The Crosswalk

    Kemenkes

    Flag of IndonesiaIndonesia — Kemenkes

    GuidanceLast updated · 2024Verified · 2026-05-28

    Permenkes No. 62/2017 + Kemenkes digital-health regulations

    Authority

    Ministry of Health (Kemenkes); BPOM for combination products

    Enforced

    2017

    Legal framework

    Permenkes 62/2017 + UU PDP (Personal Data Protection Law 2022) + BSSN guidance

    FDA package reuse

    ~65%

    Scope

    All medical devices distributed in Indonesia, including SaMD. Risk-class based registration.

    Pre-market

    Risk-class registration dossier, halal certification where applicable, e-Watch reporting commitments.

    Post-market

    e-Watch adverse event reporting, distribution audits.

    SBOM

    Recommended

    Encouraged in line with IMDRF N60; mandate expected as digital-health rules mature.

    Vulnerability disclosure

    BSSN (National Cyber and Crypto Agency) coordinated disclosure recommended.

    Penalty

    Registration revocation; UU PDP fines up to 2% of annual revenue.

    Unique requirements

    • 01Indonesian Distributor Holder (IPAK)
    • 02Bahasa Indonesia labelling
    • 03Halal certification for relevant categories

    Highlights

    • UU PDP closely modelled on GDPR
    • BSSN cybersecurity overlay for hospitals
    • Largest ASEAN device market by population

    Aligns with

    ASEAN MDD IMDRF N60 ISO 13485

    Timeline

    1. 2017

      Permenkes 62/2017 issued

    2. Oct 2022

      UU PDP enacted

    3. Oct 2024

      UU PDP full enforcement

    Key documents

    Related markets

    Frequently asked about Indonesia

    Is SBOM required for medical devices in Indonesia?

    Recommended. Encouraged in line with IMDRF N60; mandate expected as digital-health rules mature.

    What does Kemenkes require for pre-market cybersecurity?

    Risk-class registration dossier, halal certification where applicable, e-Watch reporting commitments.

    What are the post-market cybersecurity obligations under Kemenkes?

    e-Watch adverse event reporting, distribution audits.

    What is the penalty for non-compliance with Kemenkes cybersecurity rules?

    Registration revocation; UU PDP fines up to 2% of annual revenue.

    How much of my FDA cybersecurity package is reusable in Indonesia?

    Roughly 65% — an editorial estimate based on overlapping evidence requirements (threat model, SBOM, security risk assessment, pen-test report).