This research stems from the widespread practice of misusing personal identification data (National Identity Number and Family Card) to register prepaid telecommunication cards without the consent of the data ownerThe legal issue examined in this study focuses on the forms of criminal sanctions applicable to such offenders and the extent to which existing legal provisions have been effective in providing protection and deterrence. The study employs a normative juridical research method, utilizing a statute approach and a case approach. Data were collected through a literature review of legislation, legal literature, and court decisions concerning identity misuse in prepaid card registration. The analysis draws upon legal protection theories (Satjipto Rahardjo and Philipus M. Hadjon), legal system theory (Lawrence M. Friedman), and justice theory (John Rawls) to evaluate the relevance of applicable provisions, the adequacy of criminal threats, and the practical obstacles in law enforcement. The findings indicate that the criminal provisions under Article 51 paragraph (2) of the Electronic Information and Transactions Law (UU ITE) and Article 65 paragraph (2) of the Personal Data Protection Law (UU PDP) can be applied to prosecute offenders. However, their effectiveness is hindered by difficulties in proving the element of intent (mens rea), lack of harmonization between regulations, limited law enforcement capacity, and low public awareness. This research contributes novelty through a multi-regulatory analysis and progressive solutions, such as harmonizing the application of legal provisions, enhancing law enforcement training, improving digital literacy, and strengthening oversight of SIM card registration as part of a more comprehensive personal data protection framework.