Establishing a Personal Data Protection Agency for E-Commerce in Indonesia: Legal Framework and Implementation Challenges

Abstract

The rapid growth of e-commerce in Indonesia has led to a significant increase in the collection and processing of personal data, raising concerns regarding data security and privacy rights. This study analyzes the urgency of establishing a Personal Data Protection Agency (LPDP) specifically for e-commerce users in Indonesia, considering the increasing risks to personal data in the digital marketplace. This research focuses on addressing the limitations of the current legal framework, particularly the gaps in the Indonesian Personal Data Protection Law (UU No. 27 of 2022), and proposes an independent body with clear authority to regulate, monitor, and enforce data protection standards. This study employs a qualitative approach using normative legal analysis to evaluate existing regulations and assess the evolving needs of the e-commerce sector. The findings suggest that the absence of detailed implementation regulations and lack of a specific regulatory body create significant legal uncertainties, exposing users to potential data breaches. Establishing the LPDP is expected to strengthen data protection measures, enhance consumer trust, and provide legal certainty in Indonesia's digital economy. The proposed structure of the LPDP includes directorates for policy and regulation, supervision and audits, law enforcement, and public education and awareness. The implementation of effective personal data protection policies requires a comprehensive and coordinated approach, with the LPDP having sufficient authority and resources to perform its duties. This study highlights the importance of establishing an independent regulatory body to ensure the protection of personal data and privacy rights in Indonesia's rapidly expanding e-commerce sector.

Keywords

• personal data protection
• e-commerce
• legal framework