ABSTRACT

This study examines the legal framework governing the identification of parties authorized to protect personal data after the death of a data subject. Although the Personal Data Protection Law (PDP Law) regulates the rights and obligations of data subjects, it does not explicitly address post-mortem data protection, there are no clear legal provisions governing who is authorized to manage such data, whether it should be retained, or whether it should be deleted. Some individuals may wish for their digital legacy to be erased after death, while others may prefer it to be managed by their family members. In the absence of clear regulations, the misuse and unauthorized disclosure of post-mortem personal data remain significant issues. This normative juridical research employs a comparative legal approach to analyze the alignment between the PDP Law and the Indonesian Civil Code with regulatory models in selected European Union countries and Singapore. The results indicate that Indonesia lacks a comprehensive legal basis for determining who is authorized to manage or represent personal data after death. This absence creates legal uncertainty and increases the risk of misuse of personal data. Accordingly, this study recommends the incorporation of explicit provisions within the PDP Law to clarify the designation of authorized parties, ensure legal certainty, and strengthen the overall framework of personal data protection in Indonesia.. 

KEYWORDS: Data Subject, Digital Legacy, Personal Data Protection, Post-Mortem, Specific Data.