Using Indonesian laws and regulations as well as the perspective of the Civil Code on how personal data leaks, this study seeks to identify the types of legal protections against leakage of users' personal data from the EHAC digital application. This study uses normative legal research techniques. Primary, secondary, and tertiary legal materials are used to create legal materials after conducting a literature study that looks at laws, regulations, and all writings relevant to the research subject.

The findings of this study indicate that: First, legal protection for the disclosure of users' personal information through digital applications is regulated in Law Number 11 of 2019 concerning Amendments to Law Number 11 of 2008 concerning Information and Electronic Transactions, Government Regulation Number 71 of 2019 concerning Implementation of Electronic Systems and Transactions, as well as Regulation of the Minister of Communication and Information Technology Number 20 of 2016 concerning Protection of Personal Data in Electronic Systems, these arrangements provide repressive and preventive legal protection. However, these laws and regulations have not been able to fully protect the public from the leakage of personal information. A law that specifically regulates the protection of personal data is required. Second, because it violates the subjective rights of others, especially the right to privacy, which is a constitutionally guaranteed right of every citizen and is also a human right as stated in Article 29 of Law Number 39 of 1999 concerning Human Rights, the leakage of personal data can be considered as an unlawful act according to the definition of an unlawful act in the Civil Code as stated in Article 1365 of the Civil Code.