This study analyzes the forms of legal liability borne by peer-to-peer lending providers for consumer losses arising from the misuse of personal data on the basis of liability theory, and examines the legal reasoning in Decision Number 689/Pdt.G/2021/PN.Jkt.Pst. and its subsequent development at the cassation level in relation to consumers’ right to compensation. The research employs a normative juridical method with statutory and case approaches. The primary legal materials consist of legislation and court decisions, while the secondary materials comprise legal literature, doctrine, and previous research. The materials are analyzed systematically, interpretively, and prescriptively. The findings show that peer-to-peer lending providers bear layered legal liability because they control the electronic systems, personal data processing, service procedures, and debt-collection mechanisms. Liability may arise from breach of contract, unlawful acts, the acts of employees or third parties, obligations as electronic system operators, and consumer protection law. Remedies include not only material and immaterial compensation but also the cessation of unlawful processing, the deletion of unlawfully processed data, the restoration of security, and the restoration of consumer rights. The decision of the Central Jakarta District Court did not provide substantive protection because the examination ended on the issue of absolute jurisdiction. Supreme Court Decision Number 1206 K/Pdt/2024 subsequently corrected that approach, affirmed the jurisdiction of the general courts, and granted structural remedies through stronger regulation and supervision. Nevertheless, no individual compensation was awarded to consumers. Effective consumer protection therefore requires the integration of the state’s responsibility to build a protective system and the providers’ liability to redress the concrete losses suffered by consumers