It is one signal among several. The Indonesia Investment Authority, the country’s USD 10 billion sovereign wealth fund, is a lead investor. Alongside Singapore’s Granite Asia, it has committed more than USD 1.2 billion to Indonesia’s data centre and AI ecosystem.

CoreWeave has chosen Indonesia for its first Asia-Pacific data-centre presence: three facilities totalling 360 megawatts, targeting operations by 2028. Scale alone does not make a hub.

The Constraint Isn’t Capital

The capital is arriving faster than the workforce to use it. Consultancy Kearney estimates Indonesia’s digital talent demand at around 600,000 professionals a year. Komdigi’s own AI Talent Factory programme, launched in 2025, has not disclosed how many participants it has trained, or how many have found jobs.

The government is not treating this as a real-estate story. Indonesia Investment Authority’s Chief Investment Officer, Christopher Ganis, has named sub-sea cables and supporting infrastructure alongside data centres as priorities. Officials tie that explicitly to data independence and resilience.

Zankore’s own economics illustrate the scale required. Industry estimates put end-to-end AI infrastructure investment at around USD 50 million per megawatt. That would put the Batang project’s ultimate cost in the tens of billions of dollars.

That is the case for optimism. It is also the case for caution. Connectivity, power, talent, capital and regulation all have to move together for infrastructure to become genuine regional advantage rather than a collection of announcements.

This main analysis on Indonesia’s cybersecurity governance gap, “The Governance Behind Indonesia’s Digital Opportunity,” makes the same point from the risk side. The institutions meant to govern this investment are still catching up to it.

The infrastructure case and the governance case are not separate stories. They are the same story, told from opposite ends.

What Indonesia Has That Its Neighbours Don’t

None of this guarantees Indonesia converts scale into regional leadership. Vietnam, Malaysia and Singapore are each building their own version of the same pitch, with their own power grids, talent pipelines and regulatory offers.

What Indonesia has that its neighbours cannot easily match is domestic demand. Its market is large enough that infrastructure built for its own digital economy can also serve the region. Sahabat-AI, the open-source Indonesian-language model set to run on Zankore’s capacity, is a bet on exactly that domestic base.

The right question for investors is not whether Indonesia is building. It plainly is, at a pace few ASEAN peers can match. It is whether the harder inputs, trained people, reliable power, coordinated regulation, arrive on the same timeline as the capital. Indonesia has answered the capital question.

The rest of the answer is still being written.

The post Indonesia Is Laying the Foundations for an AI Hub appeared first on Bizruption Asia.

Indonesia signed Government Regulation No. 33 of 2026 on 16 July 2026 – the long-awaited implementing rule for the country’s 2022 Personal Data Protection Law. It circulated publicly only in late August. The regulation fills in detail on cross-border data transfers, breach notification and impact assessments that businesses had navigated without since the law took effect in October 2024.

It does not complete the picture. Article 58 of the 2022 law calls for a dedicated authority to oversee personal data protection. As of September 2026, that authority has yet to be formally established.

Deputy Minister of Communication and Digital Affairs Nezar Patria said in July, at a US-ASEAN Business Council dinner in Jakarta, that the agency will “operate independently across all its structures.” The presidential regulation establishing it is still being finalised.

The Capital Is Already Moving

The investment cycle is not waiting. Indonesia currently has around 580 megawatts of operational data-centre capacity. Coordinating Minister for Economic Affairs Airlangga Hartarto said, as reported by the Jakarta Post on 12 July 2026, that investors had expressed interest in another 1.3 gigawatts. That represents an estimated USD 15–20 billion in additional investment.

Some of that is already committed. Firmus Technologies, working with Nvidia, is developing a 360-megawatt AI Factory campus in Batam designed for up to 170,000 Nvidia accelerators. Offtake agreements, Firmus says, could generate USD 25–30 billion over six years. EDGNEX has separately committed USD 2.3 billion to a 144-megawatt facility in Cikarang.

Where Digital Growth Meets Governance

 

Two cybersecurity leaders from Indonesia interviewed for this piece describe the same commercial dynamic playing out across Indonesian enterprises. Ardi Sutedja K., chairman of the Indonesia Cyber Security Forum, frames it as a question of pace at the enterprise level.

“In my experience, one of the most significant gaps lies in the speed at which organisations are investing in AI and cloud technologies versus the pace at which their security governance is maturing. Many Indonesian enterprises are quick to adopt new technologies, driven by the promise of increased efficiency and competitive advantage.

“However, the same urgency is not always applied to developing robust security frameworks. This often results in a reactive rather than proactive approach to cyber security, where measures are only put in place after a breach has occurred,” he explained.

Sugiarto RM, founder of the Indonesia CXO Network, sees it playing out across the wider economy.

“Indonesia already has a growing regulatory framework around personal data, critical information infrastructure and financial-sector cyber resilience, while enterprises are simultaneously increasing spending on cloud, AI and digital infrastructure. The challenge is making sure those two curves converge.”

The National Cyber Security Index provides another indication of the governance challenge. Indonesia scores 47.50, receiving full credit for having personal data protection legislation while scoring zero on the indicator for an empowered personal-data protection authority.

The result highlights the distinction between having a regulatory framework on paper and having the institutional capacity to enforce it.

Banks Already Know What Governance Looks Like

The clearest contrast is financial services. Indonesian banks sit inside a supervisory framework where technology governance and cyber maturity are binding requirements, not aspirations.

OJK Regulation 11/2022 established IT-governance rules for commercial banks. SEOJK 29/2022 added annual cyber-maturity assessments. POJK 1/2026, effective since 1 March 2026, tightened information-technology and third-party risk requirements further.

Philip Lee, head of Orange Cyberdefense APAC, told Bizruption.asia that this is the point at which cybersecurity stops being an IT problem and becomes a board one.

“This shift is increasingly driven by the evolving threat landscape, regulatory compliance and growing pressure from shareholders and local governments. With increased regulatory requirements around data protection, critical infrastructure, incident reporting, and cybersecurity governance, boards have become more engaged with the organisation’s operational environments.

“A major cyber incident or compliance failure can directly affect revenue, business continuity, reputation, customer trust and legal exposure. Translating technical risks into business outcomes helps boards understand their risk appetite and accountability. As cybersecurity becomes integrated into enterprise risk management, it is increasingly recognised as a strategic business resilience issue rather than simply an IT expense,” he said.

Banking has a mechanism for making that translation visible. The question for the rest of Indonesia’s digital economy is how the same discipline can develop as the data centres, cloud platforms and AI ventures now absorbing its investment wave continue to scale.”

What Actually Closes the Gap

Ardi frames the work ahead as cultural before it is technical.

“There must be a cultural shift within organisations where cyber security is viewed as a shared responsibility. This involves continuous education and awareness programs to ensure that every employee understands their role in protecting the organisation’s digital assets.”

Sugiarto describes the practical work still outstanding.

“The corresponding governance layer, who owns the risk, how data is classified, what can be put into an AI model, how third-party and cloud risks are assessed, how identities and access are controlled, and how quickly an organisation can recover from a compromise, is often still catching up.”

The measure that matters, Sugiarto added, is not the size of the security budget. It is whether the board understands the cyber risk it is buying, accepting or transferring. Asked what would close the gap, he ranks the constraints directly.

“Regulation is the catalyst, budget is the enabler, talent is the constraint, but governance and accountability are what will actually close the gap.”

That ranking matters for how capital gets allocated. A regulation can set the obligation and a budget can fund the response, but neither guarantees that someone at the top of the organisation is accountable when the controls fail. That accountability is what boards and investors are now being asked to underwrite.

The USD 15–20 billion now moving into Indonesian data centres is part of a much broader digital transformation. As the country’s infrastructure, AI adoption and digital economy continue to expand, the evolution of governance and accountability will become increasingly important to the companies, boards and investors participating in that growth.

For investors, understanding how governance develops alongside that opportunity will be an increasingly important part of the decision-making process.

References:

• Indonesia tumbles in cybersecurity ranking – The Jakarta Post
• Indonesia to set up independent personal data protection agency – ANTARA News
• National Cyber Security Index: Indonesia – e-Governance Academy, version dated 31 December 2025
• Law No. 27 of 2022 on Personal Data Protection, Republic of Indonesia (Article 58)
• Indonesia’s Financial Services Authority Strengthens the Digital Backbone of Banking Sector through Regulation No. 1 of 2026 – SSEK Law Firm
• OJK Enhances Governance and Risk Management for Sustainable Economic Growth – Financial Services Authority (OJK)
• Data Protection & Privacy 2026: Indonesia – Chambers and Partners
• Data Protection Laws of the World: Indonesia – DLA Piper
• IBM Study: ASEAN Data Breach Costs Rise to US$4.12 Million – IBM Newsroom ASEAN, 2026
• Govt eyes Nvidia investment to increase data center capacity – The Jakarta Post
• Indonesia secures US$2.3b Dubai investment for major data centre – Malay Mail

View More

The post The Governance Behind Indonesia’s Digital Opportunity appeared first on Bizruption Asia.

On 13 August 2026, Temasek-backed ST Telemedia Global Data Centres secured a green financing facility of up to USD 1.37 billion for Phase 1 of its STT Johor campus. UOB Malaysia coordinated the deal, with OCBC Malaysia, Standard Chartered Bank Malaysia and CIMB Bank participating.

The transaction was not an isolated capital-markets event. AirTrunk secured USD 2.325 billion in green financing in July for its JHB2 hyperscale campus in Johor Bahru. DayOne Data Centres had already closed a RM15 billion equivalent multicurrency facility in June 2025, comprising a RM7.5 billion Islamic financing tranche and a USD 1.7 billion offshore term loan.

IFR reported in June 2026 that DayOne was seeking roughly USD 3.7 billion of additional financing. IFR also expected Malaysian data-centre financing to exceed USD 8 billion in 2026. Both figures describe a market estimate or financing activity at different stages, not necessarily debt already drawn.

The headline numbers show demand for Malaysian digital infrastructure. They do not show whether the projects will produce durable returns. That distinction matters because the market is moving from construction finance into a more demanding question: how much of the asset’s value sits in the building, and how much sits in a tenant’s willingness to keep paying for it?

The debt is arriving before the proof

IFR reported loan-to-cost ratios above 90% for some Malaysian data-centre financings. That structure can work when a project has a strong tenant, firm power arrangements, construction protections and debt amortisation aligned with contracted cash flow. It leaves less room for error when any of those assumptions weaken.

The risk is not simply that a tenant defaults. A project can remain technically sound and still disappoint lenders if energisation is delayed, power costs rise, a tenant takes less capacity or refinancing arrives before the debt has amortised sufficiently.

That is why the phrase “useful life” needs care. GPUs and other compute equipment may become uneconomic quickly. Land, substations, buildings, fibre connectivity and cooling infrastructure can retain value for decades. A lender must therefore separate technology-replacement risk from the residual value of the physical site.

IFR reported that some developers, including AirTrunk, had secured more flexible covenant and change-of-control provisions, with certain guarantees removed or reduced. The direction matters, but the conclusion cannot be that lenders have abandoned protection.

The real question is what remains after completion: parent support, debt-service reserves, minimum-payment commitments, security over the asset or a credible route to re-lease it.

The financing question also connects to the wider infrastructure constraint examined in the companion analysis, “The Grid Cannot Keep Up”. That article is aimed at investors and infrastructure executives assessing whether Malaysia’s power and water systems can support the capacity being financed.

The lease is the underwriting hinge

None of this leverage works without contracted demand or a credible path to contracted demand. Hyperscaler-backed structures may include multi-year leases and extension options, but the terms differ by tenant, project and financing. Renewal rights, termination payments, parent support, residual-value guarantees and reserve accounts determine how much risk remains with the lender.

“We haven’t seen a cycle of renewal of leases,” a buyside banker told IFR in June 2026. The comment is not evidence that renewals will fail. It identifies the market’s information gap: there is limited observable evidence on how large, specialised data-centre leases will reprice or renew at scale.

The distinction is important. A renewal option may belong to the tenant, but that does not mean the tenant can walk away without consequence. The lease may include minimum payments or termination obligations. The financing may include reserves or residual-value support.

Equally, the lender may still face months of downtime and a costly retrofit before a replacement tenant can move in.

A specialised data centre is therefore not valued as a conventional building. Debt service depends on the lease, the tenant’s credit quality, power availability, connectivity and operating readiness. It also depends on whether another tenant can use the facility without expensive changes.

Johor is where risks can correlate

Johor has become the centre of Malaysia’s data-centre expansion. Cushman & Wakefield reported 897MW of operational capacity in the state at the end of 2025, with further capacity under construction and in the planned pipeline. Planned capacity is not the same as operational capacity, secured power, contracted demand or financial close.

The concentration creates an infrastructure question as well as a credit question. Reuters reported that Johor was facing greater scrutiny over electricity and water use, while Malaysian guidance sets expectations for data-centre water efficiency. Johor’s approval process also requires projects to demonstrate that utilities and location are suitable.

That scrutiny should not be read only as a threat. Tighter approvals can protect the value of existing projects by limiting speculative capacity that cannot secure reliable utilities. For lenders, however, the test is whether power and water commitments are firm, timed to commissioning and reflected in the project documents.

A renewal problem affecting several large facilities could create correlated stress within Johor if tenant concentration coincided with power, water or connection constraints. This is a stress scenario, not a forecast. It is also why national capacity figures can conceal local concentration risk.

The bullish case is not trivial

The bearish interpretation is incomplete. Hyperscaler counterparties are generally stronger than ordinary commercial tenants, and moving a live workload can involve technical, operational and contractual costs. Lenders may also rely on minimum-payment commitments, parent support, completion protections, amortisation schedules and residual-value arrangements.

The base case for many transactions may therefore be continued tenant performance. But a base case is not a guarantee. Credit committees still need to test weaker renewal pricing, lower utilisation, delayed energisation, technology substitution and refinancing at wider spreads.

The United States offers a useful comparison, but not a direct template. Oracle-linked Vantage financings have been cited as examples of very high leverage in hyperscaler-backed data-centre structures. The reported USD 37.5 billion aggregate financing and 93% to 98% loan-to-cost figures should be retained only if confirmed through the original IFR or Bloomberg reporting, a rating-agency publication or transaction documents.

Malaysian projects differ in tenant contracts, sponsor support, power arrangements, legal structure, lender protections and market depth. The US comparison can illustrate the mechanism without proving that Malaysia has reached the same level of risk.

The test is not one event

The market will not be judged by a single lease renewal. It will be judged by the interaction of lease terms, debt amortisation, power availability and technology reinvestment across several projects.

The indicators worth watching are the first major renewals, the rent and covenant terms attached to them, the debt remaining at renewal, refinancing spreads, power-connection milestones and the time required to re-lease specialised capacity.

For lenders and investors, the next diligence question is simple: if the tenant does not renew on the original terms, what exactly pays the debt? The answer should be visible in the financing documents before the project reaches financial close.

The post Malaysia’s Data-Centre Boom Is Becoming a Credit Bet on Lease Renewal appeared first on Bizruption Asia.