This research aims to determine the legal steps that can be taken by borrowers (debtors) in personal loan services (pinpri) regarding the practice of leaking personal data carried out in the context of loan collection. This research was carried out using normative research methods, namely sourced from primary legal materials from statutory regulations, while secondary data was obtained from written legal materials such as scientific journals, books, scientific articles, statutory regulations, and other related literature materials. The results of this research show that the legal steps that can be taken by Pinpri debtors if their personal data is leaked are through non-litigation and litigation legal efforts. Non-litigation legal efforts take the form of negotiation and mediation, while the litigation route is through an unlawful act lawsuit based on Article 1365 of the Civil Code.