<![CDATA[The constitutional guarantee of privacy under Article 28G of the 1945 Constitution obliges the Indonesian state to construct an effective legal and institutional framework for personal data protection, particularly amid the rapid expansion of electronic commerce and digital economic activity. Prior to the enactment of Law Number 27 of 2022 on Personal Data Protection, Indonesia’s regulatory regime was characterized by fragmented sectoral provisions that weakened supervisory coordination and limited enforcement consistency. Employing normative legal research through statute and conceptual approaches, this study examines the legal policy underlying the formation and enforcement architecture of personal data protection law. The analysis demonstrates that although Law Number 27 of 2022 consolidates substantive obligations for Personal Data Controllers and aligns Indonesia with internationally recognized data protection principles, structural challenges remain within its institutional design, especially concerning supervisory independence and enforcement capacity. Comparative evaluation with Singapore and Malaysia indicates that effective data protection depends not merely on statutory harmonization but on institutional autonomy and operational clarity. The study concludes that the realization of constitutional privacy rights in Indonesia ultimately requires sustained political commitment to institutional consolidation and consistent enforcement within the evolving digital governance landscape.]]>
