Indonesia’s Directorate General of Population and Civil Registration (Ditjen Dukcapil), operating under the Ministry of Home Affairs, has issued a tender for 4 petabytes of storage to support real-time replication of the nation’s population and biometric identification data. Published on October 28, 2026, and titled Procurement of Storage for DC Co-Location, the tender calls for two 2-petabyte storage units at Dukcapil’s secondary co-location data center in Central Jakarta.
One storage unit will function as primary storage while the other operates as backup. Bids for the contract are due on December 10, 2026, and the winning supplier will receive five months to implement the contract once it takes effect. The procurement covers system installation, configuration, maintenance, technical support, and knowledge transfer.
Central Jakarta Co-Location Storage Procurement Details
The 4-petabyte storage acquisition supports Dukcapil’s ongoing development of an active-active data center architecture designed to improve service continuity during outages. This planned setup allows Dukcapil’s main data center and its Central Jakarta co-location facility to operate simultaneously, strengthening overall redundancy and recovery capabilities. The tender specifically mandates the replication of data between both facilities for the Automated Biometric Identification System (ABIS) and the Population Administration Information System (SIAK).
Financing for the procurement comes from Indonesia’s $250 million World Bank-backed ID for Inclusive Service Delivery and Digital Transformation project, which received approval in May 2023. A World Bank procurement notice estimates the co-location storage contract at $16.9 million and notes a separate planned $40 million acquisition of a new Automated Biometric Identification System. Dukcapil is also pursuing facial liveness technology for its IKD digital identity application through an early market engagement exercise launched in October 2026.
Did You Know? Bid evaluations assign 60 percent weight to technical and non-price criteria and 40 percent to cost, as the tender proceeds via international competitive procurement following World Bank guidelines.
Lessons Learned from the 2024 Surabaya Cyber Attack
The infrastructure resilience investment arrives in the wake of a June 2024 ransomware attack on Indonesia’s Temporary National Data Center (PDNS 2) in Surabaya. That incident disrupted immigration processing, airport operations, and services across more than 230 government agencies. Based on Reuters reporting, Indonesia’s cybersecurity agency disclosed that backups were missing for 98 percent of government data housed at one of the breached centers, which led then-Joko Widodo to command an audit of government data facilities.
Although that attack struck a separate government facility, it highlighted how quickly essential public services fail without adequate backup and recovery systems. National identity databases carry similar vulnerabilities. As electronic Know Your Customer (e-KYC) adoption expands, an outage risks disrupting not only government operations but also private-sector entities that depend on official population records for identity verification.
As reliance on centralized identity platforms deepens across both public and private sectors, system availability depends as heavily on reliable disaster recovery architectures as it does on underlying identification algorithms.
Suppliers must provide certified local engineers
The tender places strong emphasis on building domestic operational capabilities, requiring suppliers to provide certified engineers in Indonesia with round-the-clock on-site or on-call availability. Bidders with a service depot in the installation city, an established technical escalation network, and spare parts held locally are favored. The winning supplier must conduct a three-day, in-person knowledge-transfer program for at least 30 Dukcapil personnel alongside certified security training for 15 participants.
Operational control is reinforced through strict data protection rules. Defective storage drives must remain Dukcapil property and cannot leave the data center premises. The storage infrastructure must support encryption, access controls, audit logging, and secure data sanitization. These security measures align with Indonesia’s evolving personal data protection framework, which includes the Personal Data Protection Law enacted in October 2022 and Government Regulation No. 33 of 2026, taking effect on January 16, 2027.
Procurement schedule sets evaluations for early 2027
The procurement schedule sets technical evaluations for January 2027, financial evaluations for February 2027, and the end of the standstill period for March 5, 2027. Allowing up to five months for implementation after contract execution, the new storage infrastructure may become operational well into 2027, arriving ahead of the World Bank project’s scheduled closing date of December 31, 2027.
Where the new storage units will be installed
Where will the new 2-petabyte storage units be installed?
The two 2-petabyte storage units will be installed at Dukcapil’s secondary co-location data center in Central Jakarta, with one unit serving as primary storage and the other functioning as backup.
What project funds the co-location storage contract?
Indonesia’s $250 million World Bank-supported ID for Inclusive Service Delivery and Digital Transformation initiative finances the purchase, with a World Bank procurement notice valuing the storage agreement at $16.9 million.
What training requirements must the winning supplier fulfill?
The winning supplier must conduct a three-day, in-person knowledge-transfer program for at least 30 Dukcapil personnel and provide certified security training for 15 participants.
How will the active-active architecture change service reliability for Indonesian citizens and businesses relying on official identity verification?