Criminal Liability of Cybercrime Perpetrators from the Perspective of Personal Data Protection

Abstract

The expansion of digital technologies has increased the collection, processing, and circulation of personal data while creating new forms of cybercrime and challenges to privacy. This study aims to analyze criminal liability for cybercrime perpetrators from the perspective of personal data protection in Indonesia, particularly involving unlawful acquisition, disclosure, and use of personal data. The research employs normative juridical legal research using statutory, conceptual, and case approaches. Primary legal materials include Law No. 27 of 2022 concerning Personal Data Protection, Law No. 1 of 2024 concerning amendments to the Electronic Information and Transactions Law, relevant criminal-law provisions, and judicial decisions. The findings demonstrate that Indonesian law provides a stronger basis for criminal accountability, but liability cannot be established solely from the occurrence of a data breach. It requires precise attribution of unlawful conduct, legally relevant culpability, reliable electronic evidence, and differentiation between individual perpetrators, corporations, and electronic-system providers. The study concludes that personal data protection requires integration of criminal law, cybercrime regulation, corporate liability, and digital evidence. Its contribution lies in proposing an analytical framework for strengthening criminal accountability while maintaining legality, culpability, procedural fairness, and protection of data-subject rights.