Indonesia is a large and varied market, and for many exporters it is the second ASEAN country after Malaysia or Singapore. Its data protection framework is newer than its neighbours’. That is a reason to be conservative in how first contact is made, not a reason to assume anything goes.
This is general information, not legal advice. Laws and official guidance change. Check the current position, and take advice on your own circumstances, before acting.
The law in brief
Law No. 27 of 2022 on Personal Data Protection, often called the PDP Law or UU PDP, was enacted in October 2022 with a two-year transition period that ended in October 2024. It governs the processing of personal data about individuals, and it is drafted to reach some processing that takes place outside Indonesia where that processing has legal consequences in Indonesia.
The law lists several lawful bases for processing, including consent, performance of a contract, legal obligations and legitimate interests. It gives individuals rights that include access to their data, correction, deletion and the withdrawal of consent.
Implementing regulations and the supervisory body contemplated by the law have taken time to put in place. Check the current position before relying on any detail that depends on them.
Why we take a consent-led, company-inbox approach
The presence of legitimate interests in the law does not mean it can be assumed for every cold email. It requires the sender to weigh its own interest against the individual’s, and to be able to explain that judgement afterwards. With a young framework and guidance still developing, our rules for Indonesia are deliberately more conservative than the list of bases might suggest.
In practice that means writing to generic company inboxes published on the company’s own website, rather than to named individuals. It also means avoiding personal webmail addresses. A free webmail address is often a person’s own mailbox, which blurs the line between business and personal contact, and it gives the recipient less reason to trust that the message is legitimate.
Purpose, identity and the way out
Whatever the lawful basis, the same habits reduce risk. Say who you are and which company you represent. Explain briefly why you are writing to this company. Ask one question. Give a working way to stop, and honour it at once. Keep a record of where each address came from, so that a question about it can be answered.
Language and replies
Many Indonesian companies, especially exporters and larger groups, correspond in English. Others work mainly in Bahasa Indonesia, and a first message in the recipient’s working language is often easier to route internally. Outreach Asia can draft in the buyer’s language, but that only helps if someone on the client side can handle the reply. Decide before the campaign starts who will answer, and in which language.
A promotional message sent to personal webmail addresses copied from a listing, with no clear sender and no way to opt out.
A short, identified message to the company’s published enquiry inbox, with one relevant question and an unsubscribe that works immediately.
How we apply this
For Indonesia, Outreach Asia contacts generic company inboxes only and flags free webmail addresses rather than using them. Every first message waits 24 hours for review. Opt-outs stop all contact immediately and join a do-not-contact list shared across every client workspace. If a campaign needs to reach named people, or to run at volume, take local advice first.
Before you move on.
- The address is a company inbox published on the company’s own site.
- Personal webmail addresses have been excluded.
- The message states who is writing and why.
- Someone can answer a reply in the language used.
- The source of every address is recorded.
This is general information, not legal advice. Outreach Asia describes its own rules and practices here; they are not a statement that any particular campaign complies with the law.