What is changing with the 2026 Schufa score
Schufa switched over its creditworthiness score on 17 March 2026. The new score, which Schufa calls NextGen Score 1.0, replaces the base score for consumers and works on a scale of 100 to 999. Schufa will keep supplying the six industry scores to businesses until the end of 2028.
For the first time, Schufa publishes all twelve assessment criteria along with the point scale that belongs to each one. Consumers can see their score and the criteria free of charge in the Schufa account.
Address data still feeds into the score, just not on a location basis. For the regular calculation under the twelve criteria, Schufa does not use geodata. The age of the current address counts as its own criterion and ranges from 0 to 94 points; the full score is reached after 20 years at the same address.
Where no creditworthiness-relevant data exists for a person, Schufa can, at the request of the enquiring business, calculate a regional score based on the neighbourhood as an exception. The CJEU ruling C-634/21 of 7 December 2023 concerns a different question, namely whether scoring qualifies as an automated individual decision under Art. 22 GDPR.
The CJEU ruling on scoring and Art. 22 GDPR
On 7 December 2023 (C-634/21) the CJEU ruled that a credit reference agency merely establishing a probability value already amounts to a decision within the meaning of Art. 22(1) GDPR, as soon as a bank bases its lending decision on it. Such decisions are in principle prohibited.
Scoring remains permissible under the exceptions in Art. 22(2) GDPR. Until 19 November 2026, Section 31 BDSG may serve as the German legal basis: among other things, it requires a scientifically recognised mathematical and statistical procedure, and it prohibits basing the probability value solely on address data.
From 20 November 2026, the new Section 37a BDSG replaces Section 31 BDSG (Act of 12 May 2026, BGBl. 2026 I no. 139).
The right under Art. 22(1) GDPR not to be subject to a decision based solely on automated processing then does not apply, beyond the exceptions in Art. 22(2)(a) and (c) GDPR, where scores for the decision on a contract with you, or scores by credit agencies on your ability and willingness to pay that take information about debts into account, are created or used, Section 37a(1) BDSG.
Such scores are then permissible only where neither special categories of personal data nor age, gender, name, data from social networks, account transactions or address data are used to create them, they do not concern minors, and the procedure is scientifically recognised, Section 37a(2) BDSG. From that date, the address criterion and the regional score must also be measured against this.
From that date, the creator of the score must, on request and within the period under Art. 12(3) GDPR, disclose the data and criteria used, the weighting of the most influential criteria, the informative value of the specific score, and the values created and their recipients, Section 37a(4) BDSG.
Against the business that makes a decision on the basis of the score, you have the right to contest the decision, to express your own point of view and to have the decision taken by a natural person, Section 37a(5) BDSG.
According to the wording of Art. 22(3) GDPR, a right to have a person review the decision exists under the exceptions for contract performance and explicit consent.
The underlying proceedings were decided by the Wiesbaden Administrative Court on 19 November 2025 (case no. 6 K 788/20.WI), which granted leave to appeal and to bring a leapfrog appeal on points of law. It ordered the Hessian Commissioner for Data Protection and Freedom of Information to take action against Schufa so that Schufa gives the claimant information on the data used, its weighting and the reasoning behind the risk classification.
How far the right of access under Art. 15(1)(h) GDPR extends for scores is pending before the Federal Court of Justice (case nos. I ZR 227/25 to I ZR 230/25). The judgment is scheduled to be delivered on 21 October 2026.
How the new score is calculated
The twelve criteria are published, each together with the number of points it can contribute. Anyone who knows them can see in their own report which entries support the value and which pull it down.
The twelve criteria of the new Schufa score
Twelve criteria determine the score. Payment defaults carry the greatest weight: anyone with none in the past three years receives 264 points for it. The lowest maximum value goes to credit status, at 19 points for credit successfully repaid.
Further criteria are the age of the oldest bank account, the age of the oldest credit card, the age of the current address and the age of the most recent credit line.
Added to these are enquiries and agreements for current accounts and credit cards, and enquiries outside the banking sector, each covering the past twelve months, instalment loans taken out in that period, the longest remaining term of all instalment loans, credit status, a property loan and whether an identity check has taken place.
Enquiries in the score and their retention period
Schufa states that it deletes (credit) enquiries after twelve months. The code of conduct of the credit reporting agencies (section IV.6) generally allows credit agencies to store them for at least one year and at most three years; on request of the data subject, storage ends after one year.
The enquiries of the past twelve months feed into the score, in two of the twelve criteria: enquiries and agreements for current accounts and credit cards, and enquiries outside the banking sector.
For the second of these criteria, Schufa applies a rule: all enquiries made within 28 days count only once. Which enquiries are stored about you and by whom is shown in the data copy under Art. 15 GDPR.
Legal options where the score is wrong
If your Schufa report contains incorrect data, or the score was used unlawfully, three claims under the GDPR apply: rectification under Art. 16, information on the logic of the decision under Art. 15(1)(h), and damages under Art. 82.
How to challenge an incorrect credit report and under what conditions a claim for damages under Art. 82 GDPR arises are covered in two related articles.
Rectification under Art. 16 GDPR and your data copy
First request the free data copy under Art. 15(3) GDPR. If it contains incorrect entries, Art. 16 GDPR entitles you to prompt rectification, or to completion where the data is incomplete.
Schufa must also inform every recipient to whom it disclosed the data about the rectification; this obligation is set out in Art. 19 GDPR. It must respond to your request without undue delay under Art. 12(3) GDPR, at the latest within one month.
If no response follows, we enforce the claim.
Damages for score errors
If a faulty score has caused you loss, for example through a rejected loan, a refused tenancy agreement or excessive interest, you are entitled to damages under Art. 82(1) GDPR. The claim covers both material and non-material loss.
On 18 November 2024, in proceedings concerning the scraping of Facebook data, the Federal Court of Justice (BGH) ruled (case no. VI ZR 10/24) that even the brief loss of control over one’s own personal data can amount to non-material damage. The court does not require proof that the data was misused; the case did not concern a credit agency.
We document the loss and enforce the claim.
Further information
These topics may also interest you:
