A loan app is harassing me and my contacts using my phone data after I defaulted, is this legal?

Question

After missing an EMI on a quick loan app, the company started calling and abusing my contacts using data it accessed from my phone without proper consent. I would rather settle this without going to court if the law allows it, but I need to know my rights before I sign anything. Please tell me what to do first and what document to keep.

MyVakeel Legal Desk · Accepted Answer

Under Indian law, Information Technology Act, 2000 – Section 72A is the starting point for this cyber law question. What follows is the position in substance, together with the steps that usually make the difference in practice.

RBI's Digital Lending Directions require lenders/loan apps to obtain explicit borrower consent for each specific data access (contacts, gallery, location), disclose the recovery agent's identity, and restrict recovery calls to reasonable hours (typically 8 am-7 pm) without harassment.

Contacting and harassing your personal contacts using data extracted without proper consent violates Section 72A of the IT Act (unauthorised disclosure of personal information) and can attract up to 3 years imprisonment.

Threats or abuse during recovery calls to your contacts can separately constitute criminal intimidation under Section 351 BNS and defamation if false statements about you are made to third parties.

Verify whether the loan app is registered/backed by an RBI-regulated NBFC or bank — many harassment cases involve unregulated apps operating illegally without RBI authorization, which itself is a ground for complaint.

Report unregistered/harassing loan apps to the RBI's Sachet portal and to the police cyber cell, as RBI has been actively cracking down on such apps following borrower harassment complaints.

In practice, in this order: 1) Document all harassment calls/messages sent to you and your contacts; 2) Check if the app/lender is RBI-registered via the RBI website; 3) File a complaint on the RBI Sachet portal and at cybercrime.gov.in; 4) File a police complaint for criminal intimidation if threats were made.

Timing matters here: Information Technology Act, 2000 – Section 72A works on limitation periods, so a loan app harassment claim that is right on the merits can still fail if it is brought late. You can post the details on the MyVakeel forum for a practising advocate to review, or book a paid consultation with a Bar Council verified lawyer in cyber law.