This study examines the concept of personal data as a privacy right from the perspective of human rights and legal protection under Law Number 27 of 2022 concerning Personal Data Protection (PDP Law). Utilizing doctrinal legal research methods, the study finds that the PDP Law regulates personal data protection both preventively and repressively. Preventive measures include the obligation of data controllers to maintain data security through adequate systems and transparent data management practices. Meanwhile, repressive measures encompass administrative and criminal sanctions, as well as mechanisms to address violations of the legal protections stipulated in the PDP Law. However, the implementation of these protections faces significant challenges, particularly in law enforcement. The absence of a dedicated institution to enforce sanctions and oversee the implementation of the PDP Law represents a major obstacle to ensuring effective personal data protection. Therefore, the establishment of an independent supervisory authority is essential to optimize law enforcement. This study concludes that strengthening regulations through the creation of a specialized institution will not only significantly enhance legal protection for personal data in Indonesia but also bolster public trust in navigating the increasingly complex challenges of the digital era