Deepfake is a hyper-realistic video that applies AI to depict a person saying and doing things that never happened using face-swapping that leaves little trace of evidence that the video was manipulated. Deepfake is a product of AI that combines, stitches, replaces and superimposes images and video clips to make a fake video look like it's real, and the video is said by the person when in reality the person whose face is replaced in the video never said or acted that way. The legal issue that arises from Deepfake is misinformation, disinformation and fraud, so there needs to be a law governing Deepfake, where in the European Union, regulations related to Deepfake are indirectly contained in the General Data Protection Regulation (GDPR), and in Indonesia itself there is Law Number 27 of 2022 concerning Personal Data Protection. (PDP Law). The protection of data given by both laws are directed towards the data subjects of respective countries.The formulation of the problem to be studied is how the legal protection of AI Deepfake in terms of GDPR, and the PDP Law. The research method used here is normative, where positive law in Indonesia and in the European Union will be used to analyze. In conclusion, Deepfake is not specifically regulated in either the PDP Law or GDPR, but because AI uses data to develop, the PDP Law and GDPR can still be relevant and can regulate to a certain degree regarding AI.