SCHUFA entry: when deletion succeeds — and when it does not

Who decides on the entry

SCHUFA does not act on its own initiative. It collects and processes data on behalf of its contractual partners — banks, mail-order retailers, telecommunications companies and debt collection agencies (Inkasso) — which report payment defaults to it and, in return, retrieve credit reports on their own customers. From these reports, an algorithm calculates a score intended to indicate how likely it is that a person will meet their payment obligations. Legally, this is data processing within the meaning of the GDPR — with all the rights that data subjects derive from it: access, rectification, erasure.

When an entry is lawful

For a negative entry to be lawful at all, strict requirements must be met (§ 31(2) BDSG): the claim must be due and must not be disputed, the debtor must have received at least two reminders, the first reminder must have been sent at least four weeks earlier, and the debtor must have been informed in advance of the impending report to a credit agency. If even one of these requirements is missing — for example because the claim was disputed or the notice was not given — the report was unlawful from the outset, and there is a right to deletion, regardless of how long the entry has already been stored.

Settled claims

The situation is different for a claim that was initially reported lawfully and is later paid. Here, the entry — marked as settled — remains stored for a while, because SCHUFA also has a legitimate interest in a past payment default. Exactly how long was specified by the BGH (Federal Court of Justice) in its judgment of 18 December 2025 (I ZR 97/25): the decisive factor is the credit agencies' codes of conduct approved by the competent data protection supervisory authority, which as a rule provide for storage for three years, reduced to 18 months if no further negative data has been added, there are no entries from the register of debtors (Schuldnerverzeichnis) and the claim was settled within 100 days of the report. A right to deletion therefore generally only exists after these periods have expired — not already upon payment itself.

Discharge of residual debt

A special rule applies to the granting of a discharge of residual debt (Restschuldbefreiung) following insolvency proceedings: a credit agency may not store this for longer than it can be viewed in the public insolvency register itself — and that is the case after six months. The CJEU (Court of Justice of the European Union) drew this line in its judgment of 7 December 2023 (C-26/22 and C-64/22); previously, SCHUFA stored this information for three years as well. Anyone who today relies on an older decision that still assumes a three-year period is arguing on the basis of an outdated legal position.

When the action for deletion fails

That an action for deletion can also fail for other reasons is shown by an order of the Frankfurt am Main Higher Regional Court (OLG Frankfurt am Main) of 14 December 2017 (3 U 141/15): a debtor had been ordered by final judgment to pay, and the title was reported correctly. Later, in separate proceedings, he agreed with the lawyer who had made the report that the latter would withdraw the entry — the credit agency nevertheless did not delete it. The court found in its favour: a report that was lawful when made does not become unlawful because the person who made it subsequently withdraws it. The credit agency is not bound by such a withdrawal as long as the original report met the statutory requirements. Anyone who wants to obtain deletion must therefore challenge the lawfulness of the report itself — a subsequent agreement with the creditor alone is not sufficient.

Damages

Where a report was unlawful or remained stored for too long, this does not automatically entail a monetary claim — but the BGH has repeatedly confirmed that data subjects can claim damages if they have actually suffered a disadvantage as a result of the infringement. In one case, a telecommunications company had reported a claim even though it was disputed and not yet established by an enforceable title; the data subject's bank then temporarily put a loan on hold. In its judgment of 28 January 2025 (VI ZR 183/22), the BGH confirmed EUR 500 in non-material damages — not as a penalty, but as compensation for the damage to reputation and the loss of control over one's own data. According to the case law of the CJEU, even a minor but actually experienced disadvantage is sufficient for this; no particular seriousness of the infringement is required.

Conclusion

For data subjects, this means: a SCHUFA entry is not a law of nature. Anyone who has it checked whether the report was lawful from the outset, whether the applicable storage periods were observed and whether the entry caused a specific disadvantage often has better prospects than a first look at the SCHUFA certificate would suggest.

Affected by a SCHUFA entry? Take the SCHUFA check and instruct me directly.