<p>Indonesia enacted Law No. 27 of 2022 on Personal Data Protection (PDP), which provides legal certainty regarding the transfer of personal data, including that of air passengers. The protection of passenger data within the civil aviation sector is a significant issue; however, balancing security and privacy remains a complex and ongoing challenge despite the development of a legal framework. This paper aims to review and analyze the compliance of air passenger data transfer regulations in Indonesia, particularly across borders, with the principles of personal data protection established by the PDP Law. The article employs doctrinal research methods, utilizing legal materials, as well as empirical data collected through interviews with representatives of the Directorate General of Civil Aviation (DGCA), the Directorate General of Customs and Excise (DGCE) and an aviation professional in Indonesia. The results show that air passenger data transfer in Indonesia is controlled by the DGCE, which is responsible for transferring air passenger data through the utilization of the Passenger Risk Management (PRM) application. The regulations governing the transfer of air passenger data in Indonesia align with most principles of personal data protection. However, various enhancements and adjustments are necessary to fully comply with the PDP Law.</p>