Implementing Law Number 27 of 2022 in Ensuring Personal Data Security on Digital Platforms (A Case Study of the Indonesian Sharia Bank Data Leak)

Abstract

Advances in information technology have driven the transformation of digital banking services, but have also increased the risk of personal data breaches. One case of concern is the cyberattack on Bank Syariah Indonesia (BSI) in 2023, which disrupted banking services and raised concerns about customer data security. This study aims to analyze the implementation of Law Number 27 of 2022 concerning Personal Data Protection in ensuring the security of customer personal data through a case study of Bank Syariah Indonesia. The study uses normative legal methods with legislative, conceptual, and case approaches, and is analyzed qualitatively based on primary, secondary, and tertiary legal materials. The results show that Law Number 27 of 2022 provides an adequate legal basis for personal data protection, but its implementation is suboptimal due to weak cybersecurity governance and oversight of electronic system providers. In this context, Law Number 1 of 2024 concerning Electronic Information and Transactions supports law enforcement against perpetrators of cyberattacks, thus complementing the implementation of personal data protection. Therefore, strengthening the implementation of Law Number 27 of 2022, supported by law enforcement under the Electronic Information and Transactions (ITE) Law, is a crucial step in improving personal data security in the digital banking sector.