The development of information and communication technology has brought significant changes to society, particularly in the collection, processing, and dissemination of personal data. On the one hand, digital advancement provides convenience in various activities; however, on the other hand, it also poses risks of personal data misuse. Indonesia, as a state based on the rule of law, has responded to these developments by establishing personal data protection policies as stipulated in Law Number 27 of 2022 concerning Personal Data Protection. This article examines the legal politics of personal data protection in Indonesia, particularly focusing on the background of its formation, the direction of legal policy adopted by the state, and the challenges in its implementation. The findings indicate that the enactment of the Personal Data Protection Law reflects the state's commitment to providing legal certainty and protecting citizens’ privacy rights. However, its effectiveness is still influenced by institutional readiness, law enforcement, and the low level of public awareness regarding personal data protection.