Personal data leaks have become one of the major issues in cybercrime. The government has attempted to overcome this issue by implementing Law on Personal Data Protection (UU PDP) and establishing law enforcement agencies for Personal Data Protection. Despite the existence of laws that regulate and agencies responsible for this issue, personal data leaks still occur frequently. One of the cases was the leak of customer data from Bank Syariah Indonesia (BSI). This study analyzes the assurance of privacy rights concerning data managed by Big Data Controllers under the Personal Data Protection Law and identifies legal actions that victims of data hacking due to the data controller’s negligence regarding the Big Data security systems. This research uses normative juridical methods with a descriptive-analytical approach. The results of the research show that Indonesia has regulations to protect the privacy rights of its citizens, specifically in the Personal Data Protection Law which regulates actions and restoration of the right to privacy if data leaks occur by the limitations of this article.