This study examines the legal aspects of the unilateral inclusion of emergency contacts in credit card agreements in Indonesia. This practice often leads to disturbances and potential violations of third parties privacy rights. Using a normative approach, this study analyzes provisions in the Indonesian Civil Code, the Personal Data Protection Law, and the Electronic Information and Transactions Law to assess the legality and legal protection for parties listed without consent. The study recommends the necessity of explicit consent from data subjects and stronger regulations to prevent misuse of personal data by credit card issuers.