The use and utilization of technology are growing during the COVID-19 pandemic. In the use of information technology, the protection of personal data is part of the personal right and therefore, the state is obliged to fulfill such rights. In Indonesia, there is a legal vacuum related to the rules on the protection of personal data. To fulfill personal rights, the step that can be taken is to make specific rules regarding the protection of personal data and consider the establishment of an independent authority as a comprehensive supervisor of the protection of personal data to ensure the effectiveness and efficiency of the implementation of the PDP Act. The method used in this study is juridical normative with a statutory, case, conceptual, and comparative approach.