This study examines the regulatory mandate governing the liability of E-Commerce service providers in protecting personal data in personal data processing according to Law Number 27 of 2022 and General Data Protection Regulation. To support the fulfillment of the rights of consumers as owners of personal data and E-Commerce service providers as controllers of personal data, it is necessary to study the regulation of the liability of E-Commerce service providers in protecting personal data in personal data processing in other countries that first have personal data protection arrangements. The research method used to achieve the research objectives and targets is normative legal research with a legislative and comparative approach. The type of research used in this research is normative juridical research that gathers primary data through the analysis of relevant legal regulations and also includes the use of supporting scholarly journals. E-Commerce Service Providers as Personal Data Managers Against Consumer Personal Data Processing in Europe, in principle, have the same form of personal data processing as Indonesia, namely processing of personal financial data, full name, gender, nationality, user location, and personal data combined to identify a person in the form of telephone numbers and IP Addresses. However, European countries have different types of personal data from the rules in Indonesia.