Efforts to protect consumers' personal data on e-commerce platforms can be carried out by conducting a Data Protection Impact Assessment. This article discusses the indicators of the execution of Data Protection Impact Assessment by pivoting on the rights of personal data subjects based on Law Number 27 of 2022.  This research uses a library research method by focusing on legal materials so that it can be said to be library based. The results show that Data Protection Impact Assessment is explained in Article 34 paragraph (1) of Law Number 27 of 2022 concerning Personal Data Protection which is then further regulated through Government Regulations as mandated by Article 34 paragraph (3). However, the Government Regulation relating to this matter has not yet been ratified, so it still refers to the mandate of Law Number 27 of 2022. This Data Protection Impact Assessment indicator can refer to Article 16 paragraph (2), Article 34 paragraph (1) and (2), Article 35, Article 20 paragraph (2), and Article 27 of Law Number 27 Year 2022. In terms of Data Protection Impact Assessment indicators as the protection of consumer personal data on e-commerce platforms, it can refer to the mandate that explains the rights of personal data subjects and their limitations in a separate article and the form of personal data processing as mandated by Article 34 paragraph (2) of Law No. 27 of 2022.

Unauthorized use of personal data can cause harm to personal data subjects. In its mandate, Decision Number 78/Pid.Sus/2024/PN Tng provides a general outline of the potential harm that may occur to personal data subjects. However, the decision does not specifically explain the forms of loss and its impact on personal data subjects. This research critically discusses the forms of crimes causing harm and their impact on personal data subjects' damage due to unauthorized use of personal data in Decision Number 78/Pid.Sus/2024/PN Tng. The research employs the Library Research method, also known as Legal Research, which focuses on analyzing primary and secondary legal materials based on existing literature. The findings indicate that several general regulations in Indonesia address the crime of unauthorized use of personal data, including Law Number 24 of 2013, Law Number 1 of 2024, Law Number 14 of 2008, and Law Number 27 of 2022. Meanwhile, Decision Number 78/Pid.Sus/2024/PN Tng outlines the damage to personal data subjects resulting from unauthorized use of personal data, with this study revealing various impacts of damage both materially and non-materially.