<![CDATA[The digitization of government administration has encouraged the management of civil servant data through a national personnel information system, but at the same time has increased the risk of misuse and sale of personal data. Law Number 27 of 2022 concerning Personal Data Protection (PDP Law) emphasizes the obligation to protect data, including civil servant data, and regulates criminal sanctions for the unlawful acquisition and use of data. This study aims to analyze the suitability of the classification of ASN personal data according to Article 4 of the PDP Law with data management practices at the State Civil Service Agency and the Banten Provincial Civil Service Agency, as well as to examine the forms of criminal liability for the sale of ASN data based on Articles 65 and 67 of the PDP Law. This study uses a mixed method with a normative and empirical legal approach through analysis of legislation, criminal law doctrine, and in-depth interviews at the BKN and BKD Banten Province. The results of the study show that ASN data management practices are not yet fully in line with the data classification in the PDP Law, especially regarding access restrictions and data use control, making it difficult to prove the element of “without rights.” Nevertheless, the sale of ASN data still gives rise to individual criminal liability as an intentional offense. This study confirms that strengthening the governance of civil servant data and establishing a PDP supervisory agency are important prerequisites for the effective enforcement of criminal law on personal data protection.]]>
