The development of electronic commerce (e-commerce) in Indonesia has provided various conveniences in digital trade activities, however on the other hand has also created legal concerning the protection of consumers’ personal data. The increasing number of cases involving personal data breaches and theft on e-commerce platforms indicates that consumer data security has not been optimally protected. This research aims to analyze the forms of legal protection available for victims of personal data theft in e-commerce transactions and the legal aspects thereof remedies that victims may pursue legal certainty and compensation. This research adopts a normative juridical approach method using statute-based and conceptual approaches. The results indicate that legal protection for personal data has been regulated under Law Number 27 of 2022 concerning Personal Data Protection, Law Number 1 of 2024 concerning the Second Amendment to the Electronic Information and Transactions Law, and other related consumer protection regulations. However, in practice, several obstacles remain, including weak security systems on e-commerce platforms, the existence of exoneration clauses, and the lack of public understanding regarding available legal remedies. Victims may pursue both litigation and non-litigation remedies, such as filing complaints with the Consumer Dispute Settlement Agency (BPSK), initiating civil lawsuits, reporting criminal acts, or submitting complaints to relevant supervisory institutions.