The Legal Responsibility of the General Elections Commission in the 2024 Election Data Leak

Indonesia’s transition to digital governance has amplified the urgency of personal data protection, especially following the 2024 General Election data leaks, which exposed over 204 million voter records. This study investigates the legal responsibility of the General Election Commission (KPU), as the institution mandated to organize general elections, under Law Number 27 of 2022 concerning Personal Data Protection (UU PDP) and Islamic legal doctrine, particularly the principle of sadd al-dharī‘at (preventing harm). This study uses normative legal research methods with statutory, conceptual, and comparative approaches. The study analyzes primary legal materials and comparative frameworks such as the General Data Protection Regulation (GDPR). The findings reveal that despite UU PDP’s existence, implementation remains weak due to inadequate digital infrastructure and limited institutional accountability. The research highlights a dual legal gap: insufficient positive law enforcement and underutilization of preventive Islamic principles. The novelty of this study lies in integrating sadd al-dharī‘at with UU PDP to offer a preventive legal solution that strengthens institutional data security. The implication suggests the urgency of harmonizing regulatory frameworks and enhancing legal awareness within electoral institutions to ensure public trust and uphold digital democracy.