This study proposes a reference model that provides 16 control groups based on legal framework, international standards, project frameworks and best practices of security information to protect personal data in the microfinance sector from a legal, organizational and technical approach. This model would also align the control to each phase of the personal data life cycle in order to guarantee a consistent protection. The validation was conducted in a Peruvian savings and credit cooperative, where information was collected, the level of protection of their personal data was evaluated and controls were proposed to raise their indicator based on the reference model, whose implementation increased the level of personal data protection by 98%.