The regulation of personal data protection that is scattered in several instruments of legislation has the potential to cause confusion in the community regarding the legal protection of their privacy rights and personal data. As a form of legal progressivity, the Personal Data Protection Law was enacted in 2022 as a lex specialis that regulates the protection of personal data. Tokopedia, which is one of the e-commerce companies that experienced a personal data leak in 2020, made several changes to its privacy policy after the case. Against this, this research is intended to examine the privacy policy arrangements in Indonesia and analyze the suitability of Tokopedia's privacy policy with the Personal Data Protection Law. The research method used is normative legal research, which includes written regulations and certain codifications so that the research requires secondary data to support the source of the research. The results show that the regulation of e- commerce privacy policies is contained in several laws and regulations one of which is Personal Data Protection Law. When viewed from the Personal Data Protection Law, there is non-compliance with Article 16 paragraph (2) of the Personal Data Protection Law related to the principle of responsibility in processing personal data.