This research examines the legal responsibilities of banks in cases of customer data breaches in Indonesia. The study aims to analyze the scope of the banks' legal obligations, the mechanisms for protecting customer data, and to evaluate data breach cases in order to formulate recommendations for strengthening the system. Using a normative legal research method, this study investigates relevant regulations, banking practices, and case studies. The findings indicate that banks have multi-layered responsibilities based on various laws, while existing protection mechanisms often prove inadequate in preventing sophisticated cyber threats. This research also provides practical recommendations for enhancing data protection systems in the banking sector.