Information technology-based money lending service is the implementation of financial services to bring lenders together with borrowers in order to make loan agreements to borrow money. Many people have complained about the dissemination of personal data by online loan providers without notice and without the owner's permission. The purpose of this paper is to review the legal protection of customers' personal data in technology-based money lending services. The motto used in this writing is a normative legal method with a statutory approach and a fact approach. The results of the study show that legal protections and sanctions for personal data breaches have been stipulated in Law No. 11 of 2008 and changes in information and electronic transactions, but specifically regarding legal protection and sanctions for personal data breaches in online loan services have been listed in the financial services authority regulation No. 77/POJK.01/2016. Information technology-based money lending services. The organizer is responsible for maintaining the confidentiality, integrity, and availability of personal data use and in the utilization must obtain approval from the data owner, the organizer may be subject to administrative sanctions in the form of written warnings, fines, obligation to pay a certain amount of money, restrictions on business activities, and revocation of business license