Personal Data Protection Regulations Research Articles

DeRDaVa: Deletion-Robust Data Valuation for Machine Learning

Data valuation is concerned with determining a fair valuation of data from data sources to compensate them or to identify training examples that are the most or least useful for predictions. With the rising interest in personal data ownership and data protection regulations, model owners will likely have to fulfil more data deletion requests. This raises issues that have not been addressed by existing works: Are the data valuation scores still fair with deletions? Must the scores be expensively recomputed? The answer is no. To avoid recomputations, we propose using our data valuation framework DeRDaVa upfront for valuing each data source's contribution to preserving robust model performance after anticipated data deletions. DeRDaVa can be efficiently approximated and will assign higher values to data that are more useful or less likely to be deleted. We further generalize DeRDaVa to Risk-DeRDaVa to cater to risk-averse/seeking model owners who are concerned with the worst/best-cases model utility. We also empirically demonstrate the practicality of our solutions.

Digital market and its adequacy of merger assessment in Indonesian business competition law

Purpose This study aims to analyze the development of digital market characteristics particularly focusing on how the strategic choices of platforms are not fully reflected in pricing. In addition, the implications for the development of theories of harm are investigated to explore the necessity of a relevant market definition in assessing infringement and evaluating the adequacy of Indonesian competition law. Design/methodology/approach This study is a legal analysis that uses statutory approaches, cases, comparative law and the development of theories of harm in digital mergers. The case approach is conducted by analyzing three cases decided by the Indonesia Business Competition Supervisory Commission. This approach provides insight into the response of Komisi Pengawas Persaingan Usaha concerning the merger and acquisition cases in the digital era as well as the provision of different analyses in conventional markets. However, competition can be potentially damaged in digital markets and a comparative law approach is taken by analyzing digital merger cases decided by authorities in other countries. Findings Results reveal that the digital market has created a “relevant market” that is challenging and blurred due to multi-sided network effects and consumer data usage characteristics. Platform-based enterprises’ prices fluctuate due to the digital market’s network effect and consumer data statistics. Smartphone prices depend on the number of apps and consumer data. Neoclassical theory focusing on product markets and location applied in Indonesia must be revised to establish a relevant digital economy market. To evaluate digital mergers, new harm theories are needed. The merger should also protect consumer data. Law Number 27 of 2022 on Personal Data Protection and Government Regulation on the Implementation of Electronic Systems and Transactions protects online consumers, a basic step in due diligence for digital mergers. The Indonesian Government should promptly strengthen the notion of “relevant markets” in the digital economy, which could lead to fair business competition violations like big data control. Notify partners or digital merger participants of the accessibility of sensitive data like transaction history and user location. Originality/value The development of digital market characteristics has implications for developing theories of harm in digital markets. Indonesian competition law needs to develop such theories of harm to analyze the potential for anticompetitive digital mergers in the digital economy era.

THE URGENCY OF STANDARDIZING THE OPEN APPLICATION PROGRAMMING INTERFACE IN IMPLEMENTATION OF OPEN BANKING FOR CUSTOMER PROTECTION

Open banking with Open Application Programming Interface (open API) technology is an initiative aimed at streamlining the payment system in Indonesia. The open API allows banks to integrate their systems with digital financial service providers (fintech) and bold trade (e-commerce) providers by disclosing customer transaction data. This study investigates the urgency of open API standardization in implementing open banking in Indonesia. This study uses a normative juridical approach to secondary data. The data includes primary, secondary, and tertiary legal materials. In addition, it also uses qualitative normative data analysis methods. It was concluded that before the National Open API Payment Standard (SNAP) stipulation, the process of sharing data between banks and fintech and/or e-commerce still needed to be standardized but was only based on an agreement between the parties. Banking in Indonesia has various open API standards that can affect the protection of customer data. According to the Financial Services Authority Regulation Number 12/POJK.03/2018, the relationship between banks, fintech, and/or e-commerce in providing digital banking services based on agreements between parties needs to be stronger. OJK is indeed present as a supervisory agency. However, the parties will eventually come back to a deal between themselves. Unlike the Regulations of the Financial Services Authority, the Regulations of the Members of the Board of Governors, which form the legal basis for SNAP, provide standards that must be complied with by both service providers and service users. However, implementing SNAP-based open APIs still requires personal data protection regulations.

LEGAL FRAMEWORK FOR PROTECTING BANKING TRANSACTIONS IN THE METAVERSE AGAINST DEEPFAKE TECHNOLOGY

Backgorund: In the virtual world of the metaverse, various activities such as banking transactions and blockchain, despite their positive impacts, are not immune to the risks of financial cybercrime, including the use of artificial intelligence deepfake technology. This technology can create seemingly authentic audiovisual content from individuals or customers, leading to data theft, money laundering, and other financial crimes. This research aims to analyze the legal framework governing banking transactions in the metaverse and blockchain, as well as the legal regulations addressing the protection against financial cybercrimes involving deepfake technology.   Methods: This research employs the doctrinal legal research method. The approach utilized includes the legislative approach (statute approach), conceptual approach, and comparative approach. It also utilizes primary data sources such as laws and secondary data sources like books, journals, and internet resources related to banking transactions in the metaverse and deepfake technology.   Results: The analysis results indicate that the Information and Electronic Transactions Law (UU ITE) and the Financial Services Authority (OJK) regulations in Indonesia do not specifically address banking transactions in the metaverse and blockchain. Additionally, the Personal Data Protection Law and regulations related to crimes involving deepfake artificial intelligence technology are also not specifically accommodated; they currently only have general coverage. This creates a legal vacuum in Indonesia regarding these issues.   Conclusion: There are differences in regulations in each country that govern banking transactions in the metaverse and crypto, as well as regulations on cyber financial crimes. Therefore, the government needs to review existing regulations and reconstruct them to govern banking transactions in the metaverse and blockchain. It is also essential to create specific regulations for the protection of personal data and regulations specifically addressing artificial intelligence.

Communication Network of Digital Opinion Movement in the Formation of Personal Data Protection Regulation

The rise of data theft in the digital space has prompted the public to call for regulations regarding data security to be implemented immediately. Opinions in the form of requests for the passing of the Personal Data Protection Law (UUPDP) via social media Twitter have become very widely discussed. UUPDP is a regulation related to personal data protection to fill the regulatory void in the digital space. The keyword UUPDP became a topic of conversation on Twitter when the UUPDP personal data protection law was passed by the government and the DPR. The aim of this research is to map the Digital Opinion Movement through communication networks and identify influential actors in communication networks using the keyword UUPDP on Twitter. This research uses the Social Media Network Analysis (SMNA) method. The theory used to answer this case is the Digital Movement of Opinion/DMO theory and communication network theory. information collected via Twitter from 11 September 2022 – 21 September 2022. Stages in analyzing and retrieving data using the website based Netlytic.org application and Gephi software. The use of this tool is used to map influential actors involved in the communication network using UUPDP keywords, next to measure centrality using the indicators of degree centrality, betweenness centrality, closeness centrality and eigenvector centrality. The results of the research are 2 (two) main actors who influence the movement of digital opinion in communication networks with the keyword UUPDP, namely @franken_blues and @hunterjagar3.

Personal Data Protection in Telemedicine: Comparison of Indonesian and European Union Law

Telemedicine allows patients to receive remote medical consultation, diagnosis, and treatment through a digital platform. However, with the development of telemedicine, personal data protection has become one of the main concerns. This research aims to compare the regulation of personal data protection in telemedicine services in Indonesia and the European Union. The type of research in this scientific article is Normative Juridical Research with a comparative legal approach. The data sources obtained in this paper are primary data and secondary data.   The data collection method is a literature study. The data analysis method in this paper uses a qualitative approach. The results show that personal data protection in Indonesia is regulated by Law Number 27 of 2022 concerning Personal Data Protection (PDP Law). While in the European Union, Personal Data Protection is regulated in the General Data Protection Regulation (GDPR) which regulates the collection and use of personal data by organizations. Some similarities in personal data protection in both telemedicine in Indonesia and in the European Union are that the same consent requires telemedicine providers to obtain clear and explicit consent from patients. Both telemedicine providers must not disclose the patient's personal data to third parties without the patient's consent. Telemedicine providers to implement security measures to protect patient personal data. Both Indonesia and the European Union give patients the right to access, correct, delete, and limit the use of their personal data

Legal Protection of Personal Data in Artificial Intelligence for Legal Protection Viewed From Legal Certainty Aspect

Protection of personal data is one of the rights possessed by humans, which is one of the privacy rights possessed by a person in maintaining and securing personal data owned by each individual. The development of Artificial Intelligence (AI)-based technology has developed rapidly in the digital world 4.0, where legal protection is needed in personal data protection legal instruments. This research aims to examine the use of AI as a tool in protecting personal data and to examine the urgency of a special regulation in Indonesia in protecting personal data. The research method used in writing this law is normative legal research. In this research, what is meant by juridical research is the 1945 Constitution of the Republic of Indonesia, the Law on Information, and Electronic Transactions Number 11 of 2008, the Regulation of the Minister of Communication and Information Number 20 of 2016, Government Regulation Number 82 of 2012, and UDHR by conducting a study of legal products in the form of laws and regulations. Furthermore, what is meant by normative research is related to the principle of legal certainty, which later can be linked to the urgency of personal data protection regulations for the protection, supervision, and utilization of personal data abuse.
 Keywords: personal data, artificial intelligence, protection, urgency

The need to take into account the international experience of legal regulation in the field of protection of information about children

The article examines the relevance of personal data protection, in particular of children, in the context of the rapid development of the Internet and the information sphere. The author analyzes the principles and peculiarities of legal regulation of children's personal data protection as defined by the UN Convention and the Law of Ukraine "On Protection of Childhood".
 The author assesses the impact of the Data Protection Regulation on Ukrainian legislation and the need for harmonization with European standards for the full protection of children's personal data. Comparison of the provisions of the Regulation with the national legislation reveals significant differences, in particular, the absence of separate regulation of children's personal data and the principles of processing such data. The author expresses a position on the need to harmonize Ukrainian legislation with European standards as an important component of effective personal data protection. The author also analyzes the provisions of the Draft Law No. 8153 "On Personal Data Protection" and concludes that the Draft Law is aimed at establishing compliance with European standards, expanding the principles of data processing and establishing new consent requirements. Important changes relate to terminology, processing rules, protection of children's data, financial responsibility and other aspects, however, the issue of protection of children's personal data as a separate category has not been given due attention.
 The author concludes that today the issue of personal data protection, in particular of children, is regulated by numerous international and national legal acts. At the same time, it is noted that the EU Regulation provides for special protection of children's rights, which is different from the Law of Ukraine "On Personal Data Protection", and Draft Law No. 8153 leaves aside the issue of protection of personal data of a child specifically. As a result, it is noted that in order to reduce risks, it is necessary to take into account the principles of the Regulation in national legislation, in particular transparency and limitation of settings. It is also important to raise the legal culture of citizens in the field of personal data protection, contributing to the improvement of the regulatory environment.

Pertanggungjawaban Badan Penyelenggara Jaminan Sosial (BPJS) Kesehatan Atas Kebocoran Data Pribadi Pengguna dalam Perspektif Hukum Pidana

BPJS Health is the Health Social Security Organizing Agency which is responsible for administering health insurance programs for the Indonesian people. However, in the era of increasingly digitalization, user data leakage is a serious problem that must be handled seriously. User data leaks have become an increasingly disturbing issue in this digital era. One of the entities responsible for maintaining the confidentiality of user data is the Social Security Administering Agency for Health. This article aims to analyze BPJS Health's responsibility for leaking user data from a criminal law perspective. This research uses normative research methods with a statutory approach and related cases in its analysis. The research results show that leakage of user data by the Health Social Security Administering Agency can violate several criminal provisions as stated in Law no. 27 of 2022 concerning personal data protection and based on Law no. 11 of 2008 concerning Information and Electronic Transactions, especially in the context of violations of confidentiality and protection of personal data. It can be concluded that BPJS Health has criminal legal responsibility for user data leaks. To minimize the risk of data leaks, the Social Security Administering Agency for Health needs to improve system security and compliance with personal data protection regulations. Apart from that, the government needs to strengthen supervision and law enforcement in dealing with cases of data leaks involving public entities such as BPJS Health.

Protection of Genetic Data in Health Services Based on Genomics Technology in Indonesia

Indonesia is developing precision medicine by integrating genomic capacity into health services. Currently, there is no comprehensive regulation governing these services, resulting in legal uncertainty regarding the regulation of personal data protection (genetic data) based on Indonesian statutory provisions. The purpose of this research is to immediately form implementing regulations to regulate in detail Personal Data Protection in genomics-based health services in Indonesia.  The research method used is normative juridical (Legal Research) which is descriptive analytical in nature using a statutory approach and using secondary data types.  The results of this study explain that broadly speaking, genetic data generated from genomics-based technology is one of the data that should be protected by the State with provisions, rights and obligations and sanctions that should be obeyed by all interested parties. The establishment of an independent Data Controller is needed in an effort to implement personal data protection. The conclusion obtained by the author is that the PDP Law has not been implemented clearly and completely so that it requires derivative regulations that ensure the implementation of the protection of personal data of the community

The Legal Protection of Personal Data in Islamic Perspective

The protection of personal data is a public right that must be protected, even in Islam through the words of the Prophet Muhammad SAW, advocating peace by promoting attitudes of mutual respect, respect and love for fellow human beings. This attitude must be practiced among other religious communities, not only among Muslims. The research purposes to discuss specifically the regulation of personal data protection in Indonesia and personal data protection from an Islamic perspective. The type of research used in this research is normative juridical or library legal research or doctrinal legal research, namely legal research by examining library materials and secondary materials. In the view of the Islamic perspective regarding the protection of personal data is monitored as an endeavor to maintain the benefit of individuals and society in the use of information technology and can be considered as an implementation of the principle of benefit in Islam.

Protection of privacy in information technologies in the context of COVID-19: A comparative legal analysis of the Republic of Kazakhstan and the European Union

Today, the world community faces the arduous and responsible task of preventing the spread of the coronavirus disease COVID-19, which objectively requires the adoption of a complex of anti-epidemic (organizational, medical, administrative, and other) measures to prevent the spread of COVID-19 and to contain and elimi-nate this epidemic. At the same time, to a large extent, such measures are embod-ied in various forms of restrictions on the realization of civil, political, and other rights, freedoms, and legitimate interests of a person and a citizen, as well as to a certain extent there are encroachments on the inviolability of a person's private life. The purpose of the scientific article is to study the state mechanisms of Ka-zakhstan and the European Union on legal support and security of personal data on the Internet, particularly during the COVID-19 pandemic, and to determine possible ways for their development and improvement. The research used dialecti-cal, historical-legal, formal-logical, comparative-legal, and special-legal research methods, and systemic-structural research methods, as well as the method of sys-temic analysis. The theoretical significance of the study lies in the fact that it de-velops new scientific provisions, proposals, and recommendations that deepen the theoretical and practical foundations in the field of legal regulation of personal da-ta protection in information technologies during the pandemic in the European Un-ion in general and in the Republic of Kazakhstan in particular.

Prawo do bycia zapomnianym w perspektywie przetwarzania danych osobowych

Nowadays, effective protection of personal data is one of the fundamental issues of a democratic state under the rule of law. Therefore, the legislator should be very precise about the principles and standards of data processing. In the last few decades, in particular, the development of new technologies, digitalisation and the increase in the need for electronic communication has become evident, which leads to the adoption of appropriate regulations for the handling of personal data. In addition, the EU legislator has introduced the General Data Protection Regulation (GDPR) in order to harmonise the regulations of EU Member States regarding the protection of personal data. This provides a framework for the proper functioning of legal provisions across the European Union regarding the handling of personal data of its citizens.The aim of the article is to identify the legal changes resulting from the Personal Data Protection Regulation, with a particular focus on the persons to which they apply and then to analyse the regulation of ‘the right to be forgotten’. In the first part of the article, attention is drawn to the way personal data are processed and the scope of obligations incumbent on data controllers. This is because data controllers are, together with the personal data protection officer, responsible for recording data processing activities, including ongoing monitoring and responding to situations of inaccurate data processing. The second part focuses on the right to be forgotten and the assessment of this entitlement in the perspective of Regulation 2016/679. The research methods include an analysis of legal acts, at the same time using the subject literature.

Current issues of international legal regulation of the protection of personal data of employees

The article discusses the problems of protecting personal data of employees from the beginning of submitting their resumes as a job seeker to their dismissal. The authors of the article analyzed and considered the regulation of this issue in the General Regulation of Personal Data Protection. During the study of the topic of the article, the methods of structural analysis and synthesis were used to divide the received information into separate structural units and systematically combine various aspects of the information into a single structured system of presenting information regarding the features that were initiated directly by the General Regulation on the Protection of Personal Data. Special attention was also paid to the legislation of Ukraine on the protection of personal data of employees. The topic of protecting employees' personal data is relevant and timely, especially in the era of digital transformation and the growing use of technology in work processes. On the one hand, the increased use of digital tools makes the work of employees easier and faster, but it also leads to an increase in the amount of personal data that is collected and processed by the employer's company. This can become a problem for the privacy of employees who have the right to protect their personal data. On the other hand, large companies can be the target of hacker attacks that aim to steal the personal data of employees and lead to serious consequences such as the theft of identity data, financial data and other sensitive data. The authors of the article concluded about the need to introduce a separate independent institution that will act as a guarantor of personal data security.
 In order to systematize and efficiently process the personal information of employees, in the conditions of globalization processes, employers or employees of the personnel department regularly use applications, programs, websites with the ability to process data arrays, including personal data of employees. Therefore, the use of modern technologies can cause considerable harm to the employee. The authors of the article investigate the mechanism of how to protect data and the regulation of the protection of this data, both from the practical application and the legal regulation of this issue.

Regarding the issue of legal protection of personal data of employees

The paper examines the state of legal regulation of personal data protection of employees in Ukraine. It is established that the national labour legislation does not have special rules on the specifics of regulating the security of processing and storage of personal data in the process of concluding, implementing and terminating employment relations. With this in mind, the authors refer to the experience of international and European institutions in regulating this area. It is established that the ILO and EU instruments have a broader scope than national legislation, namely, they contain not only general rules, but also those regulating relations in the field of employment and employment. Given Ukraine's commitment to improve its personal data protection legislation in order to bring it in line with the GDPR as part of the implementation of the Association Agreement with the European Union, the authors propose a number of measures to improve the mechanisms and means of legal regulation of employee personal data protection in the context of digital and European integration. These include - introduction of international standards for ensuring mechanisms related to the security, protection and defence of employee personal data; - creation of a legal regime for the protection and defence of employee personal data in accordance with the European Regulation; - establishment of liability and determination of types of punishment for violation of legislation in the field of protection of employee personal data; - introduction of special provisions in the Labour Code of Ukraine regarding the employer's obligation to protect personal data.
 It is noted that in connection with the military aggression of the Russian Federation against Ukraine and the introduction of martial law, this issue has become even more relevant and requires further legislative consolidation and consideration of international experience and analysis of the current state, taking into account the existing practical component.

Personal Data Protection Issues in the Realm of Telemedicine. Blockchain, Civil Liability and other Methods to Overcome Them.

The subject of this article is the legal regulation of personal data protection in the field of medical care with the use of telemedicine technologies and digital healthcare. Its purpose is to identify and analyze the problems of personal data protection and to find ways to overcome them. The relevance of the work is due to the presence of a large number of leaks of personal data, gaps in regulation, and the lack of an effective system of norms aimed at preventing the compromise of patient information. The author examines the main aspects of regulating the procedure for working with the patient's consent to the processing of personal data. Much attention in the article is paid to blockchain technology, traditionally considered in the Russian legal literature only within the framework of the use of cryptocurrencies. The article also analyzes the issues of the application of civil liability measures for offenses in the field of personal data protection of recipients of telemedicine services.The author criticizes the unreasonably strict regulation of the procedure for obtaining the patient's consent to the processing of personal data by a medical organization, emphasizes the need to introduce a flexible form of consent. This will reduce the amount of information at risk of leakage. In addition, the idea of creating a mechanism for revoking the patient's consent to the processing of personal data and securing the patient's right to demand from the medical organization the termination of their processing is put forward. The paper points to the prospects for the use of blockchain in the field of telemedicine, including for the protection of personal data. A regulatory division of blockchain systems into centralized and decentralized ones is proposed, suggesting their different regulation in relation to the protection of confidential information. In addition, the article notes the lack of elaboration of the norms on civil liability for offenses in the field of working with personal data in telemedicine, it is proposed to tighten regulation in order to increase the level of protection of patients' rights.

THE NEW CHAPTER OF INDONESIA’S DATA PROTECTION ON DIGITAL ECONOMY PERSPECTIVE

Personal data protection regulations are an essential component of legislation to build user confidence in the digital economy. This study aims to determine how privacy and private data protection arrangements changed after the passage of the Personal Data Protection (PDP) Law through legal analysis to answer two fundamental questions regarding privacy protection and personal data protection arrangements earlier and after the enactment of the PDP Law. Indonesian regime of data protection enters a new chapter with the passing of the PDP Law. Therefore, stakeholders need to understand the changes in current laws and regulations to comply with the PDP Law. The interesting thing in this study is that the research data will answer how the current regulation of personal data protection in Indonesia works by comparing the structure before and after the enactment of the PDP Law. Data processing uses normative juridical methods. The results of this study indicate that the regulations before and after the PDP Law contained internationally accepted personal data protection principles. The principles of personal data protection that existed in regulations before the PDP Law became an essential reference for processing personal data-by-data controllers are further elaborated comprehensively in the form of obligations and responsibilities of data controllers and processors in the PDP Law. The research concludes that automatic data processing, vulnerable to privacy degradation, has become part of the data subject's rights under the PDP Law. The severity of administrative penalties has increased, including criminal penalties and demands for compensation. The presence of data protection officers and data protection agencies in the PDP Law complements Indonesia's personal data ecosystem. The PDP Law's complexity and harsh sanctions necessitate proper implementation plans and strengthening for small- and medium-scale business actors. Keywords : Personal Data Protection Law, Indonesia, Digital Economy, E-Commerce DOI： https://doi.org/10.35741/issn.0258-2724.58.3.9

Comparison of Personal Data Protection Laws Using Narrative Policy Framework Between Indonesia, Malaysia, and Japan

The era of information and communication technology continues to grow and shows a significant increase. is a type of offensive maneuver used by a state, individual, group, or organization that targets computer information systems, infrastructure, computer networks, and or personal computer devices using malicious acts which usually originate from anonymous sources who steal, modify or destroy the specified target by hacking a vulnerable system. Cyberattacks can happen in any part of the country. The increasing use of the internet has the risk of increasingly massive hacking threats. The National Cyber and Crypto Agency (BSSN) noted that until April 2022, cyber attacks in Indonesia reached 100 million cases. This research benchmarks the situation of cyber attacks and personal data protection regulations in Indonesia with countries that have better handling of cyber crimes. The method is to compare narrative elements in the form of heroes, villains, and victims in each country, using the Narrative Policy Framework (NPF) analysis method. The Narrative Policy Framework is an approach or research framework on the public policy process, it is identified that the hero character represented by comprehensive personal data protection regulations has long been used by Japan and Malaysia. The character of heroes in Indonesia seems not to be too dominant because there are villains who are present in the form of the absence of unified regulations for the protection of personal data from the threat of cyber attacks

IMPLIKASI DAN SOSIALISASI UNDANG-UNDANG TENTANG PERLINDUNGAN DATA PRIBADI DALAM MENJAGA KERAHASIAAN DATA PRIBADI SESEORANG

This journal aims to carry out the tridharma obligation, namely community service where we provide education about the implications and socialization of the Personal Data Protection Act in maintaining the confidentiality of one's personal data. The method used is to conduct a survey to the target community and conduct socialization and education directly to the community. The Personal Data Protection Law is a manifestation of the state's protection for the fulfillment of the privacy rights of its citizens, but there are still many challenges from the implications that the government and society must go through with this regulation, especially in interpreting the various interests regulated in the law. personal data protection regulations that are still very general, ensure proper implementation and supervision, as well as synchronization with various other laws and regulations. For this reason, more intense socialization is needed and has a broad impact on the community, business actors, students, etc. so that the regulation on the protection of personal data can be carried out properly and can be beneficial for various parties.

PROTECTION OF INDONESIA’S PERSONAL DATA AFTER RATIFICATION OF PERSONAL DATA PROTECTION ACT

The protection of Indonesia's personal data entered a new chapter with the signing of the Personal Data Protection Bill by the President on October 17, 2022. The presence of the Personal Data Protection Law (UU PDP) is a lex specialist of Indonesian personal data protection regulations. This study analyzes how the form of protection of Indonesian personal data after the enactment of the PDP Law by using components in the personal data protection ecosystem as parameters, namely data subjects, data controllers and data processors, data protection officers and personal data protection supervisory agencies. Using normative legal research methods, this study found that the regulation of the 4 components has been accommodated in principle in the PDP Law. The balance between the protection of individuals on the one hand and the public interest on the other is tried to be accommodated in the principles behind the PDP Law and the reduction of the implementation of some norms. The composition of the norms shows that the processing of personal data, especially the obligations of the data controller, is the focus of regulation. The role of a data protection officer to ensure regulatory compliance is complemented by a risk mitigation function. The existence of data protection as service is also accommodated in the PDP Law. The supervisory agency is given a series of authorities with detailed details of investigative authority. The PDP Law as a compact regulation requires various implementing regulations, including provisions issued by institutions and sectoral regulations. The support of understanding and strengthening of all parties in the personal data protection ecosystem absolutely needs to be carried out immediately as an effort to realize compliance by minimizing protection failures and unauthorized processing as a preventive measure. Preventive measures should be used as a key option in the data protection regime. Therefore, discussions regarding the protection of personal data continue to move dynamically following emerging legal and social developments.