The widespread use of personal information in pay-later-based loan applications services reflects the vulnerability of digital security systems implemented by technology companies in Indonesia. Recently, several Shopee users reported being victims of such cases, claiming they never activated the paylater feature, yet their bank loan applications were declined due to poor credit records linked to SPayLater usage. While services like Shopee's SPayLater offer convenience, they also increase the risks of default and data breaches. Incidents such as improper debt collection practices and unauthorized access to ShopeePay balance reveal flaws in the platform's data protection and security measures. This underscores the need for in-depth research to strengthen legal safeguards for consumer personal data in Shopee's digital transactions. Findings indicate that SPayLater, as the data controller, holds the responsibility to collect, process, and protect consumer information throughout its lifecycle. Nevertheless, Shopee is perceived to have fallen short in fulfilling this duty, resulting in consumers suffering losses from unauthorized use of their data for loan applications. This situation highlights the urgency for more robust legal protections—both internally and externally to guarantee the protection of users' personal information. This research uses a normative legal research type with a descriptive research type. The problem approach uses a statutory approach with a case approach.