In this modern era of technology, many people have relied heavily on electronic commerce (e-commerce) to make purchases for daily life needs. People in Indonesia generally buy their needs in a specific type of e-commerce, which is called online marketplace that uses mobile applications (apps) as their platform, such as Tokopedia, Bukalapak, and Shopee. By the law of Indonesia, those companies are called private electronic system operators. To be able to use their platform, user candidate must provide certain private data to the electronic system operators. Private data of users that are collected will be stored and processed by electronic system operators after the users gave their consent. And while those apps help the public to make purchases easier, it also contains a few risks of violations of user privacy rights, for example: hacking, data leakage, and the misuse of private data. Data leakage is the most popular one in Indonesia. In the events of these violations, the government and electronic system operators must act accordingly to the law, that includes an investigation, supervision, sanction, and providing legal responsibility to the victims. Unfortunately, these chains of actions aren’t always done properly, many cases of data leakage in Indonesia only ends in investigation phase without providing proper legal responsibility to the victims. In this study, the author will examine the practice of legal responsibility by the electronic system operator regarding the leakage of personal data reviewed based on the dignified justice theory. This study uses normative legal research method with library study data collection as the method of research. The results of this study found that: First, the legal regulations regarding data protection related personal data leakage are contained in five different regulations and while the articles are well versed and clear, there is still some flaws in its regulation, especially in the context of the regulation of legal responsibility for data leakage by electronic system providers. Second, the practice of legal responsibility by the electronic system operator regarding the leakage of personal data in Indonesia does not reflect the essence of the dignified justice theory, because of the lack of detailed regulations regarding compensation for the victims, and poor performance from the government in regards of enforcing the law. In conclusion, the regulations of personal data protection have already been set well and clear, although it’s still divided in many regulation acts, but unfortunately the inherent rights of human for privacy are not fulfilled, therefore the practice of legal responsibility by electronic system operators related to leakage of personal data does not reflect a dignified justice for the public.