroad.

"Imagine that we are only a supplier of digital raw materials, while the added value and taxes are enjoyed by other countries," said Ardi.

This concern was also confirmed by Center of Economic and Law Studies CELIOS digital economy researcher Nailul Huda. According to him, Indonesia has actually had personal data sovereignty since the passing of the Personal Data Protection Law (UU PDP) in 2022.

In the PDP Law, precisely the Second Part of Article 56, it is indeed stipulated that the transfer of personal data outside the jurisdiction of the Republic of Indonesia is possible, provided that the destination country has a level of data protection equal to or higher than that stipulated by the PDP Law. Not only that, there must be adequate and binding data protection.

"The requirements are actually quite heavy for the country receiving the data," said Huda.

"So, the protection of our personal data is actually not yet strong, and there are no technical rules on how data transfers abroad are carried out. But the government has dared to promise our data to the United States," said Huda.

"So if Indonesia makes data protection a requirement, actually the US has not fulfilled it," he said.

The government certainly hopes that digital investment will surge, employment will increase, and UMKM will be more competitive. However, investment must not be paid for by the loss of digital sovereignty and national security.

"Therefore, even if you want to transfer data abroad, there must be rules that allow the Indonesian government to keep an eye on our personal data even though it is on a server in the US," said Huda.

"If there is no? That's it. If our data is breached overseas, our government can lose control."