<![CDATA[The advancement of information and communication technology has significantly eroded traditional privacy boundaries, particularly within Indonesia’s rapidly growing e-commerce sector. The increasing volume and value of online transactions have intensified the collection and processing of consumer personal data, thereby amplifying legal and commercial risks at every stage of data processing. This study aims to analyze the forms of risks arising at each stage of personal data processing on e-commerce websites, as stipulated in Article 16 of Law No. 27 of 2022 on Personal Data Protection, while also identifying existing legal gaps in its implementation. This research adopts a normative juridical approach, employing library-based legal research focused on statutory and conceptual analysis. The findings demonstrate that distinct risks emerge across different stages of personal data processing, both prior to and following data storage by data controllers. Key risks include non-compliant data collection practices, lack of transparency, excessive and unlawful data collection, as well as unauthorized access, disclosure, modification, misuse, destruction, and loss of personal data. These risks are further exacerbated by ambiguities in regulatory provisions, particularly regarding consent standards, accountability mechanisms, and enforcement. This study contributes to the discourse in private and commercial law by offering a stage-based risk mapping of personal data processing within Indonesian e-commerce, highlighting specific regulatory shortcomings under the Personal Data Protection Law. It provides a nuanced understanding of how legal gaps translate into practical vulnerabilities for consumers. The research also proposes practical mitigation measures, including regular system updates and strengthening the capacity of human resources responsible for data processing, to enhance compliance and consumer data protection in Indonesia’s digital economy.]]>
