Safeguarding Personal Data Amidst Digital Transformation

Digital transformation has fundamentally altered societal life patterns. Various activities such as financial transactions, education, healthcare services, electronic commerce, and public services now depend on digital technology. This convenience is accompanied by the increased use of personal data as a primary requirement for accessing various services. Behind this ease, new problems emerge in the form of growing threats to personal data security. Data leaks, identity theft, digital fraud (phishing), misuse of personal information, and data trading without the owner’s consent are increasingly complex challenges. Various studies mention that personal data has now become a commodity with high economic value, thus requiring adequate legal and ethical protection. In Indonesia, the state has responded to these challenges through Law Number 27 of 2022 concerning Personal Data Protection (UU PDP). The presence of this regulation provides legal certainty regarding the rights of data owners, the obligations of data controllers, and sanctions for the misuse of personal data. However, the effectiveness of data protection depends not only on the existence of regulations but also on public awareness and the responsibility of all parties managing personal data. In Islam, all Sharia rules aim to realise benefit (jalb al-mashalih) and prevent harm (dar’ al-mafasid). This objective is known as maqashid shariah. According to the thought of Abu Ishaq al-Shatibi, maqashid shariah is oriented towards protecting five basic human needs (al-dharuriyyat al-khams), namely safeguarding religion (hifz al-din), life (hifz al-nafs), intellect (hifz al-’aql), progeny (hifz al-nasl), and property (hifz al-mal). Technological developments present new forms of benefit that were not known in the classical era, including the protection of personal data. Therefore, personal data protection is a tangible implementation of the principle of hifz al-mal. Furthermore, the misuse of personal data can also threaten honour (hifz al-’ird), personal safety (hifz al-nafs), and even social stability. The unauthorised dissemination of personal data can damage a person’s reputation, triggering digital bullying, blackmail, or defamation. Therefore, maintaining the security of personal data is part of the effort to uphold human dignity as taught in Islam. Islam places trust (amanah) as a fundamental value in social life. Personal data entrusted to an institution, company, or electronic system operator is a trust that must be guarded with full responsibility. Using data without the owner’s consent contradicts the principles of honesty, responsibility, and justice that form the basis of Islamic muamalah. Studies on Sharia fintech show that personal data protection is not only related to technological security aspects but is also an implementation of the principles of trust, consent (ridha), transparency, and the prohibition of actions that harm other parties. Therefore, every digital service provider is obliged to build an adequate security system so that user data is not misused. Although the UU PDP has been enacted, Indonesia still faces various challenges. Low digital literacy means some members of the public still easily share personal information via social media, untrusted links, or applications lacking adequate security systems. On the other hand, business actors are also required to improve cyber security standards to protect consumer data. Various legal studies state that personal data protection requires synergy between strong regulations, consistent law enforcement, technological readiness, and increased public awareness. Without such collaboration, the goal of data protection will be difficult to achieve optimally. From the perspective of maqashid shariah, personal data protection is part of the effort to build collective benefit. This benefit is realised not only through law enforcement but also through the formation of an ethical digital culture. The public needs to understand the importance of maintaining the confidentiality of personal data, using strong passwords, activating two-factor authentication, and not carelessly providing data to parties without a clear legal basis. On the other hand, the government must continue to strengthen the implementation of the UU PDP, while digital service providers must apply the principle of privacy by design.