<![CDATA[Photographs displaying a person's face constitute specific personal data under Indonesian law, yet their commercialisation on marketplace applications without the subject's consent has become widespread. This study analyses the legal arrangements governing the protection of personal data against such commercialisation and the forms of legal protection available to the photographic subject. It employs normative legal research using statutory, conceptual, and analytical approaches, examining primary, secondary, and tertiary legal materials collected through library research and analysed qualitatively through the Theory of Legal Certainty and the Theory of Legal Protection. The findings show that the governing arrangements are dispersed across the Personal Data Protection Law, the Copyright Law, and the Electronic Information and Transactions Law, which complement one another but are not procedurally integrated. Three points of normative vagueness persist within the Personal Data Protection Law, namely the boundary of the exempted personal or household activity under Article 2 paragraph (2), the scope of biometric data for photographs already published openly under Article 4 paragraph (2) letter b, and the tiered interpretation required to establish a lawful basis for processing under Article 20. The forms of protection consist of preventive protection through the consent requirement, the rights of the data subject, and the obligations of the marketplace operator, and repressive protection through administrative sanctions, criminal sanctions, and civil claims. The core weakness lies not in the absence of norms but in vague formulation, the absence of implementing regulations, and the incomplete establishment of the supervisory authority, which shifts the entire burden of enforcement onto the victim.]]>
