# A2P SMS regulations in Indonesia

> A2P SMS in Indonesia is regulated by the Ministry of Communications and Digital Affairs — Komdigi, formerly Kominfo — with data protection governed by the Personal Data Protection Law (Law No. 27 of 2022). Commercial traffic is sent under a registered "masking" sender ID provisioned through the operators (Telkomsel, Indosat, XL), consent is required for marketing, and anti-spam controls apply.

- Canonical URL: https://www.broadnet.me/regulations/indonesia
- Language: en
- Last reviewed: 2026-09-30
- Publisher: BroadNet (https://www.broadnet.me)

## Key facts

- **Masking** — Registered branded sender ID for commercial SMS
- **27/2022** — Personal Data Protection Law (PDP Law)
- **3+** — Main operators (Telkomsel, Indosat, XLSMART)

## Who regulates A2P SMS in Indonesia?

Telecommunications and digital services in Indonesia are regulated by the Ministry of Communications and Digital Affairs — Komdigi (Kementerian Komunikasi dan Digital), previously known as Kominfo. It sets operator and consumer-protection rules, while data-privacy obligations flow from the Personal Data Protection Law (Undang-Undang Pelindungan Data Pribadi, Law No. 27 of 2022). A2P traffic is delivered and enforced through the mobile operators.

- Regulator: Komdigi / Kominfo (komdigi.go.id).
- Data-protection law: PDP Law (Law No. 27 of 2022).
- Operators enforce masking and anti-spam rules.
- Traffic delivered through licensed local operators.

## Masking (sender-ID) registration

Commercial A2P messages are delivered under a registered "masking" — a branded alphanumeric sender ID — provisioned through the operators via a corporate/bulk-SMS agreement and supporting documents. The masking should identify the business, and content is typically mapped to the declared use case. Unregistered masking and international grey-route traffic are liable to be filtered or blocked.

- Branded "masking" sender ID registered via the operators.
- Masking should identify the registered business.
- Content mapped to the declared use case.
- Unregistered masking and grey-route traffic are blocked.

## Promotional vs. transactional messages

Marketing/promotional SMS carries the strictest consent and content obligations, while transactional/service messages — OTPs, banking alerts, delivery and account notifications — are tied to an existing customer relationship. Both are delivered under a registered masking, but promotional traffic must respect consent, opt-out and any operator timing guidance, and should be kept separate from transactional flows.

- Promotional: consent, opt-out and content rules apply.
- Transactional/service (OTP, alerts): existing-relationship messages.
- Both delivered under a registered masking.
- Keep marketing and transactional traffic on separate maskings.

## Consent, opt-out and anti-spam

Marketing should go only to recipients who have consented, with a clear, free opt-out that is honoured, and operators apply anti-spam controls against unsolicited bulk messaging. Subscribers can report spam and nuisance SMS, and persistent senders risk blocking. Sending marketing to those who have opted out is treated as spam, so maintain suppression lists and auditable consent records.

- Obtain consent before promotional sends.
- Offer a free, honoured opt-out.
- Operators apply anti-spam filtering; subscribers report spam.
- Keep suppression lists and consent records.

## Data protection: the PDP Law (Law No. 27 of 2022)

Personal data used for messaging is governed by the Personal Data Protection Law, Law No. 27 of 2022, which introduced consent, purpose-limitation, data-subject-rights, breach-notification and cross-border-transfer obligations, with a transition period for full compliance and an implementing authority being established. Processing mobile numbers for marketing needs a lawful basis — generally consent — and recipients can withdraw it. Confirm the current commencement and implementing-regulation details.

- Law: PDP Law (Law No. 27 of 2022).
- Lawful basis (usually consent) to process marketing data.
- Data-subject rights and breach-notification obligations apply.
- Confirm current implementing rules — the framework is bedding in.

## Enforcement and operator landscape

Enforcement runs through operator-level blocking of unregistered masking and non-compliant/grey-route traffic, spam-complaint handling and Komdigi directives; the PDP Law adds data-protection sanctions once fully operational. Indonesia's main operators are Telkomsel, Indosat Ooredoo Hutchison and XLSMART (formed in April 2025 by the merger of XL Axiata and Smartfren); reaching all subscribers means registering the masking with each. Confirm current registration fees, documents and timelines at onboarding.

- Enforcement: masking/traffic blocking and spam-complaint handling.
- PDP Law adds data-protection sanctions.
- Main operators: Telkomsel, Indosat, XLSMART.
- Confirm current fees, documents and timelines at registration.

## Indonesia rules: promotional vs. transactional SMS

|  | Promotional / marketing | Transactional / service (OTP, alerts) |
|---|---|---|
| Registered masking (sender ID) required | Yes | Yes |
| Prior consent required | Yes | No |
| Free opt-out required | Yes | No |
| Local licensed routing (no grey routes) | Yes | Yes |
| PDP Law lawful basis for data | Yes | Yes |
| Existing customer relationship expected | No | Yes |

## Frequently asked questions

### What is "masking" and do I need to register it in Indonesia?

Masking is Indonesia's term for a branded alphanumeric sender ID. Commercial A2P messages are delivered under a registered masking provisioned through the operators via a corporate/bulk-SMS agreement. The masking should identify your business, content is mapped to the declared use case, and unregistered masking or grey-route traffic is liable to be filtered or blocked.

### Who regulates A2P SMS in Indonesia?

The Ministry of Communications and Digital Affairs — Komdigi (formerly Kominfo) — regulates telecommunications and digital services and sets operator and consumer-protection rules, enforced through the mobile operators. Data-privacy obligations flow separately from the Personal Data Protection Law (Law No. 27 of 2022).

### Which data protection law applies to SMS campaigns?

The Personal Data Protection Law, Law No. 27 of 2022, governs the personal data behind campaigns. It introduced consent, purpose-limitation, data-subject-rights, breach-notification and cross-border-transfer obligations, with a transition period for full compliance. Processing mobile numbers for marketing generally needs consent, which recipients can withdraw. Confirm current implementing details as the framework beds in.

### What's the difference between promotional and transactional SMS?

Promotional (marketing) SMS carries the strictest consent, content and opt-out obligations, while transactional/service messages — OTPs, banking alerts, delivery and account notifications — are tied to an existing customer relationship. Both are delivered under a registered masking; keep the two flows on separate maskings with separate consent records.

### Can I use a cheaper international (grey) route?

Not safely. The operators block unregistered masking and grey-route A2P traffic, which harms deliverability and can expose the sender to enforcement. A carrier-grade local route under a registered masking protects deliverability and keeps traffic inside Indonesian rules. Register with each operator you need to reach.

### Which operators do I need to reach?

Indonesia's main mobile operators are Telkomsel, Indosat Ooredoo Hutchison and XLSMART (the April 2025 merger of XL Axiata and Smartfren). To reach the full subscriber base you register your masking with each relevant network and route through a licensed local channel. A provider with direct connections handles registration and compliant termination on your behalf.

## Related

- [Indonesia coverage](https://www.broadnet.me/coverage/indonesia)
- [All regulations](https://www.broadnet.me/regulations)

## Technical facts for Indonesia

Network codes, message lengths and sender-ID rules in one table. Segment lengths are the GSM standard values (3GPP TS 23.038).

| Technical facts | |
|---|---|
| Mobile country code (MCC) | 510 |
| Dialling code | +62 |
| Operators (MCC-MNC) | Telkomsel · 510-10; Indosat Ooredoo H. · 510-01; XL (XLSMART) · 510-11; Smartfren (XLSMART) · 510-09 |
| SMS length, GSM-7 (Latin alphabet) | 160 characters in a single SMS; 153 per part when concatenated |
| SMS length, UCS-2 (Arabic, Cyrillic and other scripts) | 70 characters in a single SMS; 67 per part when concatenated |
| Regulator | Komdigi (Ministry of Communication and Digital Affairs) |
| Sender-ID rules | Komdigi + operator sender ID registration. Bahasa Indonesia and English supported. |
| Sender-ID lead time | 5-10 business days |

## Sources

- [Komdigi — Kementerian Komunikasi dan Digital](https://www.komdigi.go.id/)