This research examines the personal data breach case during the East Jakarta regional elections and analyzes the legal responsibilities of the General Elections Commission (KPU) from the perspective of Law Number 27 of 2022 concerning Personal Data Protection (PDP Law). Employing a juridical-normative method, statutory-regulatory approach, and conceptual framework, this study investigates the hacking incident involving the Permanent Voters List (DPT) database by a hacker using the pseudonym "Jimbo," who allegedly accessed data of more than 200 million voters. The case violates the principle of legal protection for citizens' privacy rights, as stipulated in the 1945 Constitution and the PDP Law. Within the framework of Satjipto Rahardjo's legal protection theory, personal data protection transcends mere legal norms and must be implemented substantially to ensure justice and public security. This research concludes that KPU's negligence in ensuring cybersecurity constitutes a legal violation and demands accountability alongside strengthened digital data protection policies within Indonesia's democratic system.