The system of exchanging information on taxpayer data between countries called as AEoI  is follow up action on tax amesty which  provides many benefits for the country but has risks for taxpayers data. Law 9/2017 concerning the AEoI merely governs technical issues and does not regulate regarding taxpayer data protection even if taxpayer data protection is guaranteed in article 28G paragraph (1) of the 1945 Constitution. Personal data in Indonesia is currently not regulated in a specific law. The need for personal data protection arrangements is an urgent matter because personal data stores human dignity, especially in the AEoI system that has data permissions. This paper compares the personal data protection arrangements in the European Union and the regulatory principles applied in Indonesia because it is important for Indonesia to meet European Union standards regarding personal data protection.