This study employs an empirical legal research method with a qualitative descriptive approach. Data were gathered through interviews, observations, and literature reviews, then analyzed qualitatively via data reduction, data presentation, and conclusion drawing. The findings indicate that Telkomsel acts as the Personal Data Controller, as it determines the purposes and means of data processing and manages the customer database. PT Creative Widya Nusantara serves as an operational partner for marketing and customer registration, while PT Telkom Akses performs technical functions with limited data access. Personal data protection is implemented through mechanisms such as consent, self-uploading of identity data, data access restrictions, identity verification, fulfillment of rights regarding data correction and deletion, and the use of audit trails. The study’s novelty lies in its analysis of the division of legal responsibility between the Personal Data Controller and operational partners during telecommunications service registration. The effectiveness of data protection requires further strengthening through improved consent quality, periodic audits, data security training, and consumer education.
Copyrights © 2026