The Legal Protection of Personal Data in the Digital Era: A Comparative Study of Indonesian Law and the GDPR

Abstract

In the rapidly evolving digital era, personal data has emerged as a valuable asset, necessitating comprehensive legal frameworks to ensure privacy and security. This study aims to compare the legal protection of personal data under Indonesia’s Personal Data Protection Law (UU No. 27/2022) with the European Union’s General Data Protection Regulation (GDPR). Utilizing a normative legal research method and comparative approach, this research analyzes core principles, data subject rights, the obligations of data controllers and processors, as well as supervisory and enforcement mechanisms in both legal systems. The findings reveal that while the Indonesian PDP Law shares several foundational elements with the GDPR it remains less developed in terms of procedural detail, institutional readiness, and enforceability. The GDPR offers a more mature and integrated approach, featuring robust data subject rights, mandatory Data Protection Impact Assessments (DPIAs), independent supervisory authorities, and extraterritorial applicability. To align with international best practices and adequately protect citizens' digital rights, Indonesia must enhance the implementation of its PDP Law through clearer regulations, stronger enforcement institutions, and broader public awareness. This comparative analysis contributes to the academic discourse on data protection and offers practical insights for policymakers and legal practitioners in emerging digital economies.