Pertanggungjawaban Pidana Korporasi atas Kebocoran Data Pribadi Konsumen di Indonesia

Corporate Criminal Liability for Consumer Personal Data Breaches in Indonesia

Abstract

A consumer data breach does not, by itself, establish a corporation's criminal liability. This article asks when unlawful acquisition, disclosure, use, or falsification of personal data can be attributed to an electronic system operator under Indonesia's Personal Data Protection Law (PDP Law), Criminal Code, and rules on corporate criminal proceedings. It applies doctrinal legal research, combining textual and systematic interpretation with a limited functional comparison to a judgment of the Court of Justice of the European Union. The proposed sequence first tests the elements of a specific offence, then the actor's connection with the corporation, and finally the statutory grounds for corporate responsibility. A failure to secure data or notify data subjects may warrant an administrative response and provide relevant context, but it cannot replace proof of the intentional and unlawful conduct required by Articles 67 and 68 of the PDP Law. The respective roles of controllers, processors, managers, and outside attackers must be established from actual control and evidence of decisions. Sanctions require a distinction between administrative and criminal fines, attention to the criminal law adjustments effective in 2026, and remedies that remain useful to affected people. The framework is a doctrinal proposal, not an empirical finding about prosecution outcomes.