This research investigates the legal protection of personal data disseminated by illegal online loan providers based on Indonesian Law no. 27 of 2022 concerning Personal Data Protection (UU PDP). This study uses a normative legal research approach, which combines statutory and conceptual methodologies to examine relevant legal regulations and doctrines. The analysis focuses on comparing the PDP Law with Law Number 1 of 2024 concerning Amendments to Law Number 11 of 2008 concerning Electronic Information and Transactions (UU ITE). Through case studies, especially Decision Number 438/Pid.Sus/2020/PN Jkt.Utr, this research highlights the weaknesses of the ITE Law in dealing with specific problems related to personal data violations. These findings indicate that the PDP Law provides a more comprehensive and specific framework for protecting personal data. This study underscores the importance of effective implementation and enforcement of the PDP Law to ensure compliance and increase public awareness about personal data management. Interviews with legal experts reveal a consensus on the need for stronger legal mechanisms and public education to mitigate the risks associated with misuse of data by illegal online lenders. This research concludes that although the PDP Law has a strong legal foundation, its practical effectiveness depends on strict law enforcement and increasing public understanding. The recommendations include targeted training for law enforcement officials and a broad public campaign to improve personal data protection in Indonesia's digital landscape.