The misuse of personal data provided for limited purposes, demonstrates a systemic vulnerability in legal protection for victims. Based on an analysis of the Nganjuk District Court Decision Number 240/Pid.Sus/2025/PN.NJK, this research identifies a normative gap between the preventive mechanisms regulated in Law Number 27 of 2022 concerning Personal Data Protection (PDP Law) and judicial practices that remain repressive-formal in nature. The judge only imposed criminal sanctions without ordering restitution or recovery measures for the victims, despite proven immaterial losses and financial risks. The key finding of the study indicates that a restorative approach—which positions victims as the primary subjects of their constitutional rights restoration—has not been adopted in the implementation of the PDP Law at the court level. The novelty of this research lies in its specific critique of the judge’s failure to apply victim recovery mechanisms despite the normative guarantees in the PDP Law, thereby emphasizing the disparity between the theory of personal data protection law and its enforcement practice.
Copyrights © 2025