<![CDATA[Rapid digitalization in Indonesia has contributed to a surge in online lending services, but on the other hand, it poses serious threats to the protection of users' personal data. The purpose of this study is to evaluate the extent of legal protection provided to Rupiah Cepat app users regarding the management of their personal data. Indonesia has a legal framework in the form of Law Number 27 of 2022 concerning Personal Data Protection (PDP Law) and Financial Services Authority Regulation Number 10/POJK.05/2022, but its implementation remains weak because an independent supervisory body has not yet been established and implementing regulations are still being finalized. Meanwhile, Rupiah Cepat, a lending app with 10 million users, has been found to have committed several violations, ranging from excessive data collection and non-transparent consent clauses to the data leak of 1.2 million users in 2024. The practice of debt shaming, which involves the dissemination of personal data to users' family contacts, has even caused serious psychological impacts. The method used is normative law, focusing on legislative analysis and case studies to identify gaps between applicable legal regulations and actual practices. The research is expected to provide concrete recommendations and strengthen consumer complaint mechanisms. Thus, this research contributes to advancing a safe, inclusive, and responsible digital financial ecosystem for Indonesian citizens.]]>
