SaaS Subscription Agreement in Indonesia: Template, Key Clauses and Local Law (2026)

A SaaS subscription agreement is the contract between a software vendor and a customer that sets the terms for access to a hosted application: what the customer can use, for how long, at what service level, and on what commercial and data terms. In Indonesia this contract is shaped not just by what the two sides agree, but by a small set of local rules on contract language, electronic systems and personal data that catch many foreign vendors by surprise. This guide explains the clauses that matter, the Indonesian law that applies, and a template outline you can adapt. It is general information, not legal advice. Confirm the current position with an Indonesian-qualified lawyer before you sign. ## What law governs a SaaS agreement in Indonesia? There is no single SaaS statute. A subscription agreement in Indonesia sits on top of several layers of law: - The Indonesian Civil Code (Kitab Undang-Undang Hukum Perdata, KUHPerdata). Article 1320 sets the four conditions for a valid contract: consent of the parties, capacity to contract, a specific subject matter, and a lawful cause. Article 1338 gives contracts the force of law between the parties and is the source of freedom of contract.

• The Electronic Information and Transactions Law (Law No. 11 of 2008, amended by Law No. 19 of 2016 and Law No. 1 of 2024), the ITE Law. It recognises electronic contracts and electronic signatures, which matters for a product sold and accepted entirely online.
• Government Regulation No. 71 of 2019 on the Operation of Electronic Systems and Transactions, which replaced GR 82 of 2012 and took effect in October 2019. A SaaS platform is an electronic system, and a vendor serving Indonesian users may fall within the Private Electronic System Operator registration regime administered by the Ministry of Communication.
• The Personal Data Protection Law (Law No. 27 of 2022), the PDP Law, which applies whenever the service processes personal data of people in Indonesia.
• The Consumer Protection Law (Law No. 8 of 1999) where the customer is an individual consumer rather than a business. ## Is an online or click-through SaaS contract valid in Indonesia? Yes. The ITE Law recognises electronic contracts and electronic documents as valid and binding, and electronic signatures can carry legal force. A click-through or clickwrap acceptance can form a contract, provided the four Civil Code conditions are met and the user genuinely had the chance to read and accept the terms. Two practical cautions apply. First, onerous or one-sided terms buried in standard online terms are easier to challenge, so surface limitations of liability, auto-renewal and termination clearly. Second, the language rule below can affect enforceability for contracts involving an Indonesian party. ## The Indonesian language requirement This is the issue most often missed. Article 31 of Law No. 24 of 2009 on the National Flag, Language, Emblem and Anthem requires that agreements involving an Indonesian party be made in the Indonesian language. A foreign-language version may also be used. The courts have read this strictly in the past. In 2013 the West Jakarta District Court voided an English-only loan agreement for breaching Article 31, a decision later upheld on appeal. Presidential Regulation No. 63 of 2019 later clarified that parties can agree which language version prevails in a bilingual contract, and Supreme Court Circular No. 3 of 2023 indicated that the absence of an Indonesian version should not by itself void a contract unless bad faith is shown. The safe practice remains to prepare a bilingual Indonesian and English agreement and to execute both versions together, naming the version that prevails. ## Key clauses in a SaaS subscription agreement | Clause | What it should cover | | --- | --- | | Subscription and access | Named product, user or usage metric, territory, start date and term | | Fees and payment | Price, currency, billing cycle, taxes including VAT, late payment interest | | Service levels (SLA) | Uptime target, support response times, service credits as the remedy | | Data protection | Roles, security measures, breach notice, cross-border transfer, PDP Law compliance | | Intellectual property | Vendor keeps the software; customer keeps its own data | | Confidentiality | Mutual, with carve-outs and a survival period | | Warranties and disclaimers | Service warranty, disclaimer of implied warranties to the extent allowed | | Limitation of liability | Cap, and exclusion of indirect loss, drafted to survive challenge | | Term, renewal and termination | Initial term, auto-renewal, termination for cause, effect of termination | | Data return and deletion | Export format and window, deletion timeline after exit | | Governing law and disputes | Governing law, and court or arbitration, for example BANI arbitration in Jakarta | ## Data protection under the PDP Law If the service processes personal data of individuals in Indonesia, the PDP Law (Law No. 27 of 2022) applies. It uses a controller and processor model similar to European law. The customer is usually the data controller and the SaaS vendor the data processor acting on the customer's documented instructions. The agreement, or a separate data processing addendum, should set the purpose and scope of processing, security obligations, breach notification, rules on sub-processors, assistance with data subject rights, and what happens to data on termination. The PDP Law carries administrative sanctions and, for serious breaches, further penalties, so this is not boilerplate to skip. ## Electronic system operator registration Under GR 71 of 2019 and its implementing ministerial regulation, private electronic system operators that serve Indonesian users may need to register with the Ministry of Communication before the system is used. Public operators must localise data in Indonesia; private operators generally may host inside or outside Indonesia unless a sector rule says otherwise. A foreign SaaS vendor with Indonesian users should check whether registration applies to it, because non-registration can lead to access restrictions. ## A template outline you can adapt 1. Parties and definitions

2. Grant of subscription and scope of use
3. Fees, taxes and payment terms
4. Service levels and support
5. Customer responsibilities and acceptable use
6. Data protection and security addendum
7. Confidentiality
8. Intellectual property and customer data ownership
9. Warranties and disclaimers
10. Limitation of liability
11. Term, renewal and termination
12. Data export and deletion on exit
13. Governing law, language and dispute resolution
14. Signatures, in Indonesian and English where an Indonesian party is involved ## Common mistakes to avoid - Using an English-only contract with an Indonesian counterparty and ignoring the language law.

• Treating the data clauses as generic and not mapping them to the PDP Law.
• Forgetting to check electronic system operator registration.
• Auto-renewal and liability caps hidden in dense terms, which are easier to challenge.
• No clear data export and deletion process at the end of the term. ## Keeping SaaS contracts under control Once you move past one contract, the work shifts from drafting to keeping track: which renewals are coming, which data terms differ by customer, where the liability caps sit, and which version is the signed one. That is the same work across every contract type, and it is why teams increasingly keep drafting, review, version history and renewal tracking in one connected workspace rather than scattered folders and spreadsheets. Adira is an AI contract workspace built for exactly that, with per-clause risk review, plain-English editing and a live activity timeline. Adira is India-first today, and deeper non-India jurisdiction support, including Indonesia, is on its roadmap, so treat local-law specifics as something to confirm with local counsel. This article is general information and not legal advice.