Ethical and Privacy Governance Dimensions in the Adoption of Digital Payment Systems in the MSME Sector

The continuous digital transformation among Micro, Small, and Medium Enterprises (MSMEs) has accelerated the adoption of digital payment systems, fundamentally altering not only transactional efficiency but also inducing the profound datafication of commercial activities. This platformization of financial services introduces critical ethical and privacy governance challenges, particularly within the regulatory landscape shaped by Indonesia's Personal Data Protection Law (Law No. 27 of 2022). Consequently, this study aims to investigate how MSME merchants perceive and navigate data privacy issues, identify the accountability challenges embedded in platform-mediated transaction data flows, and explore feasible privacy governance practices tailored to small-scale businesses. Employing an exploratory qualitative case study design, the research analyzes empirical data collected from 15 heterogeneous MSME informants in Pekanbaru, Riau, utilizing a triangulation approach that encompasses semi-structured interviews, operational observations, and document analysis. The thematic analysis reveals a substantial privacy literacy gap, wherein merchants predominantly understand transaction records as mere proof of payment rather than as sensitive information requiring comprehensive lifecycle governance. Furthermore, a significant accountability dilemma emerges due to fragmented responsibilities across merchants and external payment providers, leading to uncertainty regarding data protection obligations. The study also highlights a structural platform dependency that, while functionally beneficial for MSMEs, creates severe informational asymmetries where merchants possess limited influence over downstream data processing practices. In response to these multifaceted challenges, the findings strongly indicate that feasible privacy governance for MSMEs must be proportionate to their limited organizational capacity, heavily favoring simple, routine-integrated controls such as basic access restrictions and data minimization over complex, enterprise-scale compliance bureaucracies. Ultimately, this research theoretically reframes MSME merchants as active organizational privacy actors rather than passive technology users, proposing a proportionate data governance logic that strictly aligns data visibility, ethical responsibility, and platform accountability within the broader digital payment ecosystem.