<![CDATA[Indonesia's digital transportation sector faces a tension between mobility efficiency and the vulnerability of users' personal data, as application providers characterise themselves as technology platforms while standard electronic contracts may allocate the risk of data breaches to consumers and driver-partners. This study examines how Minister of Transportation Regulation Number 118 of 2018 and Law Number 27 of 2022 concerning Personal Data Protection should be synchronised in determining the responsibility of application providers, to what extent exoneration clauses are compatible with contractual justice and data protection law, and what regulatory architecture should integrate cybersecurity into digital transportation governance. Using normative legal research with statutory and conceptual approaches, the study analyses legislation, literature, and the standard terms and privacy policies of dominant application providers through operational indicators of legal certainty and of commutative, distributive, and procedural justice. The findings demonstrate that regulatory synchronisation strengthens the normative basis for enhanced liability of application providers for personal data breaches, including a reversed burden of proof in consumer claims, and supports a stricter liability regime for high-risk processing as a proposal for future legislation. Exoneration clauses that transfer the provider's liability are void by operation of law without invalidating the whole contract, while personal data may constitute additional economic consideration where their processing exceeds what the transport service requires. The study proposes an Integrated Digital Transportation Data Governance Framework built on regulatory integration, platform accountability, contractual justice, and risk-based cybersecurity governance, including tiered certification, impact assessments, and coordinated supervision.]]>
