Schufa and Article 21 of the GDPR: A comprehensive guide for consumers
Schufa Holding AG, the most important credit reference agency in Germany, processes millions of personal data every year. It is often criticised because the storage and processing of this data deeply interferes with the rights of those affected. However, with the General Data Protection Regulation (GDPR), consumers have been given new opportunities to defend themselves against unlawful data processing. In particular, Article 21 of the GDPR, which regulates the right to object, plays a crucial role here. In this article, you will learn how consumers can exercise their rights, what the legal basis is and what landmark rulings there are.
What does Article 21 of the GDPR regulate?
Article 21 of the GDPR grants consumers the right to object to the processing of their personal data at any time if this is based on points (e) or (f) of Article 6(1). This is particularly relevant for Schufa, as it often justifies processing with a ‘legitimate interest’.
The most important aspects of the right to object:
1. Legal basis: The processing of Schufa data is usually justified by the legitimate interest of companies such as banks or landlords.
2. Particular personal situation: Consumers can object if they can demonstrate reasons arising from their particular situation.
3. Direct marketing: If the processing is used for direct marketing, the objection is absolute and requires no justification.
In which cases can consumers object?
1. incorrect or outdated data
Incorrect or outdated data held by Schufa can have serious consequences for those affected. A well-known example is the case of a consumer who successfully sued Schufa in 2020 before the Regional Court of Mainz (Az. 3 O 12/20) for the storage of a claim that had long since been settled. The court ruled that such data disproportionately affects the rights of the consumer and must therefore be deleted.
2. Excessive processing of personal data
Another example is the 2021 ruling by the Higher Regional Court of Dresden (case no. 4 U 1158/21). In this case, Schufa had stored data relating to a mobile phone contract that had long since been fulfilled. The court ruled that the long-term storage of this data was not compatible with the principle of data minimisation under Article 5 of the GDPR.
3. Unauthorised reporting of disputed claims
In the case of a consumer who took legal action at the Hamburg District Court (Az. 13 U 70/23) in 2023, a disputed claim was reported to Schufa by Barclays Bank. The court awarded the plaintiff 4,000 euros in damages and ruled that disputed claims may not be reported as long as they have not been legally resolved.
4. Guarantees and excessive financial demands
A prominent case from 2025 shows how consumers can successfully take action against Schufa. A woman was financially overburdened by a guarantee for her ex-husband and was no longer able to get a loan due to a Schufa entry. The Karlsruhe District Court (Az. 7 O 118/24) ruled that the entry had to be deleted and the score adjusted because the guarantee was immoral.
How can consumers file an objection?
An objection to data processing by Schufa should be well prepared and carefully documented.
Steps for a successful objection:
1. Formulating the objection: The objection should be formulated in writing and as precisely as possible.
2. Sending it by registered mail: It is recommended that you send the objection by registered mail with return receipt in order to have proof of delivery.
3. Stating the reasons: Specify exactly which data processing you are objecting to and your personal reasons.
4. Add supporting documents: Attach relevant documents such as payment receipts or contracts to support your arguments.
What happens after the objection?
After receiving the objection, Schufa is obliged to review the case. Consumers have the right to be informed of the outcome within a reasonable period of time.
Possible outcomes:
• Deletion or correction: Incorrect or unlawfully stored data is deleted or corrected.
• Restriction of processing: In certain cases, the processing of the data can be restricted until clarification.
• Rejection of the objection: If Schufa considers the objection to be unfounded, it must explain this in writing.
Case law: Milestones in dealing with Schufa entries
Obligation to delete after claims have been settled
In 2025, the Karlsruhe District Court (Az. 7 O 118/24) ruled that claims must be deleted from the Schufa database no later than one year after they have been settled. The court made it clear that longer storage periods are not proportionate.
Correction of the credit score
The Düsseldorf District Court (Az. 14d O 39/08) ruled that the Schufa score must also be adjusted when unlawful entries are deleted. Incorrect data must not be included in the calculation of the score.
Compensation for those affected
In the case of a consumer before the Hamburg District Court (Az. 19 O 12/23), compensation of €2,000 was awarded in 2023 because an unfounded claim was not deleted in time.
Storage of ‘soft negative features’
The District Court of Wedding (Az. 6b C 243/98) ruled as early as 1998 that ‘soft negative features’ such as late payments may only be reported if a clear inability or unwillingness to pay is proven.
Impact on consumers and businesses
The increasing strengthening of consumer rights has far-reaching consequences:
For consumers:
• Consumers can have unlawful entries deleted and their credit rating restored.
• They are entitled to compensation if their rights are violated.
For businesses:
• Banks and other data reporters must check more carefully which data they report to Schufa.
• Schufa is under growing pressure to revise its storage periods and processing practices.
Conclusion
The legal developments in the area of Schufa data processing show that consumers can successfully enforce their rights. With the GDPR and landmark rulings, courts have made it clear that data protection is a fundamental right that also applies to large institutions such as Schufa. Consumers should know their rights in order to take action against unlawful entries. At the same time, institutions such as Schufa must adapt their practices more closely to legal and ethical standards.
For further information and individual advice, we recommend the website of Dr Thomas Schulte. There you will find valuable information on topics such as deleting Schufa entries and data protection law. Benefit from in-depth expertise and learn how to effectively enforce your consumer rights!
For legal support in Germany, visit Twój Adwokat w Niemczech. Learn more about deleting Schufa entries and your rights under data protection law in Germany.