A loan app is harassing me and my contacts using my phone data after I defaulted, is this legal?

Question

After missing an EMI on a quick loan app, the company started calling and abusing my contacts using data it accessed from my phone without proper consent. I have been reading conflicting things online and I would like to understand what Indian law actually says about this, which Act and Section applies, what the realistic timelines and costs are, and what I should be doing right now to protect my position. If the matter can be resolved without litigation I would prefer that route, but I want to know what my rights are before I agree to anything or sign any document.

MyVakeel Legal Desk · Accepted Answer

A loan app is harassing me and my contacts using my phone data after I defaulted, is this legal? is governed in India primarily by Information Technology Act, 2000 – Section 72A, Reserve Bank of India (Digital Lending) Directions, 2025 and Bharatiya Nyaya Sanhita, 2023 – Section 351 (criminal intimidation). The short answer is set out below, followed by the practical steps most people in this situation need to take. Read it alongside the specific provisions named, because the exact relief available to you turns on the facts you can prove on paper.

RBI's Digital Lending Directions require lenders/loan apps to obtain explicit borrower consent for each specific data access (contacts, gallery, location), disclose the recovery agent's identity, and restrict recovery calls to reasonable hours (typically 8 am-7 pm) without harassment.

Contacting and harassing your personal contacts using data extracted without proper consent violates Section 72A of the IT Act (unauthorised disclosure of personal information) and can attract up to 3 years imprisonment.

Threats or abuse during recovery calls to your contacts can separately constitute criminal intimidation under Section 351 BNS and defamation if false statements about you are made to third parties.

Verify whether the loan app is registered/backed by an RBI-regulated NBFC or bank — many harassment cases involve unregulated apps operating illegally without RBI authorization, which itself is a ground for complaint.

Report unregistered/harassing loan apps to the RBI's Sachet portal and to the police cyber cell, as RBI has been actively cracking down on such apps following borrower harassment complaints.

What to do next: 1) Document all harassment calls/messages sent to you and your contacts; 2) Check if the app/lender is RBI-registered via the RBI website; 3) File a complaint on the RBI Sachet portal and at cybercrime.gov.in; 4) File a police complaint for criminal intimidation if threats were made.

If the other side has already issued a notice, filed a case or set a deadline, treat the matter as time-sensitive — most remedies under Information Technology Act, 2000 – Section 72A carry limitation periods, and a delay you cannot explain weakens an otherwise strong case. You can post the details on the MyVakeel forum for a practising advocate to review, or book a paid consultation with a Bar Council verified lawyer in this practice area.