
SCHUFA shadow database: what data subjects should know
SCHUFA is alleged to continue processing data that has supposedly been deleted. What is known, what Art. 15 and 17 GDPR require and what data subjects can do.
Read articleAnyone who has come through personal insolvency wants a fresh start. In December 2023, the CJEU (Court of Justice of the European Union) clarified how long SCHUFA may store the information on the discharge of residual debt.
Joined Cases C-26/22 and C-64/22 concerned two data subjects who had been granted a discharge of residual debt (Restschuldbefreiung). In the public insolvency register, this information was deleted after six months. SCHUFA, however, stored it in its own database for considerably longer, namely three years. The Wiesbaden Administrative Court (Verwaltungsgericht) referred to the CJEU (Court of Justice of the European Union) the question of whether this is permissible.
In its judgment of 7 December 2023, the Court ruled that private credit agencies may not store information on the granting of a discharge of residual debt that they have taken from a public register for longer than the register itself. If the data must be deleted there after six months, it cannot be kept by the credit agency for a further two and a half years. After this period has expired, data subjects have a right to erasure.
Important for putting this in context: in December 2025 (I ZR 97/25), the BGH (Federal Court of Justice) clarified that this case law concerns data originating from public registers. Payment defaults reported by creditors themselves are subject to their own standards.
If you have completed personal insolvency proceedings (Privatinsolvenz) with a discharge of residual debt, it is worth requesting access to your data from SCHUFA (Selbstauskunft). If the information is still listed there more than six months after the public notice of the discharge of residual debt, you can request its erasure. If you have questions about personal insolvency itself, you can contact me at any time.
Affected by a SCHUFA entry? Take the SCHUFA check and instruct me directly.

SCHUFA is alleged to continue processing data that has supposedly been deleted. What is known, what Art. 15 and 17 GDPR require and what data subjects can do.
Read article
Art. 13 Data Act reviews unilaterally imposed data clauses between businesses: scope, black and grey list, legal consequences.
Read article
The BGH sets out what determines the amount of GDPR damages: punitive character or deterrence are not criteria.
Read article