The Indonesian Government has legalized Law Number 11 of 2008 concerning Electronic Information and Transactions (and its amendments) (“ITE Law'') and Law Number 27 of 2022 concerning Personal Data Protection (“PDP Law”). These laws were established to protect privacy rights from cybercrimes such as doxing. Doxing is defined as the unlawful access and dissemination of information with bad faith towards the victims. This cybercrime can create significant losses for the victim due to their personal information being revealed. Despite doxing being regulated under the ITE Law and PDP Law, the enforcement of these rules and reparations for the victims are challenging. To uphold the constitutional rights of Indonesian citizens, this article addresses the regulation and implications of liability in doxing, as well as the restoration of rights for doxing victims. The research method used in this article is a normative juridical approach. Therefore, doxing is regulated as a prohibition on the misuse of personal data under the PDP Law. Furthermore, victims are entitled to receive reparations for such acts.