<![CDATA[Introduction:Personal data protection has been implemented in criminal law policies, but data breaches still occur. This demonstrates the weaknesses of Indonesian criminal law, which still require reform to protect public data security. Purposes of the Research: This study aims to analyze criminal law policies regarding the crime of hacking personal data now and in the future. Methods of the Research: The method used is a normative juridical method with a statutory, conceptual, and case-based approach. The legal sources consist of primary, secondary, and tertiary legal materials. The legal material collection procedure is carried out using a literature study method, and the processing and analysis of legal materials are carried out qualitatively. Results / Findings / Novelty of the Research: The research findings show that current criminal law policy regarding personal data hacking lies in its substance or legal provisions, technology, and law enforcement. In terms of substance or legal provisions, the current Personal Data Protection Law (Law No. 27 of 2022) focuses more on individual personal data, such as identity data, financial data, and health data. In terms of technology, the current Personal Data Protection Law does not specifically regulate the use of personal data in the context of Artificial Intelligence (AI) technology, focusing on the analysis of data collected by IoT. In terms of law enforcement, the current Personal Data Protection Law still faces several challenges, such as a lack of detail in derivative regulations and the absence of a specific authority for data protection. Further research indicates that future criminal law policy regarding personal data hacking lies in its substance or legal provisions, technology, and law enforcement. The future Personal Data Protection Law will be more comprehensive. In terms of technology, the strengthening and expansion of the use of personal data in the context of AI technology focuses on the analysis of data collected by IoT, and its law enforcement will emphasize sanctions against perpetrators of personal data hacking.]]>
