Purpose: This study investigates the legal implications and cybersecurity vulnerabilities surrounding the leak of 102 million electronic identity (E-KTP) records allegedly originating from the Indonesian Ministry of Social Affairs. It highlights the urgency of improving data protection mechanisms in the era of digital governance. Research methodology: The research adopts a qualitative document analysis method, collecting and examining data from laws, government regulations, academic literature, credible news sources, and case studies related to cybercrime and information security. An interdisciplinary approach is applied, integrating perspectives from law, information technology, and cybersecurity. Results: The study reveals that the current regulatory framework is insufficient to fully address the growing risks of data breaches in public digital infrastructures. It identifies critical gaps in cybersecurity readiness, institutional accountability, and legal enforcement related to personal data protection. Conclusions: Strengthening personal data protection in Indonesia requires a combination of stricter regulatory enforcement, increased public awareness, technological investment, and cross-sector collaboration. The legal system must adapt more proactively to emerging digital threats. Limitations: This research is limited to secondary data sources and does not include interviews or empirical fieldwork, which may restrict the depth of analysis on institutional practices. Contribution: This paper contributes to the development of cyber law discourse in Indonesia by offering legal and policy recommendations aimed at enhancing data privacy, institutional responsibility, and public trust in digital identity systems.