Consumer Personal Data Protection in the PayLater Ecosystem: Cyber Law Challenges in the Fintech Era

Daftar Referensi dan Hasil WawancaraThe increasing popularity of PayLater services in Indonesia’s digital financial ecosystem has raised significant concerns regarding the protection of consumer personal data. While these services offer convenience and broaden access to credit, they also involve the large-scale collection of sensitive personal information, including national ID numbers, financial records, and contact data, often without sufficient transparency or informed consent. This study applies a normative juridical approach to examine the effectiveness of existing legal instruments—specifically Law No. 27 of 2022 on Personal Data Protection, the Consumer Protection Law No. 8 of 1999, the Electronic Information and Transactions Law, and related OJK regulations (POJK No. 10/2022 and POJK No. 22/2023). Findings indicate substantial gaps between the legal framework and its enforcement, with many fintech providers operating without adequate internal data protection policies or clear accountability mechanisms. Real-world cases reveal that consumers frequently suffer from unauthorized transactions and misuse of personal data without effective recourse. This paper argues for the implementation of strict liability principles, the establishment of an integrated oversight framework, and improved legal literacy to ensure meaningful protection of personal data in PayLater services and promote a more accountable and rights-based digital economy.