The rapid advancement of digital technology has heightened the risk of personal data misuse, thereby necessitating effective law enforcement under Law Number 27 of 2022 on Personal Data Protection (PDP Law). This study aims to examine judges’ legal reasoning in adjudicating cases of personal data misuse and to analyze the application of the PDP Law within Indonesia’s criminal justice system. Specifically, it assesses the alignment between the ideal legal principles (das sollen) and the practical implementation (das sein). Employing a normative juridical approach combined with qualitative analysis, this research examines three court decisions: Decision No. 77/Pid.Sus/2024/PN Tangerang, Decision No. 78/Pid.Sus/2024/PN Tangerang, and Decision No. 5/Pid.Sus/2023/PN Karanganyar. The findings reveal that judges have begun to internalize the paradigm of personal data protection through the application of Articles 67 and 68 of the PDP Law, although variations in interpretation and implementation persist. The study concludes that Indonesia’s judicial practice is undergoing a gradual transition toward a more consistent enforcement of privacy law, yet further development of jurisprudential guidelines and enhanced judicial capacity remain essential to strengthening privacy protection in the digital era.