The rapid growth in the scale of cross-border data flow has pushed the protection of personal information to become an important issue of global concern. This paper drafts a legal adjustment mechanism for the protection of personal information under cross-border data, and builds a data sovereignty practice system from the aspects of comprehensive strength construction and cross-border flow pilot. It utilizes civil law, criminal law and administrative law to protect personal information in cross-border data flow. Based on the numerical analysis method, the legal protection mechanism of personal information in cross-border data flow is discussed in depth. The numerical analysis results show that the probability of personal information exposure increases to about 0.35 when the ratio of malicious nodes under the legal mechanism of this paper is 0.5. The estimated accuracy of personal information protection effect increases by 65.16% to 80.52% when the enforcement strength of this paper’s mechanism is 0.7 and the sample size of companies is 300. Fixing the initial ratio of cross-border data information disclosure, the smaller the initial ratio of personal information protection, the faster the speed of personal information leakage under the legal mechanism. The investigators’ scores on the personal information risk indicators of a cross-border e-commerce platform are uniformly distributed between 1 and 2, and the sum of the overall scores is less than 10, demonstrating the effectiveness of the legal mechanism constructed in this paper on the protection of personal information.