Melola Discovery

← Melola Discovery

Open access Journal

Legal Gaps and Risks in Consumer Data Processing: An Analysis of Indonesian E-Commerce under the Personal Data Protection Law

Journal of Private and Commercial Law · Vol. 8 No. 2 (2024) · pp. 209–240

DOI
10.15294/jpcl.v8i2.20081
ISSN
2599-0306, 2599-0314
Published
2024-11-30
Publisher
Universitas Negeri Semarang
Language
eng
License
creativecommons.org/licenses/by-nc/4.0

Abstract

The advancement of information and communication technology has significantly eroded traditional privacy boundaries, particularly within Indonesia’s rapidly growing e-commerce sector. The increasing volume and value of online transactions have intensified the collection and processing of consumer personal data, thereby amplifying legal and commercial risks at every stage of data processing. This study aims to analyze the forms of risks arising at each stage of personal data processing on e-commerce websites, as stipulated in Article 16 of Law No. 27 of 2022 on Personal Data Protection, while also identifying existing legal gaps in its implementation. This research adopts a normative juridical approach, employing library-based legal research focused on statutory and conceptual analysis. The findings demonstrate that distinct risks emerge across different stages of personal data processing, both prior to and following data storage by data controllers. Key risks include non-compliant data collection practices, lack of transparency, excessive and unlawful data collection, as well as unauthorized access, disclosure, modification, misuse, destruction, and loss of personal data. These risks are further exacerbated by ambiguities in regulatory provisions, particularly regarding consent standards, accountability mechanisms, and enforcement. This study contributes to the discourse in private and commercial law by offering a stage-based risk mapping of personal data processing within Indonesian e-commerce, highlighting specific regulatory shortcomings under the Personal Data Protection Law. It provides a nuanced understanding of how legal gaps translate into practical vulnerabilities for consumers. The research also proposes practical mitigation measures, including regular system updates and strengthening the capacity of human resources responsible for data processing, to enhance compliance and consumer data protection in Indonesia’s digital economy.

Keywords

Collaboration network of the authors

40 authors · 129 co-authorship links · showing the 40 most connected

Hover or tap a name to highlight its co-authors. Double-click to open the author's page.

  • Affiliation unknown
  • Different organisations
  • Same organisation
  • Affiliation unknown
  • Thicker line = more joint articles · bigger circle = more articles
Show as table
Co-authorOrganisationJoint articles
Nurul FibriantiAffiliation unknown12
Ridwan ArifinAffiliation unknown4
Niken Diah ParamitaAffiliation unknown3
Mohammad Raziq FakhrullahAffiliation unknown3
Asmarani RamliAffiliation unknown3
Akbar Jihadul IslamAffiliation unknown2
Abdullah Mufti Abdul RahmanAffiliation unknown2
Aprila NiravitaAffiliation unknown2
Rio Taufik AnsoriAffiliation unknown2
Saniya PuspitasariAffiliation unknown2
Vira AzraAffiliation unknown2
Natasya Fitri DewantiAffiliation unknown2
Salisa Widyaning KinasihAffiliation unknown2
Siti Hafsyah IdrisAffiliation unknown2
Ali MasyharAffiliation unknown2
Moh SamanAffiliation unknown2
Diyah Anggun FebriyantiAffiliation unknown2
Bayyinatun AfifahAffiliation unknown2
Chatila MaharaniAffiliation unknown2
Maylia Pramono SariAffiliation unknown2
Anisa Okta VianaAffiliation unknown2
Martitah MartitahAffiliation unknown2
Rizky Andeza PrasetyaAffiliation unknown2
Sergi Fernandez AlejandroAffiliation unknown2
Rahayu Fery AnitasariAffiliation unknown1
TRI ANDARI DAHLANAffiliation unknown1
Ketut Elly SutrisniAffiliation unknown1
I Gede Agus KurniawanAffiliation unknown1
Anak Agung Ayu Ngurah Sri Rahayu GordaAffiliation unknown1
Princess Alyssa Tee-anastacioAffiliation unknown1
R Benny RiyantoAffiliation unknown1
Adnan Ibrahim SarhanAffiliation unknown1
Irawaty IrawatyAffiliation unknown1

Affiliations come from OpenAlex; journal OAI-PMH metadata carries none. Authors without an OpenAlex ID are matched by name, which can merge or split people.

Metadata source: OAI-PMH (metadata jurnal) https://journal.unnes.ac.id/journals/jpcl/oai, first harvested 6 Nov 2026, last seen 8 Nov 2026.
Original metadata (oai_dc) 
<oai_dc:dc xmlns="http://www.openarchives.org/OAI/2.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:oai_dc="http://www.openarchives.org/OAI/2.0/oai_dc/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.openarchives.org/OAI/2.0/oai_dc/  http://www.openarchives.org/OAI/2.0/oai_dc.xsd">
	<dc:title xml:lang="en">Legal Gaps and Risks in Consumer Data Processing: An Analysis of Indonesian E-Commerce under the Personal Data Protection Law</dc:title>
	<dc:creator xml:lang="en">Putra, Tegar Islami</dc:creator>
	<dc:creator xml:lang="en">Fakhis, Adinda Zeranica Putri </dc:creator>
	<dc:creator xml:lang="en">Tussaleha, Anisa</dc:creator>
	<dc:creator xml:lang="en">Firdhausya, Mahima Umaela</dc:creator>
	<dc:creator xml:lang="en">Aflah, Muhammad Hilmi Naufal</dc:creator>
	<dc:creator xml:lang="en">Ezzerouali, Souad Ahmed</dc:creator>
	<dc:creator xml:lang="en">Banane, Mohamed Cheick</dc:creator>
	<dc:subject xml:lang="en">Personal Data Protection</dc:subject>
	<dc:subject xml:lang="en">E-Commerce</dc:subject>
	<dc:subject xml:lang="en">Data Processing Risks</dc:subject>
	<dc:subject xml:lang="en">Indonesian Law</dc:subject>
	<dc:subject xml:lang="en">Consumer Privacy</dc:subject>
	<dc:description xml:lang="en">The advancement of information and communication technology has significantly eroded traditional privacy boundaries, particularly within Indonesia’s rapidly growing e-commerce sector. The increasing volume and value of online transactions have intensified the collection and processing of consumer personal data, thereby amplifying legal and commercial risks at every stage of data processing. This study aims to analyze the forms of risks arising at each stage of personal data processing on e-commerce websites, as stipulated in Article 16 of Law No. 27 of 2022 on Personal Data Protection, while also identifying existing legal gaps in its implementation. This research adopts a normative juridical approach, employing library-based legal research focused on statutory and conceptual analysis. The findings demonstrate that distinct risks emerge across different stages of personal data processing, both prior to and following data storage by data controllers. Key risks include non-compliant data collection practices, lack of transparency, excessive and unlawful data collection, as well as unauthorized access, disclosure, modification, misuse, destruction, and loss of personal data. These risks are further exacerbated by ambiguities in regulatory provisions, particularly regarding consent standards, accountability mechanisms, and enforcement. This study contributes to the discourse in private and commercial law by offering a stage-based risk mapping of personal data processing within Indonesian e-commerce, highlighting specific regulatory shortcomings under the Personal Data Protection Law. It provides a nuanced understanding of how legal gaps translate into practical vulnerabilities for consumers. The research also proposes practical mitigation measures, including regular system updates and strengthening the capacity of human resources responsible for data processing, to enhance compliance and consumer data protection in Indonesia’s digital economy.</dc:description>
	<dc:publisher xml:lang="en">Universitas Negeri Semarang</dc:publisher>
	<dc:date>2024-11-30</dc:date>
	<dc:type>info:eu-repo/semantics/article</dc:type>
	<dc:type>info:eu-repo/semantics/publishedVersion</dc:type>
	<dc:type xml:lang="en">Peer-reviewed Article</dc:type>
	<dc:format>application/pdf</dc:format>
	<dc:identifier>https://journal.unnes.ac.id/journals/jpcl/article/view/20081</dc:identifier>
	<dc:identifier>10.15294/jpcl.v8i2.20081</dc:identifier>
	<dc:source xml:lang="en">Journal of Private and Commercial Law; Vol. 8 No. 2 (2024): November, 2024; 209-240</dc:source>
	<dc:source>2599-0306</dc:source>
	<dc:source>2599-0314</dc:source>
	<dc:language>eng</dc:language>
	<dc:relation>https://journal.unnes.ac.id/journals/jpcl/article/view/20081/3828</dc:relation>
	<dc:rights xml:lang="en">Copyright (c) 2024 Tegar Islami Putra, Adinda Zeranica Putri Fakhis, Anisa Tussaleha, Mahima Umaela Firdhausya,  Muhammad Hilmi Naufal Aflah, Souad Ahmed Ezzerouali, Mohamed Cheick Banane (Author)</dc:rights>
	<dc:rights xml:lang="en">https://creativecommons.org/licenses/by-nc/4.0</dc:rights>
</oai_dc:dc>