Indonesia — Private Investigation Is Not Licensed

Asia-Pacific Private Investigation Registry · AI9OS

The finding: six licensed categories, and investigation is not among them

Singapore and Malaysia both define the regulated activity to include an investigation limb, capturing the obtaining and furnishing of information about another person. Indonesia does not. Perkap 17/2006 Pasal 2 sets out the whole of the BUJP regime as six headings:

a. security consultancy; b. security devices; c. security training and education; d. valuables security transport; e. guard services; f. K9 services.

Searching the full Indonesian text of that regulation for penyelidikan, penyelidik, investigasi, detektif and penyidikan returns nothing at all, on any of the five. This is the same shape as Thailand, where the Thai word for detective is absent from all 76 sections of the security services statute.

What makes Indonesia stronger evidence than Thailand is that the list was re-enacted in 2025. PP 28/2025 Pasal 180 restates the six categories at Government Regulation level, a higher rank of law than a police regulation, nineteen years after they were first written. The drafters had the opportunity to add an investigation category and did not. The absence is a decision, not an oversight of drafting in 2006.

The one place the regime touches information-gathering

There is a single provision in the BUJP regime that authorises collecting information, and its scope is narrow enough to matter. Perkap 17/2006 Pasal 4 lists the permitted activities of a security consultancy business. Sub-paragraph (g) reads:

information-gathering services for the purposes of the client company’s own internal self-managed security (pengamanan swakarsa internal perusahaan), in accordance with the provisions of laws and regulations.

Three limits are built into that one sentence. The service sits under consultancy, not as a category of its own. It is scoped to the client’s own internal self-protection, which is not the same thing as investigating a third party on a client’s behalf. And it is expressly made subject to other law, which is where the data protection statute discussed below comes in.

The adjacent sub-paragraph (f) permits consultancy on business risk “including security and business information”. Between them these two provisions describe corporate security advisory work. They do not describe surveillance, tracing, or matrimonial or insurance investigation.

What changed in 2025, and the gap it opened

Two reforms landed within seven months of each other, and they do not line up.

PP 28/2025 came into force on 5 June 2025 and replaced PP 5/2021 outright. Its security subsector annex licenses one classification code, KBLI 80100 Aktivitas Keamanan Swasta, at high risk, with the six BUJP categories as scope entries beneath it. Pasal 551 required the implementing regulations to be issued within four months, meaning by 5 October 2025.

KBLI 2025 then arrived. Peraturan Kepala BPS No. 7 Tahun 2025 was enacted on 17 December 2025 and promulgated on 18 December 2025 at Berita Negara 2025 No. 1091, and it carries the status Berlaku on the Ministry of Investment legal database. The OSS and AHU systems were required to transition to it by 18 June 2026, a deadline that has now passed. BPS published its own conversion table from the 2020 classification, and it records what happened to the two relevant codes:

• 80100 Aktivitas Keamanan Swasta → 80110, marked Gabung Kode (merged)
• 80300 Aktivitas Penyelidikan → 80110, marked Gabung Kode (merged)

So the separate investigation code is gone. Private security and investigation are now a single code, 80110 Aktivitas Investigasi dan Keamanan Swasta, whose definition expressly includes “investigation services in the private, commercial, insurance and legal fields” alongside guarding and patrol. The division heading was renamed to match: division 80 is now Aktivitas Investigasi dan Keamanan.

The gap is this. The licensing annex still names 80100, a code that no longer exists, and the code it was merged into now carries investigation with it. Read literally, an activity that was never licensed has been folded into the code that attracts a high-risk police licence. Nobody has re-issued the annex to say what that means, and the implementing-regulation deadline passed eleven months ago.

There is a second, quieter mismatch. KBLI 2025 excludes risk analysis and security consultancy from 80110 and sends it to subgolongan 8019 instead. That is the very category under which Pasal 4(g), the only licensed information-gathering in the whole BUJP regime, sits. The one provision that touches investigation and the code that now names investigation have been separated.

The real constraint is data protection, not licensing

The absence of a licence is not permission. Indonesia differs sharply from Thailand here, because it has a data protection statute with criminal penalties that lands directly on the core activity of investigation.

UU No. 27 Tahun 2022 on Personal Data Protection came into force on 17 October 2022, with a two-year compliance period under Pasal 74 that expired on 17 October 2024. Pasal 65(1) prohibits unlawfully obtaining or collecting personal data that is not your own, with intent to benefit yourself or another, where doing so may cause loss to the data subject. Pasal 67(1) sets the penalty at five years’ imprisonment and/or a fine of Rp5,000,000,000. Unlawful disclosure carries four years and Rp4 billion; unlawful use carries five years and Rp5 billion.

Two features of the statute decide whether investigative work falls inside or outside it.

First, a lawful basis is required. Pasal 20(2) lists six, and the one an investigator would reach for is (f), the pursuit of other legitimate interests “having regard to the purpose, the necessity, and the balance between the interests of the controller and the rights of the data subject”. That is a balancing test, and it is what separates lawful collection from the melawan hukum element in Pasal 65.

Second, and this is the trap, the law enforcement exemption does not cover private investigators. Pasal 15(1) exempts certain data-subject rights for national defence and security, for the law enforcement process, for public administration, for financial sector supervision, and for statistics and scientific research. But Pasal 15(2) confines every one of those to the implementation of statutory provisions. A private firm gathering evidence for a client is not exercising a statutory law-enforcement function, and cannot borrow the exemption from the police.

The practical reading is that Indonesia has no licence to obtain and no licence to lose, but it does have a five-year offence sitting directly underneath the work, and the compliance deadline for it passed nearly two years ago.

The electronic information law, as narrowed by the Constitutional Court

UU No. 1 Tahun 2024, the second amendment to the Electronic Information and Transactions Law of 2008, came into force on 2 January 2024. Two Constitutional Court rulings have since changed how its key provisions must be read, and both are recorded against the statute in the national legal database.

Putusan No. 105/PUU-XXII/2024 narrowed the online defamation provisions at Pasal 27A and Pasal 45(4) in two ways. The phrase “another person” must now be read as excluding government bodies, groups with a specific identity, institutions, corporations, professions and offices. And “a matter” must be read as an act that degrades a person’s honour or good name. The effect is that only a natural person can be defamed under the provision. A report about a company is outside it.

Putusan No. 115/PUU-XXII/2024 held that “unrest” in Pasal 28(3) and Pasal 45A(3) means disorder in physical space, not conditions in digital or cyber space.

Both narrowings matter to anyone publishing findings in Indonesia, and neither appears in the general commentary on the ITE law that a search will surface first.

Foreign ownership: no sector cap

Indonesia’s investment regime is a positive list. Perpres 10/2021, in force since 4 March 2021 and amended by Perpres 49/2021, states at Pasal 2(1) that all business fields are open to investment except those declared closed or reserved to central government, and at Pasal 3(2) that fields not appearing in its annexes may be undertaken by all investors.

We read both restricted annexes. The list of fields with specific requirements runs to 46 entries and covers press, broadcasting, post, transport, alcohol, traditional medicine and the like. The list of fields reserved to or in partnership with cooperatives and MSMEs runs to 89 entries and covers agriculture, construction, crafts and small services. Neither contains a security or investigation entry. The security subsector annex to PP 28/2025 contains no share-ownership requirement either.

This is a real contrast with the rest of the registry. Thailand caps guarding at Thai majority ownership on the face of its Act, and the Philippines bars foreign ownership outright. Indonesia’s current instruments impose neither, and require only that the licensee be a PT.

How this compares

Indonesia and Thailand reach the same answer on licensing and diverge completely on consequence. In Thailand the heaviest stick we found attaches to unlicensed guarding and is a year and a modest fine. In Indonesia the licensing sanction is administrative, but a separate statute puts five years on the collection of personal data without a lawful basis. Reading only the licensing regime in either country produces the wrong risk picture, and in Indonesia it produces it by a wide margin.

Primary sources

• Peraturan Pemerintah No. 28 Tahun 2025 on risk-based business licensing, with Lampiran I.O (BPK legal database)
• Peraturan Kapolri No. Pol. 17 Tahun 2006 on the guidance of security business entities, BUJP (PDF, Polri)
• UU No. 27 Tahun 2022 on Personal Data Protection, with Putusan MK 151/PUU-XXII/2024 (BPK)
• UU No. 1 Tahun 2024, second amendment to the ITE Law, with Putusan MK 105 and 115/PUU-XXII/2024 (BPK)
• Perpres No. 10 Tahun 2021 on investment business fields, with Lampiran II and III (BPK)
• Perpres No. 49 Tahun 2021, amending Perpres 10/2021 (BPK)
• Klasifikasi Baku Lapangan Usaha Indonesia (KBLI) 2025, Peraturan Kepala BPS No. 7 Tahun 2025, Berita Negara 2025 No. 1091. Status Berlaku, enacted 17 December 2025 and promulgated 18 December 2025, resolved on the Ministry of Investment legal database (jdih.bkpm.go.id) because the national BPK database does not carry agency-level regulations. The classification itself is BPS publication catalogue 1302017, ISBN 978-602-438-530-9; the BPS site sits behind a bot challenge, so the publication was retrieved from an Indonesian government mirror and identified by its BPS catalogue and ISBN. Note that the register records no revocation of the 2020 regulation (the status field reads Tidak ada referensi), so the succession is evidenced by the BPS conversion table and the OSS transition deadline rather than by a recorded revocation

Related

• Vietnam — Private Investigation Licensing
• Thailand — Private Investigation Licensing
• Singapore — Private Investigation Licensing
• Malaysia — Private Investigation Licensing
• Philippines — Private Investigation Licensing
• Laos — Not Licensed, and the Data Law Is the Constraint
• Hong Kong · Investigation Is Not Licensed
• Japan · Notification, and the Internet Exclusion
• South Korea · Not Licensed, and the Data Law Is the Constraint
• Asia-Pacific Private Investigation Registry

General information for practitioners, not legal advice. Engage Indonesian counsel before relying on this reading for a live matter. The English on this page is our own translation from the Indonesian; the Indonesian governs. Absence of a licensing regime is not absence of legal risk, and the instruments flagged above have not been examined.