<![CDATA[The expansion of open banking services improves digital financial connectivity while increasing the risk of personal data breaches across banks, payment service providers, and collaborating entities. This study analyzes the legal protection available to banking customers in Indonesia and formulates an accountability model for incidents involving multiple actors. It employs normative legal research with doctrinal, statutory, conceptual, and analytical approaches. Primary and secondary legal materials were collected through document study and examined qualitatively through legal interpretation, norm synchronization, and prescriptive analysis. The findings show that Indonesia has established preventive safeguards through personal data protection law, financial consumer protection rules, electronic system governance, cybersecurity standards, and the National Standard for Open Application Programming Interface Payments. However, responsibilities remain distributed across regulatory regimes, creating uncertainty after a breach. This study proposes an integrated accountability and redress model based on functional role classification, limited data access, partner supervision, coordinated notification, a single-entry complaint mechanism, evidence preservation, and proportionate remediation. The study recommends a coordinated protocol involving Bank Indonesia, the Financial Services Authority, and the personal data protection supervisory institution. Future research should evaluate its implementation within banking institutions and digital payment ecosystems. It also identifies priorities for cross-border processing and customer-facing consent management.]]>
