Technological advancements have accelerated the use of financial technology (fintech), particularly in online lending services, which facilitate public access to credit but simultaneously raise legal challenges related to the protection of consumers’ personal data. Unauthorized collection, use, or dissemination of personal data by online loan providers without the consent of data subjects poses significant risks to consumer rights. This study examines the legal framework governing personal data protection in online lending services in Indonesia and analyzes the sanctions imposed for violations. Using a normative juridical approach, the study reviews relevant statutory regulations, including Law Number 11 of 2008 on Electronic Information and Transactions, as amended, and Financial Services Authority Regulation Number 77/POJK.01/2016 on Information Technology–Based Money Lending Services. The findings indicate that service providers are legally obligated to ensure the confidentiality, integrity, and availability of consumers’ personal data and to obtain consent for its use. Violations of these obligations are subject to administrative sanctions, including warnings, fines, restrictions on business activities, and license revocation.
Copyrights © 2026