Your contextGeneral reading

Adapt the reading to the assessed company’s country and activity.

Home / Jurisdictions / Indonesia

Country file

Indonesia

The Union's purchases here are mainly manufactured consumer goods. Around half the population is connected and local hosting is dense here. Regional markers: East Asia and Pacific.

Relationship with the European Union

Comprehensive Economic Partnership Agreement with the European Union — negotiations concluded in 2025, not yet legally binding

The text has been negotiated but is not yet in effect. Check its status before contracting — and expect nothing from it in terms of security requirements.

Sources reviewed on 17 September 2026

01

Economy and sectors

Negotiations concluded

Comprehensive Economic Partnership Agreement with the European Union

negotiations concluded in 2025, with no binding effect to dateThe text has been negotiated but is not yet in effect. Check its status before contracting — and expect nothing from it in terms of security requirements.

Map of trade agreements — European Commission
Third country

regime applicable to European data and access

European framework trackedNo general adequacy decision. The transfer mechanism and its accompanying measures must be chosen according to the actual data flows.

Adequacy decisions — European Commission
No country regime

European Union restrictive measures targeting the country

EU Sanctions Map, as at 26 September 2026No EU restrictive measures regime targets this country. Thematic regimes — terrorism, human rights, cyberattacks, chemical weapons — nonetheless target individuals of any nationality: screening against the consolidated list applies here as elsewhere.

EU Sanctions Map — European Commission
02

Incidents, fraud and impersonation

2 939

secure servers per million inhabitants

2024, latest available figureLocal hosting and certifications are common there. That says nothing about the security of any given provider — only about the terrain in which it operates.

Secure Internet servers — World Bank
Diverted order

verification of instruction changes

Cross-cutting controlOn recurring flows, impersonation works through a change of bank details announced partway through the relationship. Confirm it through a channel already known to you.

03

Points to check within your organisation

To be scoped

The sites and headcount involved

This type of production involves several sites and a large workforce, rarely named in the contract. Establish which ones work for you and who supervises them.

To be governed

What accompanies orders

Without an adequacy decision, order files, your teams' contact details and your own customers' data may only circulate under proper safeguards. Ask which transfer tool has been adopted and who has access to it on site.

To be located

Where your data actually resides

Local hosting is common here, which does not tell you where your data actually lands: ask for the country of each environment, including backups, and who holds the keys.

Developments to be aware of

The topics that may change your answers

EU restrictive measures

No EU restrictive measures regime targets this country. Thematic regimes — terrorism, human rights, cyberattacks, chemical weapons — nonetheless target individuals of any nationality: screening against the consolidated list applies here as elsewhere.

EU Sanctions Map — European Commission
What this means for your situation

Miscellaneous manufactured articles: 24.9% of what the Union buys here. No single sector really dominates these purchases. It is therefore the contract, not the country, that should determine what is actually being supplied.

Official sources

Confidential exchange

Describe your European relationship and the request received.

The Indonesia file establishes a country and its relationship with the Union. What remains is to establish which sites work for you, with what headcount and what subcontracting.

Contact iKNSA