Digital Sovereignty Starts with Infrastructure: It's Time for Indonesian Companies to Take Control of Their Cloud

A nation's independence, today, is no longer only a matter of borders on a map. There is a new dimension that matters just as much: who controls the digital infrastructure the economy actually runs on.

For companies operating in Indonesia, this is not an abstract question. Most of the systems powering banking and everyday business run on cloud infrastructure owned by someone else, and most of that someone else is headquartered abroad.

A Dependency Rarely Discussed Openly

Public cloud is now the dominant deployment model in Indonesia, accounting for 66% of the total cloud market in 2025, and the segment is dominated by a handful of global players: Amazon Web Services, Microsoft Azure, Google Cloud, and Alibaba Cloud. The scale of their investment is significant. Microsoft alone has committed USD 1.7 billion to cloud and AI expansion in Indonesia.

None of this is bad in itself. World-class infrastructure arriving faster than it could be built domestically clearly has value. But it creates a pattern: companies in Indonesia, from finance to manufacturing and retail, run their core operations on platforms whose important decisions about pricing, access, and service availability are made by someone else, entirely outside those companies' own control.

Risks That Are No Longer Hypothetical

There is a belief that losing access to foreign infrastructure remains a hypothetical scenario. Recent evidence suggests otherwise.

In January 2026, the United States House of Representatives passed the Remote Access Security Act by a vote of 369-22, extending export controls for the first time to cloud computing access rather than only the export of physical goods. The bill is currently awaiting consideration in the Senate.

What makes this directly relevant to companies in Indonesia: one of the cases that motivated the bill involved leasing thousands of GPUs through a data center in Indonesia, as a loophole for accessing export-restricted AI chips. Indonesian infrastructure, in other words, has already been part of this dynamic, not merely a distant observer.

A more forceful precedent also exists. In 2024, United States sanctions on Russia restricted the provision of cloud services and IT support for enterprise software categories such as ERP and CRM, including blocking updates and patches for software already installed. Indonesia's position is clearly different from Russia's; this is not about geopolitical sanctions aimed at Indonesia directly. But the precedent proves one important thing: the mechanisms for restricting cross-border access to digital infrastructure are real, have been used before, and their scope is being expanded by regulators entirely outside their users' control.

Moving Control into Your Hands

Answering this risk does not mean your company must reject foreign technology altogether. That is neither realistic nor necessary. Nor is the real question rent versus build; renting is a healthy model, and the local cloud industry is growing on top of it. The real question is where control sits: with a party you can reach, or with a headquarters on another continent.

There are two roads to that control, and both are legitimate. The first: rent from a local cloud provider. Your contract answers to Indonesian law, your data stays within Indonesian jurisdiction, and the team operating it can sit across the table from you. For most companies, this is the fastest route to sovereignty without carrying the operational burden. The second: operate your own platform for the most critical workloads, with full control down to the infrastructure level. The two are not mutually exclusive; many companies run both side by side. And whichever road you take, one condition is non-negotiable: platforms that are open and portable, with non-proprietary standards and easily movable data, so that dependence on any single vendor, local or foreign, never becomes an unavoidable risk.

Progress Already Underway

Indonesia is not starting from zero. As of May 2026, the National Data Center (Pusat Data Nasional) is operational with 25,000 processor cores, 200 terabytes of memory, and up to 40 petabytes of storage. The government is targeting two additional PDN facilities in Batam and the new capital, IKN.

Broader growth is also visible at the industry level. As of July 2026, Indonesia recorded 200 active data centers, the highest count in Southeast Asia, surpassing Malaysia (116) and Singapore (68). Domestic Component Level (TKDN) regulations for IT infrastructure continue to advance, encouraging a preference for solutions developed and operated locally.

Not the Job of One Party

National digital sovereignty is not decided by regulation alone. It is decided in company boardrooms, one architecture decision at a time.

This is where the two interests meet. When your company runs its production workloads on infrastructure operated in-country, whether through a local cloud provider or on a platform you operate yourself, what you are buying is control: over costs, over access, over the fate of your own data. But the same decision quietly does something larger. It seasons local engineers, proves local providers, and completes the local ecosystem. One company's independence, summed across industries, becomes national digital sovereignty. The order matters: national sovereignty is the consequence, not the reason you make this call.

The most concrete step is therefore not a slogan but an assessment you can schedule this week: map which workloads are genuinely critical, measure how deep each vendor dependency runs, then trial one workload with a local cloud provider or on an open platform you operate yourself. Your company takes back control today. And a nation's independence, it turns out, is also guarded from the server room.

---

A fuller discussion of this topic, complete with data and an interactive visual risk analysis, is available in the interactive Digital Sovereignty in Infrastructure presentation.

Sources

• Mordor Intelligence & GII Research, Indonesia Cloud Market Report (2026)
• GMI Research, Indonesia Cloud Computing Market Share Report (2025)
• U.S. House of Representatives, passage of the Remote Access Security Act (H.R. 2683), January 2026
• Ministry of Communication and Digital Affairs of the Republic of Indonesia, Indonesia Digital Leap National Forum (May 2026)
• Data Center Map, as cited by suar.id (July 2026)
• U.S. Department of the Treasury & Department of Commerce, sanctions on Russia (September 2024)