The increase in internet usage across various sectors has engendered threats to the security of personal data. The Law No. 27 of 2022 concerning Personal Data Protection (PDP Law) currently lacks implementing regulations that govern the technical aspects of personal data protection. This research aims to examine the background of the establishment of the PDP Law and the regulation of criminal sanctions as a means to combat data breaches and the illegal use of personal data. The research employs a normative legal method utilizing Legislative, Conceptual, and Comparative Approaches. The legal theories applied as analytical tools include the theory of legal purposes, the theory of legal protection, and the theory of progressive law. The findings indicate that personal data constitutes a component of Human Rights that must be protected; thus, the type of offense applicable is a complaint offense, specifically a relative complaint offense. This implies that victims who feel aggrieved are entitled to report by demonstrating the existence of both material and immaterial losses incurred due to the perpetrator's actions. Therefore, it is essential to clarify the provisions regarding relative complaint offenses (Klacht Delict) and the potential application of restorative justice as an alternative dispute resolution mechanism aimed at peacefully restoring harmony in life, with the understanding that criminal sanctions under the PDP Law serve as ultimum remedium. This denotes that criminal sanctions are intended solely as a last resort in the enforcement of the PDP Law.