Online loans are credit problems, but online loans have two conflicting interests, on the one hand the creditor demands payment of the debt along with interest and fines. On the other hand, the debtor feels disadvantaged due to the actions of the creditor who misuses the debtor's personal data to carry out terror in billing. The purpose of this study is to examine the legal protection for debtors in online loan transactions related to personal data misused by creditors and the resolution of bad credit problems and problems arising from misuse of personal data by online creditors. By using a normative juridical research method, this research refers to the ITE Law and related laws. The results of the study suggest that: first, in the provisions of the ITE Law and PM 20/2016, the protection of personal data has been regulated in Article 26 paragraph (1) of the ITE Law and in Article 26, Article 27, and Article 36 paragraph 1 of PM 20/2016. Second, based on the provisions of the ITE Law or PM 20/2016 misuse of personal data, the threat of sanctions can be in the form of administrative sanctions, fines, and/or criminal sanctions. Therefore, the settlement of misuse of personal data by creditors can be done in a civil or criminal manner.