A2P SMS regulations in Indonesia.
Compliance with Komdigi and the PDP Law.
A2P SMS in Indonesia is regulated by the Ministry of Communications and Digital Affairs — Komdigi, formerly Kominfo — with data protection governed by the Personal Data Protection Law (Law No. 27 of 2022). Commercial traffic is sent under a registered "masking" sender ID provisioned through the operators (Telkomsel, Indosat, XL), consent is required for marketing, and anti-spam controls apply.
Who regulates A2P SMS in Indonesia?
Telecommunications and digital services in Indonesia are regulated by the Ministry of Communications and Digital Affairs — Komdigi (Kementerian Komunikasi dan Digital), previously known as Kominfo. It sets operator and consumer-protection rules, while data-privacy obligations flow from the Personal Data Protection Law (Undang-Undang Pelindungan Data Pribadi, Law No. 27 of 2022). A2P traffic is delivered and enforced through the mobile operators.
- Regulator: Komdigi / Kominfo (komdigi.go.id).
- Data-protection law: PDP Law (Law No. 27 of 2022).
- Operators enforce masking and anti-spam rules.
- Traffic delivered through licensed local operators.
Masking (sender-ID) registration
Commercial A2P messages are delivered under a registered "masking" — a branded alphanumeric sender ID — provisioned through the operators via a corporate/bulk-SMS agreement and supporting documents. The masking should identify the business, and content is typically mapped to the declared use case. Unregistered masking and international grey-route traffic are liable to be filtered or blocked.
- Branded "masking" sender ID registered via the operators.
- Masking should identify the registered business.
- Content mapped to the declared use case.
- Unregistered masking and grey-route traffic are blocked.
Promotional vs. transactional messages
Marketing/promotional SMS carries the strictest consent and content obligations, while transactional/service messages — OTPs, banking alerts, delivery and account notifications — are tied to an existing customer relationship. Both are delivered under a registered masking, but promotional traffic must respect consent, opt-out and any operator timing guidance, and should be kept separate from transactional flows.
- Promotional: consent, opt-out and content rules apply.
- Transactional/service (OTP, alerts): existing-relationship messages.
- Both delivered under a registered masking.
- Keep marketing and transactional traffic on separate maskings.
Consent, opt-out and anti-spam
Marketing should go only to recipients who have consented, with a clear, free opt-out that is honoured, and operators apply anti-spam controls against unsolicited bulk messaging. Subscribers can report spam and nuisance SMS, and persistent senders risk blocking. Sending marketing to those who have opted out is treated as spam, so maintain suppression lists and auditable consent records.
- Obtain consent before promotional sends.
- Offer a free, honoured opt-out.
- Operators apply anti-spam filtering; subscribers report spam.
- Keep suppression lists and consent records.
Data protection: the PDP Law (Law No. 27 of 2022)
Personal data used for messaging is governed by the Personal Data Protection Law, Law No. 27 of 2022, which introduced consent, purpose-limitation, data-subject-rights, breach-notification and cross-border-transfer obligations, with a transition period for full compliance and an implementing authority being established. Processing mobile numbers for marketing needs a lawful basis — generally consent — and recipients can withdraw it. Confirm the current commencement and implementing-regulation details.
- Law: PDP Law (Law No. 27 of 2022).
- Lawful basis (usually consent) to process marketing data.
- Data-subject rights and breach-notification obligations apply.
- Confirm current implementing rules — the framework is bedding in.
Enforcement and operator landscape
Enforcement runs through operator-level blocking of unregistered masking and non-compliant/grey-route traffic, spam-complaint handling and Komdigi directives; the PDP Law adds data-protection sanctions once fully operational. Indonesia's main operators are Telkomsel, Indosat Ooredoo Hutchison and XLSMART (formed in April 2025 by the merger of XL Axiata and Smartfren); reaching all subscribers means registering the masking with each. Confirm current registration fees, documents and timelines at onboarding.
- Enforcement: masking/traffic blocking and spam-complaint handling.
- PDP Law adds data-protection sanctions.
- Main operators: Telkomsel, Indosat, XLSMART.
- Confirm current fees, documents and timelines at registration.
- Submit your KYC packTrade licence, authorisation letter and sample messages
- BroadNet files the applicationWith the operators or the regulator, as the market requires
- Review and approvalTypical lead time5-10 business days
- Send under your brandYour approved sender ID on every message
Technical facts for Indonesia
Network codes, message lengths and sender-ID rules in one table. Segment lengths are the GSM standard values (3GPP TS 23.038).
| Mobile country code (MCC) | 510 |
|---|---|
| Dialling code | +62 |
| Operators (MCC-MNC) |
|
| SMS length, GSM-7 (Latin alphabet) | 160 characters in a single SMS; 153 per part when concatenated |
| SMS length, UCS-2 (Arabic, Cyrillic and other scripts) | 70 characters in a single SMS; 67 per part when concatenated |
| Regulator | Komdigi (Ministry of Communication and Digital Affairs) |
| Sender-ID rules | Komdigi + operator sender ID registration. Bahasa Indonesia and English supported. |
| Sender-ID lead time | 5-10 business days |
Sources
Last reviewed
More on Indonesia
Compare A2P SMS rules across the region.
Each market pairs a regulatory playbook with its live coverage and operator-direct routing detail.
Indonesia rules: promotional vs. transactional SMS
| Capability | Promotional / marketing | Transactional / service (OTP, alerts) |
|---|---|---|
| Registered masking (sender ID) required | ||
| Prior consent required | — | |
| Free opt-out required | — | |
| Local licensed routing (no grey routes) | ||
| PDP Law lawful basis for data | ||
| Existing customer relationship expected | — |
Common questions
What is "masking" and do I need to register it in Indonesia?
Who regulates A2P SMS in Indonesia?
Which data protection law applies to SMS campaigns?
What's the difference between promotional and transactional SMS?
Can I use a cheaper international (grey) route?
Which operators do I need to reach?
Keep exploring
Test first. Go live with confidence.
Test access on request, reply within one business day. Pay-as-you-go in production. Volume pricing from 1M messages/month.