The misuse of customer personal data by bank employees in a fictitious credit case demonstrates the weakness of consumer protection in the banking sector. This study aims to analyze legal protection for customers and the legal liability of banks and perpetrators based on Indonesian laws and regulations. The research method used is normative juridical with a statutory and contextual approach. The results show that legal protection is regulated in the Consumer Protection Law, the Personal Data Protection Law, the Banking Law, and the Financial Services Authority Regulation (POJK), both preventively and repressively. However, its implementation remains weak due to suboptimal internal oversight, so that responsibility is placed more on individual perpetrators than on banking institutions
Copyrights © 2026