<![CDATA[This paper explores the legal friction between user consent and data collection practices, investigating whether the current Indonesian legal landscape provides sufficient safeguards for AI chatbot users. It employs a comparative legal analysis to evaluate the regulatory alignment between the Indonesian PDP Law and the EU GDPR, specifically regarding the protection of sensitive data. The analysis reveals that while the two regulations share foundational data protection principles, the PDP Law lacks necessary specificity regarding the definition and processing of sensitive data, risk assessment mechanisms, and the authority of supervisory bodies. The first analysis elucidates how these regulatory gaps hinder the PDP Law’s ability to effectively govern AI-based environments and establish accountability for data controllers and processors. Subsequently, the second analysis proposes necessary reforms, including more robust governance mechanisms, strengthened administrative oversight, and industry-specific guidelines to ensure uniform enforcement. This paper concludes that the PDP Law requires substantive refinement to remain effective and responsive to the rapid evolution of AI and automated systems.]]>
Copyrights © 2026
