<![CDATA[The accelerated growth of digital transactions has intensified exposure to cybercrime risks, particularly phishing and data breaches, which undermine personal data security and erode public confidence in electronic systems. Despite Indonesia’s adoption of the Law on Information and Electronic Transactions and the Law on Personal Data Protection, phishing and data breach incidents persist and continue to generate difficulties in the practical application of criminal law. This study seeks to examine the forms of criminal liability that may be attributed to perpetrators of phishing and data breach offenses within digital transaction contexts, while also identifying the principal barriers to effective criminal law enforcement against these crimes. The research applies a normative legal methodology using statutory and conceptual approaches, grounded in an analysis of relevant legislation, criminal law doctrines, and key theoretical frameworks concerning cybercrime and personal data protection. The findings indicate that phishing and data breach crimes can be subject to criminal liability even though phishing is not explicitly formulated as a specific offense; however, their enforcement faces normative, conceptual, evidentiary, institutional, and technological obstacles. These constraints reflect tensions between fundamental principles of criminal law and the dynamic nature of cybercrime, highlighting the need for a more adaptive and effective criminal law policy to ensure the security of digital transactions]]>
