Personal data is a form of data that could be used to identify a person. With the rise of digital technology usage which runs parallel with personal data collection, personal data protection has become a necessity. Recently, a hacker under the alias Bjorka has successfully hacked into Indonesia-related institutions, such as Tokopedia, the State Intelligence Agency, and PeduliLindungi. As Indonesia has not had a law for personal data protection until September 2022, the laws and responsible authorities that could bring Bjorka to justice is in question. This research will be dedicated to figure out the government’s responsibility regarding each government agency’s authority and duty to capture him, and each electronic system operator’s due diligence. The research method applied in this research is the normative research method, where Indonesian positive law and non-judicial case study will be applied to analyze the problems asked in the research. In conclusion, government agencies i.e., Ministry of Communication and Information, the State Intelligence Agency, and the State Cyber and Code Agency have the duty and powers to work together to capture Bjorka. Second, the Ministry of Communication and Information are responsible to oversee the electronic system provider’s adherence to Indonesian regulation. Even without the law on personal data, Indonesia has proper legal grounds to capture Bjorka and for the government to assign responsibilities to all government agencies and electronic system operators.