The increasing adoption of virtual conferencing technology after the COVID-19 pandemic has encouraged the use of online hearings in arbitration proceedings, while also giving rise to risks of confidential data leakage and cybersecurity breaches in transnational commercial disputes. This study aims to analyze the legal framework for the liability of international arbitration institutions for data security breaches in virtual hearings in Indonesia and to reconstruct relevant legal doctrines for the national arbitration regime. This study uses a normative juridical method with statutory, conceptual, and comparative approaches based on functional comparison. The results show that there is no legally binding standardization of cybersecurity protocols for international arbitration institutions in Indonesia, unlike Singapore and the United Kingdom, which already have more comprehensive regulatory frameworks. In addition, the construction of arbitral civil liability in the Indonesian legal system remains fragmented and has not been able to address losses resulting from data breaches in transnational commercial disputes. The conclusion of this study affirms the need to reconstruct the concept of Cyber-Duty of Care as a new legal doctrine in the Indonesian arbitration regime that systematically integrates the principles of personal data protection, cybersecurity standards, and arbitral civil liability. These findings provide a theoretical contribution to the development of arbitration law and data protection in virtual hearings, as well as practical implications for policymakers and arbitration institutions in strengthening data security protocols in international arbitration proceedings in Indonesia.