Indonesia is a country that is open to the development of the times which is currently moving towards the digital era quite well. Along with the times, community activities will not be separated from the help of technology. Advances in information technology and financial innovation have created a highly complex, dynamic and interrelated financial system. In order for community activities to remain under supervision and protection, the Financial Services Authority (OJK) was formed as an independent state institution engaged in the financial sector. The role of the OJK in this case is to provide oversight of Financial Technology companies, especially online loan applications, which are currently abusing consumers' personal data when making financial transactions online, of course this is against POJK regulation Number 10 of 2022. Fintech companies are prohibited from abusing consumer personal data. This study aims to find out how the regulation and form of legal protection for personal data in Indonesia and how big the role of OJK as an independent institution is to provide protection and supervision. This study uses a normative juridical research method consisting of primary legal material in the form of legislation, secondary legal material in the form of relevant journals or research, tertiary legal material in the form of non-legal material relevant to this writing. Regulations for personal data protection in Indonesia when there is no specific rule governing the handling of personal data, until now the rules regarding personal data are still separate in several laws and regulations, the form of consumer protection in online loan applications is regulated in POJK Number 10 of 2022 However, this regulation does not yet provide detailed protection to consumers, only providing sanctions against Fintech companies that misuse personal data in the form of suspension or revocation of business licenses. The role of OJK as an independent state institution in protecting consumers' personal data can only follow up on complaints from consumers to Fintech companies that are officially registered with the Financial Services Authority.