This update highlights the personal data protection considerations arising from debt collection activities in Indonesia’s financial services sector. While debt collection is a lawful recovery mechanism, financial institutions must ensure that any use, disclosure, or sharing of debtor information complies with the requirements of Law No. 27 of 2022 on Personal Data Protection, particularly regarding lawful basis, purpose limitation, and the handling of data by third-party collectors.