Reconstructing Personal Data Protection Institutions for PayLater Users under Law No. 27 of 2022
DOI:
https://doi.org/10.24252/al-risalah.v26i2.71051Keywords:
Personal Data Protection, Personal Data Protection Authority, PayLaterAbstract
The development of fintech in Indonesia, particularly through PayLater services, has provided the public with easier access to financing while also driving the growth of digital financial inclusion. On the other hand, the use of these services increases risks to the protection of consumers’ personal data, such as the misuse of data for debt collection purposes, the disclosure of information to third parties without consent, and data breaches that result in both material and immaterial losses. This issue is further complicated by the fact that, to date, the mandate of Article 58 of the Personal Data Protection Act (PDP Act) regarding the establishment of a personal data protection authority has not been fully implemented, resulting in suboptimal oversight and enforcement of laws against personal data protection violations in the fintech sector. This study aims to analyze the reconstruction of a model for a personal data protection authority in the implementation of Article 58 of the PDP Law to strengthen consumer protection for PayLater fintech services, as well as to identify the factors that act as barriers to its implementation. The study employs a normative legal methodology using a legislative approach, a conceptual approach, and a comparative approach. Primary, secondary, and tertiary legal sources were analyzed using qualitative descriptive methods through a literature review. The research findings indicate that the implementation of Article 58 of the Personal Data Protection Act requires institutional restructuring through the establishment of the Personal Data Protection Authority as an independent, professional, and accountable state agency, with authority that includes risk-based oversight, compliance audits, review of Data Protection Impact Assessments (DPIAs), the application of the principles of “privacy by design” and “privacy by default, ” oversight of granular consent mechanisms, the enforcement of administrative sanctions, and integrated coordination with the Financial Services Authority (OJK) and other relevant agencies. This study also found that the implementation of Article 58 of the Personal Data Protection Law still faces various obstacles, including the failure to establish a personal data protection agency, delays in implementing regulations, overlapping authorities among agencies, limited human resources and digital oversight infrastructure, low personal data protection literacy, and the lack of a culture of compliance among fintech operators.
References
AH, Muh. Arfhani Ichsan, and Muh. Chaerul Anwar. “Urgency of Establishing an Independent Supervisory Body to Implement Article 58 of Indonesia’s Data Protection Law.” Alauddin Law Development Journal 8, no. 1 (2026): 7–17. https://doi.org/10.24252/aldev.v8i1.67700.
Angelia, Finesse Sly Oeijono, and Daniel Limbong. “Legal Protection of Paylater Users on E-Commerce Platforms for Personal Data Leakage.” Amnesti: Jurnal Hukum 6, no. 2 (2024): 174–85.
Asherli, Bella Fistya, and Sidi Ahyar Wiraguna. “Perlindungan Keamanan Data Pribadi Di Era Digital Menghadapi Serangan Phishing Ditinjau Dari Undang-Undang Pelindungan Data Pribadi Nomor 27 Tahun 2022.” Jurnal Hukum, Administrasi Publik Dan Negara 2, no. 4 (2025): 1–14.
Cantik, Dhea, and Adhining Prabawati Rahmahani. “The Urgency of Establishing a Supervisory Agency for the Implementation of Personal Data Protection in the Implementation of the Personal Data Protection Law.” International Journal of Science and Environment (IJSE) 6, no. 1 (2026): 300–308.
Cristine, Megawati Agus, Frangki Mario Angelo Risakota, and Steffy Ruth Celine Sirait. “Perlindungan Data Pribadi Dalam Sistem Skoring Kredit Otomatis Oleh Fintech Di Indonesia: Analisis Yuridis Normatif Berdasarkan Undang-Undang Nomor 27 Tahun 2022.” Jurnal Studi Hukum Modern 7, no. 3 (2025): 1–15.
Daeng, Yusuf, Nasri Linra, Atan Darham, Derry Handrianto, Risky Risandy Sianturi, Denny Martin, Rendy Pratama Putra, and Hendi Saputra. “Perlindungan Data Pribadi Dalam Era Digital: Tinjauan Terhadap Kerangka Hukum Perlindungan Privasi.” Innovative: Journal Of Social Science Research 3, no. 6 (2023): 2898–2905.
Firdaus, Rahma Agri. “Perlindungan Hukum Dan Pencegahan Kejahatan Siber Di Era Digital Dalam Sistem Hukum Di Indonesia.” STAATSRECHT: Jurnal Hukum Kenegaraan Dan Politik Islam 4, no. 1 (2024): 79–104.
Guttman-Kenney, Benedict, Chris Firth, and John Gathergood. “Buy Now, Pay Later (BNPL)... on Your Credit Card.” Journal of Behavioral and Experimental Finance 37 (2023): 100788.
Hassanah, Hetty, and Wahyudi Wahyudi. “Legal Protection of Consumer Personal Data on the Use of Fintech in E-Commerce.” Jurnal Bina Mulia Hukum 10, no. 1 (September 2025): 68–84.
Hs, Fatimah, Nursalam Rahmatullah, Hamsah Hamsah, and Hasmiati Hasmiati. “Independensi Lembaga Pengawas: Kunci Efektivitas Undang-Undang Perlindungan Data Pribadi.” Zaaken: Journal of Civil and Business Law 6, no. 2 (2025): 209–23.
Maharani, Audi Sonia Putri, and Adi Suliantoro. “Perlindungan Konsumen Pada Sistem Pembayaran PayLater Berdasarkan Undang-Undang Perlindungan Konsumen (UU No. 8 Tahun 1999) Di Indonesia.” Audi Et AP: Jurnal Penelitian Hukum 5, no. 02 (2026): 222–35.
Matheus, Juan, and Ariawan Gunadi. “Pembentukan Lembaga Pengawas Perlindungan Data Pribadi Di Era Ekonomi Digital: Kajian Perbandingan Dengan KPPU.” JUSTISI 10, no. 1 (2024): 20–35. https://doi.org/https://doi.org/10.33506/jurnaljustisi.v10i1.2757.
Pattipeilohy, Alex Maxer, Agus Satory, and Mahipal Mahipal. “Analisis Kesadaran Hukum Konsumen Paylater Atas Data Pribadi Berdasarkan Undang-Undang No. 27 Tahun 2022 Tentang Perlindungan Data Pribadi.” Arus Jurnal Sosial Dan Humaniora 5, no. 3 (2025): 4001–7.
Priskarini, Intan Audia, and Kukuh Tejomurti. “The Role of The Financial Services Authority in The Legal Protection of Privacy Rights in Connection with Personal Data of Fintech Lending Debtor in Indonesia.” PADJADJARAN Jurnal Ilmu Hukum (Journal of Law) 6, no. 3 (2019): 556–75.
Ramadhani, Gusti, and Cecep Suhardiman. “Kebuntuan Pembentukan Lembaga Pelindungan Data Pribadi Dan Implikasinya Terhadap Efektivitas UU PDP Di Indonesia.” Jurnal Riset Rumpun Ilmu Sosial, Politik Dan Humaniora (JURRISH) 5, no. 1 (2026).
Utomo, Setyo. “Personal Data Protection Through Law Number 27 Of 2022: Challenges Of Cybercrime in The Era of Globalization and Digital.” Pena Justisia: Media Komunikasi Dan Kajian Hukum 23, no. 3 (2024): 2967–75.
Wijaya, Catherine, Corrie Yemima Ilona, Cristin Rosa Gultom, and Sri Handayani. “Perlindungan Data Pribadi Konsumen Dalam Layanan Keuangan Digital: Tinjauan Dari UU PDP.” Birokrasi: Jurnal Ilmu Hukum Dan Tata Negara 3, no. 2 (2025): 30–42.
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Irma Dewi Kania, Sentosa Sembiring, Catharina Dewi Wulansari
This work is licensed under a Creative Commons Attribution 4.0 International License.
