Other Issues: Sovereign Boundaries, Energy Treaties, Investment Protection, and Cybersecurity in Indonesian Energy

Originally published in Lexology Panoramic: Energy Disputes 2026.

By Setyawati Fitrianggraeni, S.H., LL.M., FCIArb., FAIADR, Reynalda Basya Ilyas, Aga Kristiana Silaen, Marcel Raharja, and Irvena A Dewanto

In brief

Beyond contracts and regulation, energy investors in Indonesia face a further set of issues: unresolved maritime boundaries that can affect exploration, a treaty position that excludes the Energy Charter Treaty but includes the Kyoto Protocol, statutory protections against expropriation, and cybersecurity obligations for electronic systems. This part explains each of these issues and what they mean in practice.

Sovereign boundary disputes

Currently, there is no sovereign boundary dispute involving Indonesia that is brought before any adjudicative body. However, this year, the Minister of Home Affairs and the Head of the National Border Management Agency revealed that Indonesia is in separate discussions with Malaysia, China, Vietnam, and East Timor regarding several border issues. The dissent on the border with China and Vietnam in the South China Sea may affect the energy sector the most, as it concerns the overlapping of an Exclusive Economic Zone. According to the US Energy Information Administration, the South China Sea holds about 190 trillion cubic feet of natural gas and approximately 11 billion barrels of oil. Any development or decision on this issue will be monumental, especially for exploration activities and the establishment of drilling rigs.

Energy treaties

Indonesia is not a party to the Energy Charter Treaty (ECT). On 18 June 2009, Indonesia signed the 1991 European Energy Charter, a set of non-binding declarations of principles related to, but separate from, the 1994 Energy Charter Treaty. Although this act represented the first steps towards ratification of the ECT, Indonesia never took further steps towards ratification of the treaty, and thus is not a party to the ECT itself.

Aside from that, Indonesia has been a party to the 1997 Kyoto Protocol to the UNFCCC since 2004. As such, the country has been an active participant in the Clean Development Mechanism initiative provided for in the Protocol, which includes, among others, carbon trade.

Investment protection

The general principle for protection of domestic and foreign investors is regulated in Law No. 25 of 2007 concerning Investment (the Investment Law), as amended by Government Regulation in Lieu of Law No. 2 of 2022. Through the Investment Law, the state provides the following protection to investors:

the state guarantees equal treatment to all foreign investors from any states, save for the privileges obtained through investment treaties;
the state shall not nationalise or expropriate an investment if not mandated by law. If nationalisation or expropriation is mandatory, compensation shall be pursuant to the market price. In the case of any dispute on compensation, the state and investor shall pursue arbitration;
investors can transfer assets to any desired parties and repatriate funds in foreign currency in accordance with statutory provisions; and
the state guarantees certainty of rights, law and protection, open information regarding the business sector it carries out, rights of public service, and facilities in accordance with the provisions of statutory regulations.

Cybersecurity

Government Regulation No. 71 of 2019 on the Organisation of Electronic Systems and Transactions (GR 71/2019) regulates the management of electronic systems. Electronic systems are defined as a series of electronic devices and procedures that function to prepare, collect, process, analyse, store, display, announce, transmit, and disseminate electronic information. GR 71/2019 provides that electronic systems shall fulfil the following requirements:

they can re-display electronic information and electronic documents in their entirety in accordance with the retention period determined by statutory regulations;
they can protect the availability, integrity, authenticity, confidentiality, and accessibility of electronic information while operating the electronic system;
they can operate in accordance with the procedures or instructions for administering the electronic system;
they are equipped with procedures or instructions announced in language, information, or symbols that can be understood by the parties concerned with the implementation of the electronic system; and
they have an ongoing mechanism to maintain the freshness, clarity, and accountability of procedures or instructions.

GR 71/2019 also regulates IT governance of an electronic system, which includes:

electronic system operators must guarantee the availability of service level agreements, information security agreements for the IT services used, and security of information and internal communication facilities held;
electronic system operators must implement risk management regarding any damage or losses incurred;
electronic system operators must have governance policies, operational work procedures, and audit mechanisms that are carried out periodically on electronic systems; and
in the event that electronic systems and electronic data are managed, processed, or stored outside the territory of Indonesia, private (including foreign companies and individuals) electronic system operators must ensure the effectiveness of supervision by ministries or institutions and law enforcement, and must provide access to electronic systems and electronic data in the context of supervision and law enforcement in accordance with statutory provisions.

GR 71/2019 also mandates that electronic systems owned by the private sector (including foreign companies and individuals) are registered if they are in the form of internet-based portals, sites, or applications organised with the following functions:

provision, management, and operation of offering and trading of goods and services;
financial transaction services;
communications services (including, but not limited to, short text messages, voice calls, video calls, emails, digital chatrooms, networking services, and social media);
delivery of materials or paid digital content through data networks, by way of downloading via websites, sending of emails, or via applications to customers’ devices;
search engine and electronic information provider services (in the form of text, audiovisual data, animations, music, video, films, and games, or any combination of these); and
processing of personal data in relation to the organisation of public services that address electronic transaction activities.

For advice on investment protection, treaties, or cybersecurity in Indonesian energy, contact Anggraeni and Partners at connect@ap-lawsolution.net.