SCHUFA processes personal data in order to provide authorized recipients with information to assess the creditworthiness of natural persons and legal entities. It only provides the information if a legitimate interest in this has been credibly demonstrated in the individual case and processing is permissible after weighing up all interests.

The legitimate interest is given in particular before entering into transactions with a financial default risk. The creditworthiness check serves to protect the recipient from losses in the lending business and at the same time opens up the possibility of protecting borrowers from excessive debt through advice. The data is also processed for fraud prevention, integrity checks, money laundering prevention, identity and age checks, address verification, customer care or risk management as well as pricing or conditioning.

SCHUFA's contractual partners are institutions, financial companies and payment service providers that bear a financial default risk (e.g. banks, savings banks, cooperative banks, credit card, factoring and leasing companies) as well as companies, in particular from the (mail order) trade, e-commerce, service, rental, energy supply, telecommunications, insurance or debt collection sectors.

The German legislator also states in the explanatory memorandum to Section 31 BDSG that scoring procedures and credit information systems with the registration of positive and negative data, which are carried out by credit institutions, financial services companies, payment institutions, telecommunications, trading, energy supply and insurance companies or leasing companies, for example, remain permissible in principle. They are still regarded as important prerequisites for economic life.