The development of digital technology accelerates the transformation of public services through population identity applications, but increases the risk of personal data vulnerability. This research analyzes the legal protection of population identity data in digital applications with a normative juridical approach, referring to Law No. 27 of 2022 on Personal Data Protection (PDP Law) and its relevance to Article 28G paragraph (1) of the 1945 Constitution which guarantees the right to privacy. The research aims to examine the effectiveness of the regulation in protecting user data and identify legal loopholes that could potentially be exploited by irresponsible parties. The scope of the research focuses on the implementation of the PDP Law in the context of digital population applications in Indonesia. The results show that although the PDP Law has provided a strong legal basis, three main challenges still hinder optimal protection, namely: (1) weak supervisory mechanisms, (2) low user awareness, and (3) unclear sanctions for violators. Research implications lead to policy recommendations in the form of strengthening supervisory institutions, socializing citizens' digital rights, and improving sanction provisions. The research conclusion emphasizes that the protection of population identity data requires a synergy between regulation, technology, and community participation.