What data credit agencies store and evaluate
Credit agencies collect payment history, contract data and information from public registers and condense it into a probability score.
Until 19 November 2026, § 31(1) BDSG (the Federal Data Protection Act) permits the use of a score only where data protection law has been complied with and the data used is demonstrably relevant under a scientifically recognised mathematical-statistical procedure. Address data alone may not carry the score.
From 20 November 2026, § 37a BDSG applies (Act of 12 May 2026, BGBl. 2026 I no. 139). Address data, age, gender, name, data from social networks, account transactions and special categories of personal data may then no longer feed into such scores at all, and minors may not be scored, § 37a(2) BDSG.
For outstanding debts a tighter limit applies. Debts may be included that are subject to a court title, that were established in insolvency proceedings and not disputed at the verification meeting, or that the debtor has expressly acknowledged.
Otherwise the debtor must have been sent at least two written reminders after the due date, the first reminder must lie at least four weeks back, the debtor must have been informed beforehand, at the earliest with the first reminder, that the debt may be taken into account by a credit agency, and the debtor must not have disputed the debt.
It is also sufficient that the contract can be terminated without notice because of payment arrears and the debtor was informed beforehand that the debt may be taken into account. That is how § 31(2) BDSG regulates it until 19 November 2026, and § 37a(3) BDSG with the same list thereafter. Whether a debt was allowed to be reported to the credit agency is governed solely by the GDPR (BGH, judgment of 12 May 2026, VI ZR 375/24, para. 14).
On 7 December 2023 the CJEU held that such a probability score can amount to an automated individual decision under Art. 22(1) GDPR where a third party’s decision to enter into a contractual relationship depends on it (C-634/21).
Every agency keeps its own records. An error at Schufa says nothing about the entry at infoscore Consumer Data or CRIF. That is why we review all data copies side by side.
Your GDPR rights against credit agencies
Four rights carry the challenge. Art. 15 GDPR gives you access including a copy of your data, Art. 16 GDPR the rectification of inaccurate data, Art. 17 GDPR erasure, and Art. 21(1) GDPR the right to object to processing based on legitimate interests.
They are directed at every agency as controller. Under Art. 12(3) GDPR it must inform you of the measures taken within one month of receiving the request; for complex or numerous requests it may extend this by a further two months, and must tell you so within the first month.
If no response follows or the agency refuses, Art. 77(1) GDPR entitles you to complain to a supervisory authority. You can also sue before the civil courts.
Common errors in credit reports
The patterns of error repeat. They range from mistaking two people with the same name to debts that were settled long ago and still appear in the records. Check every item on the data copy individually: creditor, amount, due date, settlement note.
Wrong entries, mistaken identity and duplicate entries
Wrong entries involve debts that do not exist, have already been settled, or were reported with the wrong amount. Mistaken identity mainly affects people who share a name and distorts entire payment histories. Duplicate entries arise when a creditor and a debt collection agency report the same debt separately.
Art. 16 GDPR corrects inaccurate data. Where it was processed unlawfully, the right to erasure under Art. 17(1)(d) GDPR applies. Where a loss is established, Art. 82(1) GDPR applies in addition.
Outdated entries and unjustified enquiries
Once the storage period has expired, the entry must disappear. On 7 December 2023 the CJEU held that private credit agencies may not store information about a granted discharge of residual debt (Restschuldbefreiung) for longer than the public register it comes from (joined cases C-26/22 and C-64/22).
In the insolvency announcements portal, this publication is deleted under § 3(2) in conjunction with paragraph 1 sentence 1 InsBekV at the latest six months after the decision on the discharge of residual debt becomes final.
Every enquiry also needs a legal basis. Art. 6(1) GDPR covers a credit enquiry where you have consented, where it serves to negotiate or perform a contract, or where a legitimate interest outweighs your interests. If none of these grounds applies, the data was processed unlawfully and must be erased without delay under Art. 17(1)(d) GDPR.
Enforcing a challenge and claiming damages
The sequence is always the same: request the data copy, name the incorrect items, demand rectification or erasure with a deadline, and escalate if refused. If the correction fails to happen, Art. 82(1) GDPR applies.
§ 824(1) BGB stands alongside it. The provision protects another person’s credit against untrue factual assertions and applies to businesses just as it does to private individuals whose livelihood or advancement is endangered.
Process and deadlines for the challenge
Request the data copy under Art. 15(3) GDPR from every agency that may be relevant. The first copy is free; a fee may be charged only for further copies of the same data, and a new request at a later date is free of charge again, unless it is manifestly unfounded or excessive (Art. 15(3) sentence 2, Art. 12(5) sentence 2 GDPR). Then name every entry you object to individually, with a reason.
Under Art. 12(3) GDPR the agency must inform you of the measures taken within one month of receiving the request. If it refuses, a complaint under Art. 77(1) GDPR and a claim before the civil courts are both open to you, side by side.
Claims become time-barred after three years under § 195 BGB. Under § 199(1) BGB the period begins at the end of the year in which the claim arose and you obtained knowledge, or should have obtained knowledge without gross negligence, of the circumstances giving rise to the claim and the identity of the debtor.
Damages for an incorrect credit report
Art. 82(1) GDPR gives every person compensation for material and non-material loss arising from a breach of the Regulation. Material loss includes the higher interest rate, the collapsed financing, the lost supplier relationship.
For the non-material part, the CJEU held on 4 May 2023 that Art. 82(1) GDPR precludes a national rule or practice that makes compensation conditional on a particular degree of seriousness (C-300/21). You must still set out the loss itself.
§ 824(1) BGB applies in addition where an untrue factual assertion endangers creditworthiness. The claim exists even where the reporting party does not know the assertion is untrue but ought to know it.
Further information
These topics may also be of interest:
This information does not constitute legal advice in an individual case.
