<![CDATA[The rapid advancement of digital technology has enabled seamless global communication, yet it simultaneously heightens the risk of personal data breaches. A salient example is the Facebook data incidents between 2018 and 2021 which affected millions of Indonesian users and revealed systemic weaknesses in data governance. Earlier regulatory instruments, particularly the Information and Electronic Transactions Law (UU ITE), provided limited remedies and made accountability for data controllers difficult to enforce. This study examines legal protections for personal data and the legal liability of Meta through a normative juridical method integrating statutory, conceptual, and case-based analyses using descriptive secondary data. The analysis focuses on key provisions of the Personal Data Protection Law, including Article 17, which guarantees data subject rights to access, correct, and delete their data; Article 18, which obliges controllers to implement adequate security measures to prevent breaches; Article 58, which establishes supervisory authorities to ensure compliance; and Article 75, which imposes administrative sanctions as a deterrent. These provisions collectively strengthen legal certainty for victims and address deficiencies in prior regulations by compelling global digital platforms to adopt higher compliance standards. In conclusion, the Personal Data Protection Law constructs a comprehensive protection regime by affirming user rights and enforcing sanctions effectively.]]>
