Storage periods after payment: three years or 18 months
For payment defaults that a contracting party reports to a credit agency, the codes of conduct approved by the supervisory authorities under Art. 40 GDPR provide for a basic storage period of three years. The Bundesgerichtshof (BGH) approved this rule on 18.12.2025 (I ZR 97/25).
Storage shortens to 18 months under three conditions: the debt was settled within 100 days of the report, no further negative data has been reported, and there is no entry for the debt in a public register. If any one of these is missing, the three year period applies.
Following the BGH’s decision, the deletion period of a public register does not dictate the permissible storage period of this reported data. The court set aside the appellate judgment of the Oberlandesgericht Köln of 10.04.2025 and referred the case back.
The CJEU judgments on storage duration and scoring
On 07.12.2023 the CJEU handed down two decisions concerning Schufa. One concerns data from a public register, the other the score value. In the joined cases C-26/22 and C-64/22 the issue was data on discharge of residual debt from the public insolvency register. Under the judgment, storage of such data by a credit agency beyond the register’s six month period can no longer be based on Art. 6(1)(f) GDPR.
The six months derive from § 3 InsoBekV. Case C-634/21 concerned the score value itself: it can constitute an automated decision within the meaning of Art. 22(1) GDPR where a third party makes its contractual decision substantially dependent on it.
Enforcing deletion: request, complaint, litigation
The credit agency and the reporting company are each independent controllers within the meaning of Art. 4(7) GDPR. A deletion request should therefore be addressed to both at the same time.
The path has three stages: a request under Art. 17 GDPR, a complaint to the supervisory authority under Art. 77 GDPR, and litigation before the civil courts. Each stage is open independently of the others.
Deletion request to Schufa and the creditor
Address the deletion request under Art. 17 GDPR to Schufa and to the reporting company at the same time. Base it on the lack of necessity for storage under Art. 17(1)(a) GDPR. Argue that the balancing of interests turns out differently once the debt has been settled, Art. 6(1)(f) GDPR.
State the date of settlement and the date of the report. Both dates determine the 18 month period. The controller must respond without undue delay, at the latest within one month of receiving the request; for complex or numerous requests this period is extended by two months (Art. 12(3) GDPR).
Complaint to the data protection authority and litigation
If Schufa refuses deletion, you may complain to a supervisory authority. Art. 77(1) GDPR allows you to choose the authority of your place of residence, your place of work, or the place of the alleged infringement.
Independently of this, you can sue before the civil courts for deletion under Art. 17 GDPR and for damages under Art. 82 GDPR. Both routes run alongside each other. Which succeeds depends on whether storage exceeds the periods set by the approved codes of conduct, or whether the data originates from a public register.
Damages and costs for unlawful storage
If storage exceeds the permitted period, a claim for damages under Art. 82(1) GDPR may arise. The provision covers both material and non-material damage.
Material damage covers measurable disadvantages such as a higher interest rate or the cost of alternative financing. Non-material damage is impairment without a monetary value. Under Art. 82(3) GDPR, the controller is liable unless it proves it bears no responsibility whatsoever for the event causing the damage.
Damages under Art. 82 GDPR
You must set out the damage yourself. Document credit refusals, rejected tenancy applications and failed contracts, each with the date and the other side’s letter.
The course of proceedings in case I ZR 97/25 shows the range of outcomes. The Landgericht Bonn dismissed the claim on 21.06.2024; the Oberlandesgericht Köln awarded the claimant damages of 1.040,50 euros plus interest on 10.04.2025.
The Bundesgerichtshof set this judgment aside on 18.12.2025 and referred the case back, because the appellate court had misapplied the approved codes of conduct. A claim therefore only exists once storage exceeds these rules.
Legal fees and cost risk
Statutory fees are based on the RVG and the value of the matter. For court proceedings, § 91(1) ZPO governs reimbursement: the losing party bears the costs of the litigation, including the other side’s necessary costs.
This rule does not apply out of court. Who bears the costs there is agreed separately in any settlement. Whether your legal expenses insurance covers the case is something we clarify through a request for cover before accepting the mandate.
Further information
These topics may also be of interest:
This information does not constitute legal advice in an individual case.
