Personal data is private and must be protected. The number of personal data leakage cases in Indonesia has a detrimental impact on society. The lack of comprehensive legislation has led to a lack of legal protection for data leakage cases. As a result of the many personal data leaks, the government passed the Personal Data Protection Law Number 27 of 2022. The purpose of this research is to find out the legal umbrella that protects personal data including understanding more about the legal policies regulated in Law Number 27 of 2022. This research will discuss the formulation of problems including how is the regulation of personal data protection based on Law Number 27 of 2022 and how is the legal protection of the dissemination of confidential personal data of Indonesian citizens. The method used is normative with a statutory approach. The findings reveal that legal protection against personal data leaks is already comprehensive in Law Number 27 of 2022, preventive efforts to protect personal data do not share data from the community and society also avoid illegal platforms that occur in cybercrime. While the government will conduct a compliance test for Repressive Protection Efforts in the event of a personal data leak, the sanctions contained in the Personal Data Protection Law are Criminal Provisions Articles 67, 68 and 70 which already contain fines and imprisonment.