LEGAL LIABILITY OF BUSINESS ENTITIES FOR VIOLATIONS OF CONSUMER PERSONAL DATA PROTECTION IN DIGITAL TRANSACTIONS IN INDONESIA: A LITERATURE REVIEW ON LEGAL CERTAINTY AND COMPENSATION MECHANISMS

The processing of personal data in digital transactions gives rise to a need for clarity regarding the liability of business operators and redress mechanisms for consumers who have suffered breaches. This study aims to analyse the legal certainty of business operators’ liability for breaches of consumer personal data protection, as well as redress mechanisms in digital transactions in Indonesia. The method employed is normative legal research through a literature review using a legislative and conceptual approach. Primary and secondary legal sources were analysed qualitatively through inventory, systematic interpretation and synthesis. The findings indicate that Law No. 27 of 2022 on the Protection of Personal Data and Law No. 8 of 1999 on Consumer Protection provide a normative foundation for business operators’ liability and the redress of consumer rights. Legal certainty requires clarity regarding the status of business operators as data controllers or processors, the basis for processing, security obligations, and the consequences of breaches. Redress mechanisms may be pursued through direct claims for redress, out-of-court settlements, or legal action in court in accordance with applicable jurisdiction and provisions. However, the implementation of remedies faces challenges regarding the identification of the liable party, access to evidence, proving a causal link, and the assessment of damages. This study concludes that clarity regarding liability norms must be linked to enforceable redress procedures. Strengthening consumer protection requires clarity on the forum for resolution, proportionate access to evidence, guidelines for assessing damages, and the enforcement of dispute resolution outcomes.