Legal Protection against Misuse of Personal Data of Financial Technology (Fintech) Users in the Indonesian Legal System: A Normative Analysis
DOI:
https://doi.org/10.33603/hermeneutika.v10i2.12513Keywords:
Legal Protection, Personal Data, Financial Technology (Fintech), Personal Data Protection, Indonesian Legal SystemAbstract
The development of Financial Technology (Fintech) services in Indonesia has driven the transformation of the financial services sector through ease of access, transaction efficiency, and increased financial inclusion. On the other hand, large-scale processing of users' personal data poses various legal risks, particularly data misuse, unauthorized access, data leaks, and data utilization without user consent. These conditions indicate that personal data protection is a fundamental aspect in ensuring legal certainty, privacy rights, and public trust in the Fintech ecosystem. This study aims to analyze the forms of legal protection against misuse of Fintech users' personal data and examine its legal provisions in the Indonesian legal system. The study uses a normative juridical method with a statutory approach, a conceptual approach, and an analytical approach. The legal materials used consist of primary, secondary, and tertiary legal materials analyzed qualitatively using a prescriptive method. The research results show that legal protection for Fintech users' personal data is realized through preventive and repressive mechanisms. Preventive protection includes the obligation to obtain valid consent, the application of transparent data processing principles, restrictions on the purposes of data use, the application of information security standards, and the fulfillment of data subjects' rights. Repressive protection is realized through dispute resolution mechanisms, the imposition of administrative sanctions, civil liability, and criminal sanctions against perpetrators of personal data misuse, as stipulated in Law Number 27 of 2022 concerning Personal Data Protection, which complements the regulatory framework for the digital financial services and electronic transactions sector. However, the implementation of legal protection still faces various obstacles, including the suboptimal harmonization of sectoral regulations, supervisory challenges, and the need to strengthen compliance of Fintech providers with personal data protection governance principles. Therefore, strengthening regulatory synchronization, effective supervision, and increasing compliance of Fintech providers are necessary to realize legal protection that provides certainty, fairness, and benefits for users of digital financial services.
References
Ali, Achmad. (2009). Uncovering Legal Theory and Judicial Prudence. Jakarta: Kencana.
Ali, Zainuddin. (2021). Legal Research Methods. Jakarta: Sinar Grafika.
Asshiddiqie, Jimly. (2020). The Indonesian Constitution and Constitutionalism. Jakarta: Sinar Grafika.
Asshiddiqie, Jimly. (2015). Introduction to Constitutional Law. Jakarta: Rajawali Pers.
Budhijanto, Danrivanto. (2010). Telecommunications, Broadcasting, and Information Technology Law: Regulation and Convergence. Bandung: Refika Aditama.
Budhijanto, Danrivanto. (2024). Personal Data Protection and National Data Law. Bandung: Logoz Publishing.
Fuady, Munir. (2013). Grand Theories in Law. Jakarta: Kencana.
Friedman, Lawrence M. (1975). The Legal System: A Social Science Perspective. New York: Russell Sage Foundation.
Hadjon, Philipus M. (1987). Legal Protection for the People in Indonesia. Surabaya: Bina Ilmu.
HS, Salim, & Nurbani, Erlies Septiana. (2017). Application of Legal Theory to Thesis and Dissertation Research. Jakarta: Rajawali Press.
Kelsen, Hans. (1967). Pure Theory of Law. Berkeley: University of California Press.
Mahfud MD. (2017). Legal Politics in Indonesia. Jakarta: Rajawali Pers.
Marzuki, Peter Mahmud. (2021). Legal Research. Jakarta: Kencana.
Mertokusumo, Sudikno. (2019). Understanding Law: An Introduction. Yogyakarta: Cahaya Atma Pustaka.
Nonet, Philippe, & Selznick, Philip. (1978). Law and Society in Transition: Toward Responsive Law. New York: Harper & Row.
Pound, Roscoe. (1959). Jurisprudence. St. Paul: West Publishing.
Radbruch, Gustav. (1950). Legal Philosophy. Edinburgh: Edinburgh University Press.
Rahardjo, Satjipto. (2000). Legal Science. Bandung: Citra Aditya Bakti.
Rahardjo, Satjipto. (2009). Progressive Law: A Synthesis of Indonesian Law. Yogyakarta: Genta Publishing.
Riswandi, Budi Agus, Zulhuda, Sonny, Wibowo, Ari, Hartanto, Ratna, Luthfidyfa, Nabilla Maryam, & Erlangga, Vania Lutfi Safira. (2024). Personal Data Protection Law: Comparative Study on Indonesian and Malaysian Law. Yogyakarta: Universitas Islam Indonesia Publisher.
Rosadi, Sinta Dewi. (2015). Cyber Law: Aspects of Data Privacy According to International, Regional, and National Law. Bandung: Refika Aditama.
Rosadi, Sinta Dewi. (2021). Personal Data Protection in Indonesia. Bandung: Refika Aditama.
Sjahdeini, Sutan Remy. (2018). The Legal System and Legal Protection in Indonesia. Jakarta: Prenadamedia Group.
Soekanto, Soerjono. (2019). Introduction to Legal Research. Jakarta: UI Press.
Soekanto, Soerjono, & Mamudji, Sri. (2019). Normative Legal Research: A Brief Review. Jakarta: RajaGrafindo Persada.
Subekti. (2005). Principles of Civil Law. Jakarta: Intermasa.
Sutedi, Adrian. (2009). Sharia Banking: Review and Several Legal Aspects. Jakarta: Ghalia Indonesia.
Sutedi, Adrian. (2014). Banking Law. Jakarta: Sinar Grafika.
Walters, Robert, Trakman, Leon, & Zeller, Bruno. (2019). Data Protection Law: A Comparative Analysis of Asia-Pacific and European Approaches. Singapore: Springer.
Westin, Alan F. (1967). Privacy and Freedom. New York: Atheneum.
National Journal Article
Fauzy, E., & Shandy, N. A. R. (2023). The Right to Privacy and the Legal Politics of Law Number 27 of 2022 concerning Personal Data Protection. Lex Renaissance, 7(3), 445–461.
Manurung, E. A. P., & Thalib, E. F. (2023). A Legal Review of Personal Data Protection Under Law Number 27 of 2022. Saraswati Law Journal, 5(2), 240–252.
Saly, J. N., Artamevia, H., Gulo, B. J. S., & Rhemrev, M. A. (2023). Analysis of Personal Data Protection Related to Law Number 27 of 2022. Serina Social Humanities Journal, 1(3), 1800–1808.
Aulia, H., & Umboh, N. K. (2025). Analytical study of Law Number 27 of 2022 concerning Personal Data Protection in the financial sector. Indonesian Intellectual and Scholars Journal.
State Responsibilities Regarding Personal Data Protection Based on Law Number 27 of 2022 concerning Personal Data Protection. (2024). Kutei Scientific Journal, 23(2), 158–172.
International Journal Articles
Aldboush, H. H. H., & Ferdous, M. (2023). Building Trust in Fintech: An Analysis of Ethical and Privacy Considerations at the Intersection of Big Data, AI, and Customer Trust. International Journal of Financial Studies, 11(3), 90.
Arner, D. W., Barberis, J., & Buckley, R. P. (2016). The Evolution of FinTech: A New Post-Crisis Paradigm? Georgetown Journal of International Law, 47(4), 1271–1319.
Blumenstock, J. E., & Kohli, N. (2023). Big Data Privacy in Emerging Market Fintech and Financial Services: A Research Agenda. arXiv.
Gomber, P., Koch, J. A., & Siering, M. (2018). Digital Finance and FinTech: Current Research and Future Research Directions. Journal of Business Economics, 87(5), 537–580.
Kollnig, K., Zhang, L., Zhao, J., & Shadbolt, N. (2023). Before and After China's New Data Laws: Privacy in Apps. arXiv.
Putri, B. M. L., Rohaini., Nhung, P. H., & Putri, R. W. (2025). Analysis of Consumer Rights Protection Against the Misuse of Personal Data in Fintech Services. Lex Publica, 12(1), 32–62.
Sianipar, O. J., Satory, A., & Darmawan, I. (2025). The Urgency of Consumer Personal Data Protection in Indonesia's Fintech Ecosystem in the Era of Digital Business Transformation. International Journal of Cultural and Social Science, 7(2).
Yang, L., Tian, M., Xin, D., Cheng, Q., & Zheng, J. (2024). AI-Driven Anonymization: Protecting Personal Data Privacy While Leveraging Machine Learning. arXiv.
Legislation
The 1945 Constitution of the Republic of Indonesia.
Law Number 27 of 2022 concerning Personal Data Protection.
Law Number 1 of 2024 concerning the Second Amendment to Law Number 11 of 2008 concerning Electronic Information and Transactions.
Government Regulation Number 71 of 2019 concerning the Implementation of Electronic Systems and Transactions.
Financial Services Authority Regulation Number 10/POJK.05/2022 concerning Information Technology-Based Joint Funding Services.
International Documents
European Union. (2016). General Data Protection Regulation (EU) 2016/679.
United Nations. (1948). Universal Declaration of Human Rights.
United Nations. (1966). International Covenant on Civil and Political Rights.
Downloads
Published
Issue
Section
Citation Check
License
Copyright (c) 2026 Taupan Selamat Wibawa, Endang Sutrisno, Sanusi Sanusi
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
The Authors submitting a manuscript do so on the understanding that if accepted for publication, copyright of the article shall be assigned to Jurnal HERMENUTIKA, Sekolah Pascasarjana Ilmu Hukum. Universitas Swadaya Gunung Jati as publisher of the journal. Copyright encompasses rights to reproduce and deliver the article in all form and media, including reprints, photographs, microfilms, and any other similar reproductions, as well as translations.
Jurnal HERMENEUTIKA, Universitas Swadaya Gunung Jati and the Editors make every effort to ensure that no wrong or misleading data, opinions or statements be published in the journal. In any way, the contents of the articles and advertisements published in Jurnal HERMENEUTIKA are the sole responsibility of their respective authors and advertisers.
