SCHUFA has stored creditworthiness-relevant information on around 68 million people. Data protection and, in particular, the sensitive handling of personal data are at the forefront of our actions.

SCHUFA's services are subject to the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG). In addition, SCHUFA is under the supervision of the Hessian Commissioner for Data Protection and Freedom of Information. The authority has unrestricted access to all data protection-relevant procedures and processes in our company, and we are in continuous communication with each other.

SCHUFA does not currently transfer SCHUFA creditworthiness data to third countries on the basis of standard contractual clauses.

Table of contents

The deletion of the data is carried out automatically to the day on the basis of the specified storage periods. These are based on the approved rules of conduct for checking and storage lists of the Association of Credit Reporting Agencies.

What information is deleted from SCHUFA and when?

Trouble-free loans

• Three years after settlement

(Credit) inquiries

• After twelve months

Trouble-free contracts (current accounts, basic accounts, credit cards)

• Immediately after notification of the termination/termination by the company to SCHUFA

Attachment protection accounts, basic accounts

• Immediately after notification of the termination/termination by the company to SCHUFA

Data from debtor directories

• After three years, but earlier if SCHUFA is provided with proof of deletion by the central enforcement court

Information on consumer insolvency proceedings

• Deletion takes place immediately after deletion from the public register.

Information on the granting of residual debt discharge proceedings

• Deletion takes place immediately after deletion from the public register. Publication currently takes place for a period of six months.

Rejected insolvency proceedings or refusal of residual debt discharge

• Deletion is mirrored to the respective directory in which the information was published (six months or three years to the day)

Information on unfulfilled payment obligations such as
e.g. undisputed, due and repeatedly reminded or titled claims

• Deletion takes place three years to the day after settlement. In deviation from this, storage ends after 18 months if (1) no further negative data has been reported to SCHUFA by this time, (2) no information from the debtor register or from insolvency announcements is available and (3) the claim has been settled within 100 days of registration.
• Upon expiry of the retention period for the information on the granting of residual debt discharge, the retention period for the claims recognizably covered by the proceedings shall also end.

Compliance lists - currently assignable entries from PeP and sanctions lists

• Information on entries on lists of Politically Exposed Persons (PEPs) and sanctions lists is based exclusively on official lists, in particular those published by government authorities.
• If entries are removed from these public lists by the issuer, this is automatically reflected in the SCHUFA with the next update. PeP lists are updated weekly and sanction lists are updated every working day.

The statistics show: After settling outstanding and long overdue debts, people have an increased risk of defaulting again even after more than three years compared to people who have fulfilled their payment obligations in accordance with the contract. The fact that settled payment defaults are stored for three years is the result of a balancing of different interests: protecting the economy from payment defaults, protecting people from over-indebtedness and making it easier for them to participate in economic life.

The German legislator had also enshrined this in the BDSG until 2018. With the abolition of the legal regulation due to the introduction of the GDPR, the storage periods were regulated in the Code of Conduct in 2018 and discussed and approved again in 2024.

Prior to the renewed approval in 2024, a hearing was held with the various stakeholders, including the relevant associations of the lending industry and online trade, the Federal Association of Consumer Advice Centers (VZBV) and the Federal Association of Debt Counselors. The retention period of three years is therefore once again the result of weighing up different interests.

"Legitimate interest" is a prerequisite for data transfer.

With the GDPR, consumers no longer need to give their specific consent by signing a so-called "SCHUFA clause". The legal basis for the transfer of data to SCHUFA is the existence of a "legitimate interest" in data processing. This is legally regulated by Art. 6 para. 1 letter f) GDPR.

As before, the following applies to payment defaults, i.e. outstanding debts: they may only be reported to SCHUFA if the consumer has previously received two reminders, the first reminder was sent at least four weeks ago at the time of reporting to SCHUFA, the claim is undisputed and the consumer has also been informed of the possibility of data transmission to SCHUFA. This procedure is part of the contracts with companies that are affiliated to the SCHUFA procedure.

The General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG) no longer contain any specific regulations on the question of how long credit agencies such as SCHUFA may store and use data.

In order to create legal certainty and clarity for consumers - but also for companies - the credit agencies in Germany, represented by the association "Die Wirtschaftsauskunfteien e.V.", together with representatives of the Data Protection Conference (DSK), which consists of the independent data protection authorities of the federal and state governments, have agreed a Code of Conduct (CoC) to regulate the review and retention periods. The CoC was first approved in May 2018 and had a term of 6 years until May 25, 2024. It was therefore renegotiated in spring 2024.

The CoC creates a uniform standard for all credit agencies that have joined the CoC. Consumers want to fulfill their financial wishes quickly, securely and easily - lending companies want to reduce the risk of payment default. The CoC regulates how both interests can be brought together.

SCHUFA is a member of the association One of the association's main concerns is to set quality standards for the industry. This applies above all to the area of data protection, which is particularly important to the credit agencies.

In addition to the GDPR, the association's sets out standardized review and deletion periods for personal data. All member companies have undertaken to comply with these rules of conduct for the erasure of data.

Is compliance with the deletion deadlines monitored?

Compliance with the association's quality standards is monitored by an independent monitoring body.

If there are any discrepancies regarding data storage or compliance with deletion deadlines, you can contact them. The complaints office can clarify your concerns without you having to involve a lawyer.

Contact details of the monitoring body:

TIGGES DCO GmbH
- Complaint credit agencies -
Zollhof 8, 40221 Düsseldorf
Phone: +49 211 819982-70
E-Mail:
Online: