<![CDATA[Technological advancements have increased financial access through financial technology (fintech) services, particularly peer-to-peer (P2P) lending, yet these developments also present significant risks. Illegal online lenders (pinjol) often misuse personal data and employ intimidating debt collection practices, while large-scale data breaches, such as those involving BPJS Kesehatan, Tokopedia, and Kredit Plus where 890,000 customer records were allegedly leaked and sold highlight the urgent need for effective debtor protection. This research employs a normative juridical method using statutory, conceptual, and historical approaches to examine the legal framework for debtor protection against doxing practices. The findings show that legal protection is crucial to maintaining stability, security, and user trust in fintech services. Protection mechanisms are divided into internal measures, which regulate transparency, fair treatment, confidentiality, and risk management, and external measures provided by authorities through law enforcement, administrative sanctions, and dispute resolution. Despite the existence of the Personal Data Protection Law (PDP Law), the Information and Electronic Transactions Law (ITE Law), and Financial Services Authority (OJK) regulations, regulatory disharmony, weak supervision, and low public awareness hinder effective protection. Strengthening PDP Law enforcement and explicitly prohibiting doxing practices in OJK regulations are recommended.]]>
