<![CDATA[Background: The rapid development of digital technology has increased the collection and processing of personal data, creating significant risks of misuse, unauthorized access, and data breaches. In Indonesia, Law No. 27 of 2022 on Personal Data Protection (PDP Law) provides a comprehensive legal framework, but its implementation continues to face institutional and societal challenges. Objective: This study aims to examine the legal protection of citizens’ personal data under Law No. 27 of 2022, assess challenges in its implementation, and formulate measures to strengthen personal data protection in Indonesia. Methods: This study employs a normative-empirical legal approach using qualitative and quantitative methods. Normative analysis examines legislation, legal concepts, and relevant cases, while empirical data were obtained through semi-structured interviews with 10 key informants, observations of five electronic system operators, documentary analysis, and an online survey involving 156 respondents from five major Indonesian cities. Data were analyzed using thematic analysis and descriptive statistics, with methodological triangulation applied to strengthen validity. Results: The findings indicate that the PDP Law establishes an important legal basis for protecting individual privacy and personal data. However, implementation remains constrained by limited supervisory capacity, institutional readiness, technical resources, and inadequate public awareness of personal data rights. Conclusion: Effective personal data protection requires stronger law enforcement, enhanced supervisory capacity, clearer regulatory implementation, and sustained public education regarding privacy rights and data security.]]>
