Today's innovative industry is rapidly growing, fuelled by technology utilization and an increasingly diverse range of economic models. One of these models includes the rise of illegal financial technology peer-to-peer lending (illegal fintech P2P lending), which is increasingly gaining popularity within society. There exist various regulations designed to safeguard the personal data of debtors involved in illegal fintech P2P lending. This study employs a normative doctrinal approach utilizing three research methodologies: statute, comparative, and conceptual approach. The research reveals that while some standard rules have been elucidated, there lacks specificity regarding the responsible institution. The study collected information indicating numerous instances of debtors misusing personal data through illegal fintech P2P lending This highlights the continuous legal framework overseeing the balancing act of safeguarding personal data in Indonesia. comparing it to the typical legal principles governing personal data protection in other nations with principles on common law. Consequently, this study concludes that the current handling of debtors' personal data misuse in illegal fintech P2P lending by the Personal Data Protection Agency remains sectoral. It emphasizes the necessity for a more comprehensive, independent institution to offer optimal legal protection for debtors' personal data in the context of illegal P2P lending using fintech.