Advances in digital technology in the insurance industry have triggered an increase in the processing of customers' personal data, which on the other hand also poses a potential risk of data leaks. This study seeks to examine the forms of protection for PT Asuransi Allianz Life customer data based on Law Number 27 of 2022 concerning Personal Data Protection (PDP Law), as well as reviewing legal responsibility for incidents of personal data leaks involving individuals and business entities. The methods applied are normative legal research with a legislative approach and case studies. The study findings indicate that PT Asuransi Allianz Life has implemented legal protection through a privacy notice on the official Allianz website, which contains its designation as a data controller, the determination of data purposes and processing, and information security in accordance with the provisions of the PDP Law. However, the data breach experienced by Dara Arafah indicates that this protection is not yet fully effective, especially in terms of supervision of third parties. In conclusion, normatively, PT Asuransi Allianz Life has complied with applicable regulations, but the reality on the ground is not yet fully compliant. This study confirms that legal responsibility for data leaks is not only borne by the individual perpetrator but can also be imposed on corporations in the form of criminal, administrative, or civil sanctions if they are proven to be involved. In addition, POJK Number 6/POJK.07/2022 further strengthens legal protection in the financial services sector.