Easy permit processing is one of the tools that supports businessmen in obtaining the legality of their business. OSS is the initial stage for the government in reforming and simplifying permit services in an effort that has been marked since the issuance of the Job Creation Law. In processing permits, personal data of businessmen will be uploaded to the OSS system and managed by electronic system administrators. This data contains personal information of businessmen which must not be misused. Therefore in this research, the author proposes 2 (two) problem formulations, including: a) discussing the policies and regulation of personal data for OSS users, reviews according to Law Number 27 of 2022 concerning Personal Data Protection and b) regarding the legal benefits of protecting personal data in OSS services used by businessmen. The author uses normative legal research methods with a legal principles approach and also legal synchronization. Based on the author’s research on this issue, Indonesia’s policy still consisted of many problems regarding business permits. This lead to the birth of the OSS system which in turn brought reformation for business permits in Indonesia. In the enforcement of the OSS system, every user data that gets registered becomes valuable personal data and deserves to be protected by the regulations governing it, one of which is Law Number 27 of 2022. The author also finds that the legal benefits of protecting personal data in OSS services are realized in legal responsibility through the form of law enforcement instruments and sanctions that can create a principle of benefit or is in line with Jeremy Bentham's theory of utilitarianism. Conclusively, these results the author determine that the implementation of OSS is a form of the government's efforts to create an investment- friendly climate in the Indonesian economy. Moreover, legal regulations balanced with law enforcement bring prosperity for many people. The author also suggests that there be a balance between the public and private sectors in law enforcement as well as strengthening sanctions and developing other data protection institutions.