SCHUFA has stored credit-related information on approximately 68 million individuals. Data protection—and, in particular, the careful handling of personal data—is our top priority.

SCHUFA’s services are subject to the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG). In addition, SCHUFA is supervised by the Hessian Commissioner for Data Protection and Freedom of Information. The authority has unrestricted access to all data protection-related procedures and processes within our organization, and we maintain an ongoing dialogue with them.

SCHUFA does not currently transfer SCHUFA credit data to third countries based on standard contractual clauses.

Table of Contents

Data is deleted automatically on a specific date based on the specified retention periods. These are governed by the approved guidelines for review and retention periods issued by the Association of Credit Reporting Agencies.

What information is deleted from SCHUFA, and when?

Loans Without Delinquencies

• Three years after settlement

(Loan) Inquiries

• After twelve months

Contracts Without Issues (Checking Accounts, Basic Accounts, Credit Cards)

• Immediately after the company notifies SCHUFA of the termination or cancellation

Seizure-Protected Accounts, Basic Accounts

• Immediately after the company notifies SCHUFA of the termination or cancellation

Data from debtor registries

• After three years, but earlier if SCHUFA is provided with proof of deletion by the central enforcement court

Information on Consumer Bankruptcy Proceedings

• Deletion takes place immediately after removal from the public registry.

Information on the Granting of Discharge from Remaining Debts

• Deletion takes place immediately after removal from the public registry. Currently, the entry remains published for a period of six months.

Dismissed bankruptcy proceedings or denial of discharge of remaining debt

• Deletion occurs in accordance with the respective directory in which the information was published (six months or three years, to the day)

Information regarding unfulfilled payment obligations,such as
—e.g., undisputed, past-due claims that have been the subject of multiple reminders or for which a judgment has been issued

• Records are deleted exactly three years after the claim has been settled. Notwithstanding this, storage ends after only 18 months if (1) no further negative data has been reported to SCHUFA by that time, (2) there is no information from the debtor registry or from insolvency notices, and (3) the claim was settled within 100 days of being reported.
• Upon expiration of the retention period for information regarding the granting of residual debt discharge, the retention period for claims clearly covered by the proceedings also ends.

Compliance Lists – Entries Currently Matching PEP and Sanctions Lists

• Information regarding entries on lists of politically exposed persons (PEPs) and sanctions lists is based exclusively on official lists, such as those published by government agencies.
• If entries are removed from these public lists by the publisher, this change is automatically reflected in the SCHUFA database during the next update. PeP lists are updated weekly, and sanctions lists are updated on business days.

Statistics show that even more than three years after settling outstanding and long-overdue debts, people still face a higher risk of defaulting again compared to those who have fulfilled their payment obligations as stipulated in their contracts. The fact that resolved payment defaults are retained for three years is the result of balancing various interests: protecting the economy from payment defaults, protecting individuals from excessive debt, and facilitating their participation in economic life.

German lawmakers had also enshrined this provision in the BDSG until 2018. When the statutory provision was repealed due to the introduction of the GDPR, the retention periods were regulated in the Code of Conduct in 2018 and were discussed and approved again in 2024.

Prior to the renewal of the authorization in 2024, a hearing was held with various stakeholders, including the relevant associations representing the lending industry and online retail, the Federal Association of Consumer Advice Centers (VZBV), and the Federal Working Group of Debt Counseling Services. The three-year retention period is thus once again the result of a balancing of various interests.

"Legitimate interest" is a prerequisite for data transfer.

Under the GDPR, it is no longer necessary for the consumer to provide specific consent by signing a so-called “SCHUFA clause.” The legal basis for transferring data to SCHUFA is the existence of a “legitimate interest” in data processing. This is governed by Article 6(1)(f) of the GDPR.

As before, the following applies to payment defaults, i.e., outstanding debts: They may only be reported to SCHUFA if the consumer has previously received two reminders, the first reminder was issued at least four weeks prior to the date of reporting to SCHUFA, the debt is undisputed, and the consumer has been informed of the possibility that the information may be reported to SCHUFA. This procedure is an integral part of contracts with companies that participate in the SCHUFA system.

The General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG) no longer contain specific provisions regarding how long credit bureaus such as SCHUFA may store and use data.

To provide legal certainty and clarity for consumers—as well as for businesses—credit reporting agencies in Germany, represented by the association “Die Wirtschaftsauskunfteien e.V.,” together with representatives of the Data Protection Conference (DSK)—which consists of the independent federal and state data protection authorities—agreed on a Code of Conduct (CoC) to regulate review and retention periods. The CoC was first approved in May 2018 and was valid for 6 years, until May 25, 2024. It was therefore renegotiated in the spring of 2024.

The CoC establishes a uniform standard for all credit reporting agencies that have joined the CoC. Consumers want to fulfill their financial goals quickly, securely, and easily—while lenders want to reduce the risk of default. The CoC sets out how these two interests can be reconciled.

SCHUFA is a member of the association : One of the association’s primary goals is to establish quality standards for the industry. This applies above all to the area of data protection, which is of particular importance to credit reporting agencies.

The association’s establishes uniform review and retention periods for personal data, supplementing the GDPR. All member companies have committed to complying with these rules of conduct regarding the deletion of data.

Is compliance with the retention periods monitored?

Compliance with the association's quality standards is monitored by an independent oversight body.

If there are any issues regarding data storage or compliance with retention periods, you can contact them. The complaints office can help resolve your issue without you having to involve a lawyer.

Contact information for the supervisory authority:

TIGGES DCO GmbH
- Complaints About Credit Bureaus -
Zollhof 8, 40221 Düsseldorf
Phone: +49 211 819982-70
Email:
Online: