<![CDATA[The rapid growth of cybercrime poses significant threats to personal data security, with phishing emerging as one of the most common methods. Phishing involves tricking individuals into revealing confidential information, and a concerning development is the creation and sale of phishing links to facilitate personal data theft. This situation raises legal questions regarding the sufficiency of current regulations to address such acts. This study aims to examine the legal framework governing the buying and selling of phishing links and to assess law enforcement efforts in handling these activities. The research applies a normative juridical method, combining statutory and conceptual approaches, and relies on the analysis of legislation and relevant legal literature. The study finds that phishing link sellers may be prosecuted under Article 34 paragraph (1) letter a in conjunction with Article 50, as well as Article 35 in conjunction with Article 51 paragraph (1) of the ITE Law. Phishing link buyers can be charged under Article 28 paragraph (1) in conjunction with Article 45A paragraph (1) of the ITE Law and Article 65 paragraph (1) in conjunction with Article 67 paragraph (1) of the Personal Data Protection Law. Nonetheless, these provisions remain insufficient, as they do not explicitly regulate the sale of phishing links and leave room for multiple interpretations. Law enforcement involves preventive actions through public and institutional collaboration and repressive measures through the imposition of criminal penalties.]]>
