<![CDATA[The aim of this study is to examine the strength of legal protection for Tokopedia customers' personal data following the leak of 91 million accounts in May 2020, as well as to explain Tokopedia's obligations and responsibilities as a data controller under PDP Law 27/2022, UUPK 8/1999, ITE Law 11/2008, PP 71/2019, and the breach of contract provisions of Article 1234 of the Civil Code. This study uses a normative legal approach, which involves examining written regulations through laws, scientific journals, and official reports from the Ministry of Communication and Information Technology, then analyzing them conceptually and comparing them to assess legal certainty, fairness, and benefits for the community. The novelty of this research lies in combining classical civil law (breach of contract in the Civil Code) with new regulations in the PDP Law to assess Tokopedia's responsibility as a private PSE in the case of the leak of 91 million accounts, something that is still rarely discussed comprehensively in Indonesian literature. The results of the study show that the rules on personal data protection are actually quite strong on paper, but their implementation is still weak because Tokopedia has not maximized its assessment of data protection, encryption, and incident reporting; the public's level of understanding of their personal data rights is still low; and the government's response has only been in the form of warnings, so there is still the possibility of administrative sanctions, fines, or criminal penalties being imposed based on the PDP Law and the ITE Law. The conclusion of the study emphasizes the need to strengthen personal data protection through mandatory information security standards such as ISO 27001, the application of the principle of privacy by design from the outset of system design, the provision of features (dashboards) for rapid data deletion, increased public education, and better coordination between Kominfo, OJK, and the PDP Council so that e-commerce transactions in Indonesia are safer for hundreds of millions of users.]]>
