The advancement of information and communication technology has made privacy boundaries thinner.  Various personal data on E-Commerce websites are increasingly easy to spread, which creates risks at every stage of personal data processing. This is important to be given further attention, given the high number of transaction valuations that occur through E-Commerce websites. This research aims to analyze what forms of risks can occur at each stage of personal data processing on E-Commerce websites. The stages of personal data processing described in this research are the stages of personal data processing as stipulated in Law Number 27 Year 2022 on Personal Data Protection. This research utilizes a library research method by focusing on legal materials so that it can be said to be library based. The results show that there are different risks at each stage of personal data processing on E-Commerce websites, both before the storage of personal data, and after the storage of personal data by the personal data controller.  This can be in the form of data collection that is not in accordance with applicable regulations, lack of transparency of data collection, and data collection that is not specific, unlimited, and illegal, unauthorized access, disclosure in an unauthorized manner, unauthorized modification, misuse, destruction, and loss of personal data on the system. To reduce the impact of risks, things that can be done are to update the system regularly, or increase the capacity of human resources who process personal data.

Unauthorized use of personal data can cause harm to personal data subjects. In its mandate, Decision Number 78/Pid.Sus/2024/PN Tng provides a general outline of the potential harm that may occur to personal data subjects. However, the decision does not specifically explain the forms of loss and its impact on personal data subjects. This research critically discusses the forms of crimes causing harm and their impact on personal data subjects' damage due to unauthorized use of personal data in Decision Number 78/Pid.Sus/2024/PN Tng. The research employs the Library Research method, also known as Legal Research, which focuses on analyzing primary and secondary legal materials based on existing literature. The findings indicate that several general regulations in Indonesia address the crime of unauthorized use of personal data, including Law Number 24 of 2013, Law Number 1 of 2024, Law Number 14 of 2008, and Law Number 27 of 2022. Meanwhile, Decision Number 78/Pid.Sus/2024/PN Tng outlines the damage to personal data subjects resulting from unauthorized use of personal data, with this study revealing various impacts of damage both materially and non-materially.