Legal Protection for Investors’ Personal Data Against Cybercrime Threats in Capital Market Based on IOSCO Principles

The increasing threat of cybercrime, particularly in the capital market sector, poses a serious risk to investors' personal data protection in Indonesia. This challenge requires a robust and adaptive regulatory approach to maintain trust and security within the capital market. As a member of IOSCO, Indonesia has access to principles designed to protect investors and minimize cyber risks. This study employs a normative juridical method using secondary data in the form of primary and secondary legal materials to examine the effectiveness of IOSCO principles in national law. The study’s findings indicate that IOSCO applies 38 principles forming a policy framework for investor protection through preventive and educational efforts for its member countries. However, although Indonesia’s positive law has established a framework for personal data protection, certain aspects of IOSCO principles remain unaccommodated, particularly in terms of oversight and cyber risk management. Therefore, the establishment of a Personal Data Protection Supervisory Body in Indonesia is essential to enhance investor protection and ensure functional harmonization alongside the Indonesia Financial Services Authority.