The Effectiveness of Personal Data Protection Law in Addressing Data Breach Threats in Indonesia’s Digital Transformation Era

Abstract

The rapid pace of digital transformation in Indonesia has given rise to various cyber threats, particularly the increasing incidence of personal data breaches. The enactment of Law Number 27 of 2022 concerning Personal Data Protection represents a significant milestone in the national cyber law framework. However, the effectiveness of its implementation continues to face multiple challenges, including limited supervisory capacity, low levels of public digital literacy, and delays in the establishment of an independent supervisory authority as mandated by the law. This study adopts a normative-sociological approach to examine two primary issues: (1) the extent to which the Personal Data Protection Law effectively safeguards against personal data breaches; and (2) the urgency of evaluating this regulation amid the rising number of cyber incidents. The findings indicate that the law still contains several legal gaps that require immediate attention, particularly in terms of sanction enforcement mechanisms, inter-agency coordination, and harmonization with existing sectoral regulations. Strengthening institutional frameworks and enhancing the capacity of cyber law enforcement authorities are identified as key recommendations of this study.