The Crosswalk
    NewPer-page social previews and this changelog

    Kemenkes

    Flag of IndonesiaIndonesia - Kemenkes

    GuidanceLast updated · 2024Verified · 2026-07-16

    Permenkes No. 62/2017 + Kemenkes digital-health regulations

    Share

    Authority

    Ministry of Health (Kemenkes); BPOM for combination products

    Enforced

    2017

    Legal framework

    Permenkes 62/2017 + UU PDP (Personal Data Protection Law 2022) + BSSN guidance

    FDA package reuse

    ~65%

    Scope

    All medical devices distributed in Indonesia, including SaMD. Risk-class based registration.

    Pre-market

    Risk-class registration dossier, halal certification where applicable, e-Watch reporting commitments.

    Post-market

    e-Watch adverse event reporting, distribution audits.

    SBOM

    Recommended

    Encouraged in line with IMDRF N60; mandate expected as digital-health rules mature.

    Vulnerability disclosure

    BSSN (National Cyber and Crypto Agency) coordinated disclosure recommended.

    Penalty

    Registration revocation; UU PDP fines up to 2% of annual revenue.

    Unique requirements

    • 01Indonesian Distributor Holder (IPAK)
    • 02Bahasa Indonesia labelling
    • 03Halal certification for relevant categories

    Highlights

    • UU PDP closely modelled on GDPR
    • BSSN cybersecurity overlay for hospitals
    • Largest ASEAN device market by population

    Aligns with

    ASEAN MDD IMDRF N60 ISO 13485

    Timeline

    1. 2017

      Permenkes 62/2017 issued

    2. Oct 2022

      UU PDP enacted

    3. Oct 2024

      UU PDP full enforcement

    Key documents

    How to submit in Indonesia

    Playbook reviewed · 2026-07-16

    Submission route

    Ministry of Health (Kemenkes) registration via Regalkes portal

    Indonesia requires a local licence holder (IPAK holder). Cybersecurity documentation, when submitted, is reviewed as part of the technical file.

    Authority portal

    Step-by-step

    1. Step 01

      Appoint local representation

      Most jurisdictions require a locally-established entity to hold the registration or act as authorised representative before submission.

    2. Step 02

      Reuse FDA or CE package as baseline

      Adapt the cybersecurity subsection you already prepared for FDA or CE; regulators here typically accept the structure and ask for local labeling additions.

    3. Step 03

      Translate and localise

      Local-language technical summary and labeling are usually mandatory; certified translation is safest.

    4. Step 04

      Submit + track queries

      Respond to clarification rounds promptly; each unanswered question can add 30-90 days to the clock.

    Evidence checklist

    Item Level FDA equivalent Notes
    Cybersecurity documentation (baseline FDA or CE) Required SPDF
    Local authorised representative agreement Required —
    Local-language labeling and IFU Required —
    SBOM Recommended — Not mandatory but reduces clarification rounds.

    Common Kemenkes rejections

    IPAK-holder appointment missing

    Common

    Fix · Appoint an IPAK-licensed distributor before submission.

    Typical timeline

    End-to-end window: 4-10 months

    Phase 01

    Local rep + dossier prep

    2-4 months

    Phase 02

    Regulatory review

    4-10 months

    Phase 03

    Approval + market entry

    1-3 months

    Related markets

    Frequently asked about Indonesia

    Is SBOM required for medical devices in Indonesia?

    Recommended. Encouraged in line with IMDRF N60; mandate expected as digital-health rules mature.

    What does Kemenkes require for pre-market cybersecurity?

    Risk-class registration dossier, halal certification where applicable, e-Watch reporting commitments.

    What are the post-market cybersecurity obligations under Kemenkes?

    e-Watch adverse event reporting, distribution audits.

    What is the penalty for non-compliance with Kemenkes cybersecurity rules?

    Registration revocation; UU PDP fines up to 2% of annual revenue.

    How much of my FDA cybersecurity package is reusable in Indonesia?

    Roughly 65% - an editorial estimate based on overlapping evidence requirements (threat model, SBOM, security risk assessment, pen-test report).