Kemenkes
Indonesia - Kemenkes
Permenkes No. 62/2017 + Kemenkes digital-health regulations
Authority
Ministry of Health (Kemenkes); BPOM for combination products
Enforced
2017
Legal framework
Permenkes 62/2017 + UU PDP (Personal Data Protection Law 2022) + BSSN guidance
Scope
All medical devices distributed in Indonesia, including SaMD. Risk-class based registration.
Pre-market
Risk-class registration dossier, halal certification where applicable, e-Watch reporting commitments.
Post-market
e-Watch adverse event reporting, distribution audits.
SBOM
RecommendedEncouraged in line with IMDRF N60; mandate expected as digital-health rules mature.
Vulnerability disclosure
BSSN (National Cyber and Crypto Agency) coordinated disclosure recommended.
Penalty
Registration revocation; UU PDP fines up to 2% of annual revenue.
Unique requirements
- 01Indonesian Distributor Holder (IPAK)
- 02Bahasa Indonesia labelling
- 03Halal certification for relevant categories
Highlights
- UU PDP closely modelled on GDPR
- BSSN cybersecurity overlay for hospitals
- Largest ASEAN device market by population
Aligns with
Timeline
2017
Permenkes 62/2017 issued
Oct 2022
UU PDP enacted
Oct 2024
UU PDP full enforcement
Key documents
How to submit in Indonesia
Playbook reviewed · 2026-07-16
Submission route
Ministry of Health (Kemenkes) registration via Regalkes portal
Indonesia requires a local licence holder (IPAK holder). Cybersecurity documentation, when submitted, is reviewed as part of the technical file.
Authority portalStep-by-step
Step 01
Appoint local representation
Most jurisdictions require a locally-established entity to hold the registration or act as authorised representative before submission.
Step 02
Reuse FDA or CE package as baseline
Adapt the cybersecurity subsection you already prepared for FDA or CE; regulators here typically accept the structure and ask for local labeling additions.
Step 03
Translate and localise
Local-language technical summary and labeling are usually mandatory; certified translation is safest.
Step 04
Submit + track queries
Respond to clarification rounds promptly; each unanswered question can add 30-90 days to the clock.
Evidence checklist
| Item | Level |
|---|---|
| Cybersecurity documentation (baseline FDA or CE) | Required |
| Local authorised representative agreement | Required |
| Local-language labeling and IFU | Required |
| SBOM | Recommended |
Common Kemenkes rejections
IPAK-holder appointment missing
CommonFix · Appoint an IPAK-licensed distributor before submission.
Typical timeline
End-to-end window: 4-10 months
Phase 01
Local rep + dossier prep
2-4 months
Phase 02
Regulatory review
4-10 months
Phase 03
Approval + market entry
1-3 months
Related markets
Frequently asked about Indonesia
Is SBOM required for medical devices in Indonesia?
Recommended. Encouraged in line with IMDRF N60; mandate expected as digital-health rules mature.
What does Kemenkes require for pre-market cybersecurity?
Risk-class registration dossier, halal certification where applicable, e-Watch reporting commitments.
What are the post-market cybersecurity obligations under Kemenkes?
e-Watch adverse event reporting, distribution audits.
What is the penalty for non-compliance with Kemenkes cybersecurity rules?
Registration revocation; UU PDP fines up to 2% of annual revenue.
How much of my FDA cybersecurity package is reusable in Indonesia?
Roughly 65% - an editorial estimate based on overlapping evidence requirements (threat model, SBOM, security risk assessment, pen-test report).