In one sentence
Schufa (the German credit reference agency) is not a public authority but a private company subject to the GDPR — and from that follow three enforceable rights in a fixed order: first information, then sorting, then rectification, erasure or objection.
First the free copy of your data
The first step is often taken wrongly. Ask for the copy of your data under Art. 15 Abs. 3 DSGVO, not the paid credit report intended for landlords. It is free of charge, requires no reasons and contains more: all entries, their origin, the storage period, the recipients. The statement of origin is the lever — without it you do not know whom you have to object to, and many corrections run via the reporting company.
Then sort: three categories
Assign each entry to a category — which right applies depends on it:
- Factually wrong — never incurred, wrongly quantified, a confusion of names, long since paid. The right that applies is rectification under Art. 16 DSGVO.
- Disputed or ineffective — for instance arising from a contract that was revoked, or a claim never reduced to a title and consistently disputed. Here erasure under Art. 17 DSGVO fits.
- Correct but overdue — the entry was accurate, has been settled and has reached its storage period. That, too, is a case for erasure.
Alongside this stands the objection under Art. 21 DSGVO — it is directed not against the accuracy but against the processing as such. Make each request separately and with a deadline; a blanket “please delete everything” will be refused, because it gives no reviewable ground.
The three-year period is not in the statute
A widespread misconception: the erasure periods for settled negative entries — three years after settlement is the familiar figure — are not in the BDSG but in the code of conduct of the credit reference agencies, a set of industry rules approved by the supervisory authority. That is not a formality: voluntary commitments can be changed and bind differently from statutes.
What is regulated by statute is something else: § 31 BDSG determines when a credit reference agency may include data about claims in a probability value at all — for instance where there is a final title, an express acknowledgement, or two written reminders with prior notification. Whether the provision is compatible with the primacy of the GDPR is contested and unresolved.
What the CJEU decided at the end of 2023
Two decisions of 7 December 2023 shifted the position. In case C-634/21 the Court held that the calculation of a score value can be an automated decision within the meaning of Art. 22 DSGVO where third parties make the conclusion of a contract substantially dependent on it. In joined cases C-26/22 and C-64/22 it held it contrary to EU law for private credit reference agencies to store data about a discharge of residual debt for longer than the public insolvency register — if such an entry remains, that is a request for erasure that can be reasoned, not a plea for goodwill.
Escalation: to the supervisory authority first
If the credit reference agency stands by its refusal, the next step is as a rule not a law firm but a complaint to the supervisory authority (Art. 77 DSGVO). It is free of charge, requires no lawyer and shifts the burden — the agency has to explain to the authority why it is storing the data. Only where there is quantifiable loss — a flat refused, a loan that fell through — or for damages under Art. 82 DSGVO does representation by a lawyer pay off.
What the platform can do — and what it cannot
You can upload the copy of your data and have it structured: which entries there are, who reported them, how long they are stored, which request fits. From that a matter-of-fact letter with a deadline is produced. What it cannot assess is whether a disputed claim really is unfounded — that is what the dispute turns on, and it remains an assessment in the individual case.
→ GDPR access request in the glossary · Use case: GDPR access request · Data protection law · System limits
