Digital Transformation Demands Enhanced Legal Accountability and Personal Data Protection

Illustration by AI

FORMOSA NEWS

Digital transformation across public and private institutions increases the processing intensity of personal data while simultaneously raising privacy violation risks. Recent research conducted by Dominicus Djoko Budi Susilo from Universitas Terbuka analyzes the legal construction of personal data protection and institutional legal accountability in the implementation of digital systems. Published in September 2026, this study emphasizes the importance of governance and consistent law enforcement to protect the rights of data subjects.

The digitalization of public services, banking, healthcare, and e-commerce undeniably creates high efficiency. However, these developments also trigger risks of unauthorized data processing, information leakage, and privacy violations. In Indonesia, the ratification of Law Number 27 of 2022 concerning Personal Data Protection (PDP Law) has provided a comprehensive legal framework. Nonetheless, written regulations alone are not enough to guarantee effective protection without clear legal obligations, supervisory mechanisms, and institutional accountability when violations occur.

This study employed a normative legal methodology utilizing legislative, conceptual, and comparative approaches. Primary and secondary legal materials were gathered through literature studies and analyzed qualitatively-prescriptively without involving respondents or informants.

The analysis revealed several key findings regarding personal data protection:

• Data protection effectiveness heavily depends on data controller compliance, processing security, clarity of legal obligations, and effective enforcement mechanisms.
• The PDP Law mandates every data controller to possess a lawful processing basis, such as explicit consent, agreement execution, or public interest.
• The utilization of third parties or cloud service vendors does not relieve the primary controller of legal responsibility regarding data security.
• When a data protection failure occurs, controllers are obliged to provide written notification no later than $3 \times 24$ hours to data subjects and authorized institutions.

Dominicus Djoko Budi Susilo asserts that personal data protection should not be viewed merely as a technical IT security issue, but rather as an institutional legal obligation that must be integrated starting from the system design stage (privacy by design). Both the government and the private sector need to strengthen risk governance, mitigation, and continuous compliance to ensure digital transformation develops in harmony with the protection of public privacy rights.

Author Profiles

• Full Name: Dominicus Djoko Budi Susilo, S.H., M.H.
• University Affiliation: Universitas Terbuka, Indonesia
• Fields of Expertise: Personal Data Protection Law, Contract Law, and Electronic Technology Law

Research Sources

• Journal Article Title: Personal Data Protection and Legal Accountability in the Digital Transformation of Public and Private Institutions
• Journal Name: International Journal of Integrated Science and Technology (IJIST)
• Publication Year: 2026
• DOI: https://doi.org/10.59890/ijist.v4i9.51
• Official URL: https://ntlmultitechpublisher.my.id/index.php/ijist