PERSONAL DATA PROTECTION AS A LIMIT TO STATE AUTHORITY IN THE SUPERVISION OF THE BANKING SECTOR IN INDONESIA

Abstract

This study analyzes personal data protection as a legal limit to the exercise of state authority in the supervision of the banking sector in Indonesia. The issue arises because banking supervision may create a need to obtain customer information, while such information is closely related to the right to privacy, bank secrecy, and the trust-based relationship between banks and customers. This study focuses on two issues: how personal data protection limits state authority in banking supervision, and whether the regulatory framework and its implementation are consistent with the principle of the rule of law and the protection of customers' privacy rights. This study uses normative legal research with statutory and conceptual approaches. The findings show that state authority to supervise banks is legitimate, but it cannot be exercised without limits. Access to customer data must have a legal basis, be directed toward a lawful purpose, be limited to the necessary information, and be accompanied by the principles of proportionality, security, and accountability. Indonesian law has provided a normative basis through regulations on personal data protection, bank secrecy, financial services supervision, and electronic system security. However, implementation still requires clearer operational limits, stronger institutional coordination, and a strengthened role for personal data protection officers or officials. Therefore, personal data protection is not an obstacle to banking supervision, but a legal instrument that ensures state supervision remains within lawful and accountable limits.