How to Answer Data Residency Questions in an AI Project RFP

A data residency question in an AI project RFP is answered with three things: a location map for every component, written evidence for every claim, and a clear line between what the systems integrator (SI) owns and what the infrastructure provider owns. An answer that only says "data is stored in Indonesia" usually fails at the clarification stage, because risk teams at banks and state-owned enterprises (SOEs) now ask about inference, logs, and sub-processors, not just storage.

Why are data residency questions in AI RFPs getting more detailed?

Data residency questions are getting more detailed for two reasons. First, the rules are more specific: banks are bound by POJK 11/POJK.03/2022, public institutions by Government Regulation (PP) 71/2019, and PP 33/2026 requires an assessment before personal data is transferred abroad. Second, a single AI pipeline has many components, and each one can run in a different location.

As of October 2026, these are the regulations evaluators cite most often:

Regulation	Applies to	What the RFP asks
POJK 11/POJK.03/2022	Commercial banks	Electronic systems must sit in data centers and disaster recovery centers in Indonesia. Placement abroad is allowed only for specific criteria and needs prior OJK approval.
PP 71/2019	Public-scope electronic system operators (PSE)	Management, processing, and storage within Indonesian territory, unless the technology is unavailable domestically.
Law No. 27/2022 (PDP Law)	All personal data controllers and processors	Legal basis for processing, transfers abroad (Article 56), and notification of a personal data protection failure within 3 x 24 hours (Article 46).
PP 33/2026	All personal data controllers and processors, effective 16 January 2027	Processor agreements (Article 14), written approval for sub-processors (Article 15 paragraph 2), and an assessment before transfers abroad.
Indonesian Banking AI Governance guideline (OJK, April 2025)	Banks that use AI	Governance, risk management, and third-party oversight in AI projects.

PP 33/2026 was promulgated on 16 July 2026 and takes effect six months later. RFPs issued now should already be answered against its provisions, since many of these projects go live after that date. The full breakdown is in what PP 33/2026 means for AI projects.

What questions usually appear in the data residency section?

The data residency section of an AI RFP typically holds five to seven questions. The wording varies, but what evaluators check is almost always the same: where each component runs, whether any data leaves the country, who else takes part in processing, and what evidence can be verified. The table below maps each question to what is really being checked and the attachment that answers it.

RFP question	What the evaluator is really checking	Attachment that answers it
Where is data processed and stored?	The location of every component, not just the database	Data flow diagram with a location for each component
Does any data leave Indonesia?	Foreign model API calls, tracing, monitoring, support tools	Written statement and a list of external endpoints
Who are the sub-processors?	The parties involved in processing and the controller's written approval	Sub-processor list with roles and locations
What security certifications are held?	Number, issuer, scope, validity	Certificate copy and its scope
Where are backup and disaster recovery?	The location of data copies, not only primary data	Backup and DR location statement from the provider
Who can access data, and from where?	Admin access, remote support, vendor access	Access matrix and audit trail
How are incidents handled?	A notification path that meets the 3 x 24 hour limit	Escalation path with named contacts

The questions that most often stall bank projects are also covered in the 3 bank client questions that stall AI projects.

What does an answer that passes evaluation look like?

An answer that passes evaluation has four parts: statement, scope, evidence, and boundary. The statement answers the question directly. The scope names which components are covered. The evidence points to attachments that can be verified. The boundary states what remains the client's responsibility. Evaluators trust an answer that is honest about its boundary more than one that sounds absolute.

An example answer to "Where is data processed and stored?":

1. Statement. All processing components of the solution run on infrastructure located in Jakarta, Indonesia.
2. Scope. Covers OCR, embedding, LLM inference, vector database, application logs, and backup. No calls are made to model APIs outside Indonesia.
3. Evidence. Appendix C (data flow diagram per component), Appendix D (the infrastructure provider's ISO/IEC 27001:2022 certificate and its scope), Appendix E (sub-processor list).
4. Boundary. The legal basis for processing, data subject consent, and the DPIA remain the responsibility of the Bank as personal data controller. The SI prepares the technical inputs.

Avoid phrases like "100% compliant with the PDP Law" or "data is guaranteed never to leave". Compliance is a shared responsibility, and absolute claims tend to invite follow-up questions from the legal team.

Which components are most often forgotten?

The components most often forgotten are the ones missing from the main architecture diagram: tracing and monitoring services, fallbacks to foreign model APIs, embedding APIs, ticketing tools that store screenshots or data snippets, and copies of data in staging. A single component outside Indonesia is enough to make a data residency statement inaccurate.

A checklist before signing an RFP answer:

1. Map every pipeline component, including those used only for debugging.
2. Check observability and error tracking services: where logs are stored, and whether prompts or outputs are sent along with them.
3. Confirm there is no automatic fallback to a model API outside Indonesia when the primary model is busy.
4. Check where embeddings and the vector database run, not just the LLM.
5. Ask the infrastructure provider in writing where backup and disaster recovery are located.
6. Confirm that sample data for staging and testing stays in the same environment.
7. List every party that touches data as a sub-processor, with its location and role.

For RAG pipelines, the pattern is covered in more detail in RAG architecture where data stays in Indonesia.

Who answers which part: the SI or the infrastructure provider?

The SI writes and signs the RFP answer because the SI owns the solution and the client relationship. The infrastructure provider supplies evidence for the layer underneath: compute location, certifications, and security controls. Problems start when an SI writes infrastructure claims without documents from the provider, or when the provider is asked to answer something that actually sits in the application layer.

Part of the answer	SI	Infrastructure provider
End-to-end data flow diagram	Builds it	Confirms infrastructure component locations
Compute, inference, and storage location	References it	Provides the statement and evidence
Security certifications	Attaches them	Supplies the copy and scope
Sub-processor list	Compiles the full project list	Names the parties at the infrastructure layer
Legal basis, data subject consent, DPIA	Prepares technical inputs	Not handled
Incident escalation path	Acts as first-line support	Acts as infrastructure-layer escalation

The full role split is in how roles divide between systems integrators and AI infrastructure providers.

Where IONext fits

IONext acts as the infrastructure provider underneath the SI, not as a competitor to the SI on client projects. As of October 2026, IONext's GPU compute, inference, and customer data storage are located in Jakarta. Open-weight models run on IONext's own hardware, so inference requests are not forwarded to API providers abroad. Details are on the IONext Security and Compliance page.

What an SI can attach from IONext for the data residency section:

• An ISO/IEC 27001:2022 certificate from TÜV NORD Indonesia, number 01 07 E 26000410, valid 7 May 2026 to 6 May 2029, issued to PT Data Awan Nusantara.
• A certification scope covering AI platform services and AI-based cloud resources: GPU, storage, and network.
• The specifications of the GPUs available on IONext: NVIDIA RTX PRO 6000 Blackwell SE 96GB and NVIDIA L40S 48GB.
• Audit trail and public or private resource status through ORBIT, plus flagging of exposed resources by IONA, as input for the access matrix.
• Rupiah invoicing through an Indonesian legal entity, with VAT as required.

The limits are also clear. IONext does not write the client's DPIA, does not determine the legal basis for processing, does not handle OJK approvals, and cannot guarantee the location of components the SI runs outside IONext. Company documents for procurement can be requested through the IONext contact page.

SIs preparing an RFP for a bank, SOE, or government client can start a partnership conversation through the IONext Partner Program. To try ORBIT and IONA first, sign up in the IONext console.

Frequently asked questions

Is it enough to write "data is stored in Indonesia" in an RFP answer? No. Evaluators now ask about the location of inference, logs, backup, and sub-processors. The answer should itemize the components covered and point to attachments that can be verified, such as a data flow diagram and the provider's certificate.

Is using a foreign model API automatically prohibited? Not automatically. The PDP Law and PP 33/2026 regulate transfers abroad with conditions and a risk assessment. For banks, however, POJK 11/POJK.03/2022 requires OJK approval for processing outside Indonesia. In an RFP this route has to be disclosed, not hidden.

When does PP 33/2026 take effect? PP 33/2026 was promulgated on 16 July 2026 and takes effect on 16 January 2027, six months later. Projects that go live after that date should be prepared against its provisions from the RFP stage.

Sources

• Law No. 27 of 2022 on Personal Data Protection, JDIH BPK
• Copy of PP No. 33 of 2026, Implementing Regulation of Law No. 27 of 2022
• Kompas.id: Peraturan Pelaksana UU PDP Akhirnya Terbit, Lembaga Pengawas Masih Dinanti
• OJK: Summary of POJK 11/POJK.03/2022 on IT Implementation by Commercial Banks
• OJK: Indonesian Banking AI Governance
• Hukumonline: Mengenal Pokok-Pokok Aturan Baru PP PSTE
• IONext Security and Compliance

This article provides general information, not legal advice. For compliance decisions, consult legal counsel and your organization's DPO.

IONext is sovereign AI infrastructure hosted in Indonesia, operated by PT Data Awan Nusantara in Jakarta. IONext provides GPU as a Service, managed inference through an OpenAI-compatible API, and open-weight model hosting, certified to ISO/IEC 27001:2022 by TÜV NORD.