The rapid growth in technology affects various aspects of social life in IndonesiaIndoneisa. Especially in improving the economy in Indonesia, technology and internet plays a huge role through online transaction known as e-commerce. Personal data is one of the requirements in order to be engaged in online activities. Thus, personal data should be protected. Every Indonesia citizens have the same rights for their personal data to be protected. Personal data is a personal information that is binding on a person themselves. However, from year to year cases on data protection in Indonesia increases through many forms of cyber crime, one of which is the leakage of personal data experienced by the users of Tokopedia. KKI then filed a lawsuit to the Central Jakarta District Court with the intention to fight for the rights of the Tokopedia users. KKI claimed Tokopedia violated several regulations that are listen in Article 14 paragraph (5) PP No. 71 of 2019 and Article 2 paragraph (2) letter f along with Article 28 letter c Permenkominfo No. 20 of 2016. This research used a normative method and uses statuary, case, and conceptual approach. In solving this case, Tokopedia have tried to fulfil of what is listed on both PP No. 71 of 2019 and Permenkominfo No.20 of 2016/ however, KKI and users still question Tokopedia’s form of responsibility and how they protect consumer’s personal data.