Guest Wi-Fi compliance in Indonesia: UU PDP and Kominfo
Indonesian hospitality venues must balance telecommunications compliance under Kominfo regulations with the Personal Data Protection Law (UU No. 27/2022).
RM-WiFi delivers compliant session logging following local statutory regulations, bilingual English and Bahasa Indonesia captive notices, and strict separation between connectivity and marketing consent.
Law No. 27/2022 on Personal Data Protection (UU PDP)
Enacted in October 2022, Law No. 27/2022 on Personal Data Protection (Undang-Undang Perlindungan Data Pribadi or UU PDP) establishes comprehensive statutory obligations for data controllers operating across Indonesia. Hotels, villa resorts, and beach clubs providing guest Wi-Fi act as data controllers under the statute.
UU PDP establishes fundamental requirements for personal data processing:
- Lawful basis requirement
- Under Article 20, data controllers must possess a valid legal basis before processing guest data, distinguishing between contractual necessity, legal obligations, and consent.
- Explicit and recorded consent
- Consent must be expressed clearly in writing or recorded electronically. Bundled terms and forced consent are prohibited under Article 22.
- Bilingual transparency in Bahasa Indonesia
- Data privacy notices presented to users within Indonesian jurisdiction must be provided in Bahasa Indonesia alongside English.
- Data protection officer requirements
- Large-scale hospitality operators processing substantial volumes of personal data must appoint a designated Data Protection Officer (DPO) under Article 53.
Kominfo electronic system operator regulations
Commercial Wi-Fi providers operate under regulatory supervision by the Ministry of Communication and Digital Affairs (Komdigi, formerly Kominfo). Relevant frameworks include Government Regulation No. 71/2019 on Electronic Systems and Transactions (PP PSTE) and Ministerial regulations on electronic system records.
Hospitality operators must maintain operational compliance:
- Private electronic system operator rules
- Hospitality venues operating guest portals fall within the scope of Private Scope Electronic System Operators (PSE Lingkup Privat).
- Traffic and connection audit logs
- Operators must maintain reliable activity logs in accordance with local regulations, documenting user sessions, allocated internal IP addresses, external NAT mappings, client MAC addresses, and connection timestamps to assist lawful investigations.
- Data storage and encryption
- Connection records must be encrypted in transit and at rest using modern cryptographic standards, protecting stored logs against unauthorised modification or interception.
- NTP time synchronisation
- Network controllers and gateways must maintain synchronised system clocks referencing Stratum 1 or Stratum 2 time servers to preserve forensic admissibility.
Staying guest PMS verification and OTA consent
Under UU PDP Article 16, data processing must adhere to the principle of data minimisation, collecting only personal information necessary for the stated purpose.
RM-WiFi aligns guest sign-in with how the reservation was made:
- Room and surname authentication
- In-house guests authenticate by entering their room number and surname. RM-WiFi cross-references the request against the live PMS database.
- No email prompt for direct-booked guests
- Direct-booked guests whose personal contact details are already on file connect immediately with zero email or survey prompts.
- Optional email and consent prompt for OTA-booked guests
- Guests who booked via an OTA with a masked proxy email can be prompted for their personal email address and a separate, unbundled marketing opt-in under UU PDP Article 22.
- Official identity linkage
- Legal identification requirements under Indonesian telecommunications rules are satisfied because the guest's identity is verified at front-desk check-in via official identity cards (KTP for Indonesian nationals or passport / KITAS for foreign visitors) recorded in the PMS.
- Automated check-out expiry
- Wi-Fi access ends at PMS folio check-out after a short grace period, preventing unauthorised usage following departure.
Bilingual captive portal and unbundled marketing consent
RM-WiFi provides localised captive portal interfaces tailored to Indonesian regulatory requirements.
Captive screens balance legal transparency with guest clarity:
- Automatic locale detection
- Captive portals detect user device language preferences and present full terms and privacy disclosures in Bahasa Indonesia and English.
- Unbundled connectivity terms
- Guests accept standard network terms of use to obtain basic internet access.
- Optional promotional consent
- Marketing opt-in checkboxes for email or WhatsApp promotions remain separate, optional, and unchecked by default.
- Full performance for declining guests
- Guests who decline promotional marketing receive identical internet bandwidth, speed tiers, and connection quotas as guests who opt in.
Data subject rights and automated data lifecycle
UU PDP Articles 5 through 13 grant data subjects explicit legal rights, including the right to obtain details on data processing, rectify errors, and request deletion or destruction of personal records.
RM-WiFi manages data subject requests systematically:
- Immediate CRM profile deletion
- When a guest submits an erasure request, RM-WiFi removes contact details, preferences, and marketing tags from RM-CRM.
- Preservation of statutory technical logs
- Network session logs retained to follow local telecommunications regulations remain preserved in pseudonymised format until the applicable statutory retention window expires.
- Automated lifecycle purging
- Upon expiration of the local statutory retention period, connection logs are permanently and irreversibly purged from platform databases.
- Law enforcement disclosure
- When presented with formal judicial orders from Indonesian authorities, RM-WiFi provides targeted log exports for specified IP or MAC addresses without exposing unrelated guest records.
Clear subscription plans, or a tailored quote for your property.
See our published monthly rates for RM-WiFi, RM-Tables, RM-CRM, RM-Desk and Resort Manager Flex on our Pricing page, or tell us how many rooms and outlets you run and which add-on modules you need for a tailored proposal.