Administrative legal liability for data breaches: Securing the right to compensation in indonesia and the eu

The protection of personal data has become a fundamental concern in both legal theory and governance due to the exponential growth of digital ecosystems. With an emphasis on the right to compensation for impacted parties, this study critically evaluated Indonesia’s institutional and legal framework for handling breaches of personal data. The analysis, which employed doctrinal legal research methods, focused on the General Data Protection Regulation of the European Union, Government Regulation No. 71 of 2019, and the Personal Data Protection Law, specifically Article 82, which provides compensation for both material and non-material harm. The findings pointed to serious institutional shortcomings in Indonesia’s legal system. The 2020 Tokopedia data breach, which affected over 91 million users, serves as an example of the absence of institutional oversight and procedural clarity. Citing the applicability of administrative jurisdiction under the Law on Public Administration, the Central Jakarta District Court dismissed the case on jurisdictional grounds. On June 15, 2022, the Supreme Court subsequently affirmed this decision. Although compensation was prescribed in Article 58 of the Personal Data Protection Law, the mechanisms for implementing this provision have not yet been developed. On the other hand, the General Data Protection Regulation ensures that data subjects have effective remedies by requiring both administrative oversight through independent supervisory bodies and judicial access. The study concluded that Indonesia must harmonise public-private liability structures, codify explicit procedural remedies, and establish an empowered data protection authority.