<![CDATA[This article examines the legal regulation of phishing crimes conducted via WhatsApp in Indonesia and evaluates the relevance of the General Data Protection Regulation (GDPR) as a normative model for strengthening personal data protection. Although Indonesia has established a legal framework through the Criminal Code, the Electronic Information and Transactions Law, and Law Number 27 of 2022 on Personal Data Protection, these instruments do not specifically regulate preventive mechanisms, data controller obligations, or victim remedies for phishing based on social engineering. This study employs a normative juridical method using statutory, conceptual, and case approaches, including an analysis of the Pekanbaru District Court Decision Number 958/Pid.Sus/2020/PN.Pbr. The findings indicate that Indonesia’s regulatory framework remains fragmented and predominantly punitive, limiting its effectiveness in addressing evolving digital phishing practices. In contrast, the GDPR provides a more preventive and accountable model through mandatory risk assessments, the appointment of Data Protection Officers, data breach notification requirements, and independent supervisory authorities. The novelty of this study lies in identifying regulatory gaps within Indonesian law and proposing a GDPR-based normative framework to enhance personal data protection against WhatsApp-based phishing crimes.]]>
Copyrights © 2025
