Information in the form of personal data is inevitable with internet-based applications. Legal protection of personal data is important to protect a person's right to privacy. A hacker named "Bjorka" who claims to come from Poland is currently becoming a conversation for committing personal data theft in Indonesia. This study aims to analyze the comparison of legal regulation and protection of personal data in Indonesia and Poland. The research method used by the author is the normative juridical method. This study uses secondary data types consisting of primary, secondary, and tertiary legal materials. Personal data theft arrangements in Indonesia are currently regulated by the Personal Data Protection Act. In the Bjorka case, because the law does not apply retroactively, legal arrangements and protections are based on the Information and Electronic Transactions Law with a maximum imprisonment of 10 years and/or a maximum fine of Rp. 5,000,000,000.00. Legal arrangements and protections in Poland are based on the Polish Criminal Code with a maximum penalty of 2 years in prison.