The development of retail business activities in the digital world has caused the processing of customers' personal data to be carried out not only by retail companies, but also by various service providers, such as cashier systems, payment services, applications, data storage, digital marketing, customer service, and delivery services. The involvement of multiple parties creates the need to clarify the legal relation between the Personal Data Controller and the Personal Data Processor through a Data Processing Agreement. Thus, the article aims to analyze the adequency of the obligations and responsibilities of Personal Data Controllers and Personal Data Processors under Law Number 27 of 2022 on Personal Data Protection to ensure a legal compliance system in the retail sector. The article employs a normative legal research method with a statutory, conceptual, comparative, and limited case approaches. Results show that the regulation of the obligations and responsibilities of Personal Data Controllers and Personal Data Processors is not yet fully adequate at the level of contractual relation and implementation mechanisms. Several gaps remain in relation to things such as documented instructions, due diligence of Processors, minimum clause standards, Processor assistance, audits and evidence of compliance, early notification of Personal Data Protection failures, the use of other Personal Data Processors, and the deletion or return of Personal Data after the processing relation ends. Therefore, we argue that there is a need for the formulation of a layered normative model of a legal compliance system, consisting of compliance principles, internal and external compliance parameters, minimum clause standards, and mechanisms for implementation and accountability.