Abstract Debt collection practices within fintech lending services in Indonesia continue to raise legal issues, particularly when collection involves pressure, intimidation, the misuse of personal data, or the involvement of third parties to the detriment of the debtor. This study aims to analyze the legal framework governing the liability of fintech lending providers regarding debt collection practices and to formulate a legal liability construct for fintech lending platforms concerning collection practices that harm debtors. This is a normative legal study employing statutory, conceptual, and case-based approaches. Legal materials comprising primary, secondary, and tertiary sources were gathered through literature review and analyzed qualitatively using legal interpretation to examine the interplay between norms governing fintech lending, consumer protection, and personal data protection. The findings indicate that the legal framework for fintech lending provider liability in debt collection is anchored in OJK Regulation (POJK) Number 40 of 2024 concerning Information Technology-Based Joint Funding Services and OJK Regulation (POJK) Number 22 of 2023 concerning Consumer and Public Protection in the Financial Services Sector. The legal liability construct for fintech lending platforms arises from their roles as electronic system operators, personal data controllers, service mechanism administrators, and entities capable of collaborating with debt collectors. Platforms cannot absolve themselves of liability if collection is conducted unlawfully, even when such actions are carried out by third parties. This liability encompasses preventive, corrective, and repressive measures to ensure that debt collection activities remain within the boundaries of law, ethics, consumer protection, and personal data protection.