Personal Data Protection in ASEAN: A Critical Comparison between Indonesia's and Malaysia's Legal Frameworks

The development of digital technology presents significant challenges in personal data protection amid globalization and cross-border data exchange. This study compares Indonesia’s Personal Data Protection Act (UU PDP) and Malaysia’s Personal Data Protection Act (PDPA) 2010 from a normative and doctrinal legal perspective. Using a comparative legal approach through literature review, this research analyzes data subject rights, application mechanisms, supervisory structures, and enforcement and sanctioning mechanisms in both jurisdictions. The findings indicate that Indonesia’s UU PDP is more comprehensive as it covers both the public and private sectors, regulates formal procedures for data access, correction, deletion, and consent withdrawal, and is supported by strict administrative and criminal sanctions. In contrast, Malaysia’s PDPA applies only to commercial transactions, relying on lighter administrative sanctions, potentially leaving gaps in public sector data protection. Both countries also face challenges regarding the independence of supervisory bodies. This study highlights the need for institutional reforms and regulatory adjustments in line with international standards to enhance transparency, accountability, and legal certainty in personal data protection across ASEAN