Germany
SCHUFA Eintrag löschen: What You Can Actually Get Removed, and What You Cannot
Independently fact-checked against primary sources (last audited July 20, 2026). · 11 primary sources cited on this page. How we verify our legal content

A SCHUFA entry can feel like it controls your life in Germany: whether you get an apartment, a phone contract, or a loan. The good news for anyone starting from scratch is that the most useful tool for dealing with it, a full copy of what SCHUFA actually holds on you, is completely free and takes a few minutes to request. The bad news is that a widely repeated claim, that any negative entry disappears eighteen months after you pay it off, is not the rule the Bundesgerichtshof (BGH) actually set. This page separates what you can get deleted, what you can only get corrected, and what simply has to run its course.
This page works through what SCHUFA stores and what a score actually is, the free rights you have under the DSGVO to see it, correct it, and object to it, what the December 2025 BGH ruling changed and did not change, the separate six month rule that applies specifically after a Privatinsolvenz, and the free Ombudsmann route for a dispute that a written request alone does not resolve.
Information last verified on 20 July 2026. This page provides general legal information and does not constitute legal advice in an individual case.
What SCHUFA actually stores, and what a score is
SCHUFA Holding AG is Germany's largest private credit reporting agency (Wirtschaftsauskunftei). Banks, landlords, mobile phone providers, and online retailers ask it, with your consent as part of signing up, whether it holds information suggesting you are a payment risk. SCHUFA does not decide whether you get the apartment or the loan. It supplies information, and often a score, that the company you are dealing with then weighs alongside its own criteria.
What it stores falls broadly into two groups. The first is neutral, structural information: your name, address history, and details of accounts and contracts you hold, most of which is reported by the banks and companies you already do business with, not evidence of anything going wrong. The second is negative information (Negativmerkmale): a missed payment reported by a creditor, a Vollstreckungsbescheid, a formal enforcement measure, or an insolvency filing. § 31 BDSG specifically regulates how a Wirtschaftsauskunftei may calculate and use a score, requiring that the underlying data be demonstrably suitable for predicting payment behaviour rather than arbitrary.
A score itself is a probability estimate, not a fact about you. It is calculated from the stored data using a method SCHUFA does not have to publish in full, though under Art. 15 DSGVO it must tell you, on request, the significance and the general logic behind how it is derived.
The free right that matters most: the Datenkopie under Art. 15 DSGVO
Before anything else, request a Datenkopie: a full copy of every piece of personal data SCHUFA holds about you, the source of each entry, who it has been shared with in the past twelve months, and the score categories used. Art. 15 DSGVO guarantees this right to anyone, at no cost, once a year at minimum, and SCHUFA provides an online self-service portal (Meine SCHUFA) for exactly this purpose alongside the option of a written postal request.
This is worth stating plainly because it gets buried under paid credit monitoring advertising: you do not need to pay for a subscription product to see what SCHUFA holds on you. A Selbstauskunft, the free version of this report, shows the same underlying entries that a paid product repackages with extra dashboards and alerts. Start with the free report every time, and only consider anything paid, if at all, for ongoing monitoring after you have already confirmed what is currently on file.
Worked example
Someone applying for an apartment gets turned down after the landlord runs a SCHUFA check, with no explanation beyond a low score. Rather than guessing, they request a Datenkopie through the Meine SCHUFA portal. It arrives within the statutory month and shows a two year old mobile phone contract default that was actually settled and should have been marked as paid. That single entry, not some vague overall risk profile, was dragging the score down, and it is now something concrete to act on rather than a mystery.
Getting a genuinely wrong entry corrected
Art. 16 DSGVO gives you the right to have inaccurate personal data corrected without undue delay. This is the tool for a factually wrong entry: a debt reported that was never yours, an amount that is wrong, a status that still shows unpaid after you settled it, or a duplicate entry for the same debt. Write to SCHUFA, cite the specific entry from your Datenkopie, explain what is wrong, and where possible attach proof, a payment confirmation, a bank statement, a letter from the creditor confirming settlement.
It is worth being direct about the limit of this right. Art. 16 corrects facts. It does not remove an entry simply because you find it embarrassing, because a landlord might see it, or because you have since improved your finances. A late payment that genuinely happened and is accurately dated is not wrong merely because you would rather it were not there. The distinction between wrong, which is correctable, and unwelcome but accurate, which generally is not, is the single most common source of frustration in this process, and understanding it early saves a lot of wasted correspondence.
Where the entry originated with a specific creditor, for example a bank or a mobile provider that reported a default it should not have, it is often faster to raise the correction directly with that creditor as well, since SCHUFA itself is not always the source of the underlying error and cannot correct data at its root without the reporting party's confirmation.
What the December 2025 BGH ruling actually decided
On 18 December 2025 the Bundesgerichtshof decided I ZR 97/25, a case about how long SCHUFA may keep a negative entry after the underlying claim has been settled. The court held that a settled negative entry does not have to be deleted immediately the moment payment is confirmed. It rejected the argument that a public register's own faster deletion rule for a comparable claim should automatically carry over to a private credit bureau's retention of the same kind of information.
What the ruling did not do is set a specific number of months as a universal rule. The retention periods actually in play come from the credit reporting industry's own code of conduct, which the BGH's reasoning treated as a legitimate basis rather than something it invented. Under that code, the general retention period for a settled negative entry is three years. It can shorten to 18 months only where a specific combination applies: the underlying claim was settled promptly after being reported, no further negative entry has since been added, and there is no separate notice from the public insolvency register attached to the same matter.
That conditionality matters. A reader who assumes every paid off debt clears from SCHUFA after 18 months regardless of circumstances is relying on a shortcut the BGH did not actually grant. Whether the shorter period applies depends on the specific facts of the entry, and a Datenkopie is the only way to see which retention clock is actually running on a given entry.
The separate six month rule after a Privatinsolvenz
A discharge following a Privatinsolvenz, a Restschuldbefreiung, is handled differently again, and the source of that rule is easy to misattribute. The figure commonly quoted is six months from the point the discharge decision becomes final, and it comes from § 3 InsBekV, the German ordinance that sets the retention period for the public insolvency register's own electronic notices, not from any EU court decision.
A 2023 ruling by the Court of Justice of the European Union, joined cases C-26/22 and C-64/22, is relevant here but does a narrower job than it is often given credit for. It established the principle that a private credit bureau may not retain insolvency register data for longer than the public register itself retains it. It did not create the six month figure. The six months is the German ordinance's own number; the EuGH ruling simply confirmed that a credit bureau cannot extend that period on its own initiative, which is why SCHUFA's practice on Restschuldbefreiung entries lines up with the register's own six month clock rather than the three year or 18 month figures that apply to an ordinary settled default.
See Privatinsolvenz and the three year path to discharge for how a discharge is actually reached before this six month clock even starts running.
A different case entirely: the 2023 ruling on scoring itself
A separate EuGH ruling from the same day, 7 December 2023, C-634/21, is frequently mixed up with the insolvency data cases above because both involve SCHUFA and both landed the same week. C-634/21 addressed a different question: whether SCHUFA's calculation of a score, where a bank then relies on that score to effectively decide a credit application without meaningfully reviewing it itself, counts as an automated decision under Art. 22 DSGVO, which gives a person the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects them.
The EuGH found that where the bank's own decision is materially predetermined by the score, the scoring itself falls within Art. 22, even though SCHUFA is not the entity making the final lending decision. This is a ruling about how a score gets used downstream, not about how long an entry sits on file, and it should not be cited as authority for a deletion timeline. If you believe a lender relied entirely on an automated SCHUFA score without any real human review of your application, Art. 22 and Art. 21 DSGVO, the right to object to certain processing, are the relevant tools, separate from anything about deletion.
If SCHUFA does not resolve your written request
Where a correction or deletion request is refused, or simply goes unanswered past a reasonable period, two free routes exist before anything involving a fee. The Ombudsmann scheme that SCHUFA and the wider credit reporting industry maintain offers an independent, cost free review of individual disputes. Separately, and at any point, a complaint to the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) under Art. 77 DSGVO is always available, since the authority responsible for SCHUFA Holding AG is the Hessischer Beauftragter für Datenschutz und Informationsfreiheit, since the company is based in Hesse. The federal BfDI is not the right address here: § 9 BDSG confines it to federal public bodies and telecommunications providers.
Neither route requires a lawyer, and neither costs anything to use. For debts SCHUFA is reporting that you cannot currently pay, see debt collection in Germany for how a collection claim actually works, and personal insolvency if debts across several creditors have become unmanageable. General background on German civil law is at German law explained.
Frequently Asked Questions
How do I get a free SCHUFA report?
Request a Datenkopie under Art. 15 DSGVO, either through the free Meine SCHUFA online portal or by written request. It costs nothing, shows every entry SCHUFA holds, and there is no need to buy a paid monitoring product to see this information.
Does a SCHUFA entry get deleted automatically 18 months after I pay off the debt?
Not automatically. The BGH's December 2025 ruling upheld industry conduct rules that set a general three year retention after settlement, shortened to 18 months only where the debt was settled quickly, no further negative entry followed, and there is no separate insolvency register notice on the same claim.
How long does a Restschuldbefreiung stay on my SCHUFA record?
Six months from the point the discharge decision becomes final, under § 3 InsBekV, the German ordinance that sets the public insolvency register's own retention period. A 2023 EuGH ruling confirmed a credit bureau cannot keep that data longer than the register itself does, but the six month figure itself comes from the ordinance, not the court.
Can I get a SCHUFA entry removed just because it is unflattering?
No. Art. 16 DSGVO lets you correct an entry that is factually wrong, such as the wrong amount, an unpaid status after you already paid, or a debt that was never yours. An accurate entry cannot be removed simply because you would prefer it were not there.
What is the difference between the 2025 BGH ruling and the 2023 EuGH scoring ruling?
They answer different questions. The BGH's 2025 ruling is about how long a settled negative entry may be stored. The EuGH's 2023 ruling in C-634/21 is about whether a bank relying heavily on an automated SCHUFA score counts as an automated decision under Art. 22 DSGVO. Neither sets a deletion timeline for the other's issue.
What can I do if SCHUFA refuses to correct or delete an entry?
Use the free Ombudsmann scheme run by the credit reporting industry for an independent review, or file a complaint with the BfDI, the federal data protection authority, under Art. 77 DSGVO. Neither route charges a fee or requires a lawyer.
Is a SCHUFA score the same as a credit decision?
No. SCHUFA supplies information and a score to the company you are dealing with, such as a bank or landlord, but that company makes its own decision. Where a lender's decision is materially predetermined by the score alone, the 2023 EuGH ruling in C-634/21 found that Art. 22 DSGVO can still apply to that scoring step.
Updates
Independently fact-checked against the cited primary sources
The Law Behind This Article
This article rests on the statutory provisions below, held in our own legal record and retrieved from the official source. Tap a section to read the operative text.
General Data Protection Regulation (GDPR)
Art. 15Right of access by the data subjectIn forcecited in 14 of our articles
1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information: (a) the purposes of the processing; (b) the categories of personal data concerned; (c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; (d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; (e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; (f) the right to lodge a complaint with a supervisory authority; (g) where the personal data are not collected from the data subject, any available information as to their source;
Official text (excerpt) · last checked 2026-08-12 · Read the full text in our law library · Verify at eur-lex.europa.eu
Cited in 13 court opinionsMost recently applied by a court: 2025
Leading cases:
- CK v Magistrat der Stadt Wien (Court of Justice of the European Union 2025, C-203/22)
- F.F. v Österreichische Datenschutzbehörde and CRIF GmbH (Court of Justice of the European Union 2023, C-487/21)
- Proceedings brought by J.M (Court of Justice of the European Union 2023, C-579/21)
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Austrian Data Privacy Law (Datenschutz): GDPR, the DSG and the Datenschutzbehörde, How to File a Data Protection Complaint (Beschwerde) with Austria's DSB, GDPR in Austria (DSGVO): How EU Law and the Datenschutzgesetz Work Together
Art. 16Right to rectificationIn forcecited in 2 of our articles
The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Official text (excerpt) · last checked 2026-08-12 · Read the full text in our law library · Verify at eur-lex.europa.eu
Cited in 7 court opinionsMost recently applied by a court: 2025
Leading cases:
- VP v Országos Idegenrendészeti Főigazgatóság (Court of Justice of the European Union 2025, C-247/23)
- RW v Österreichische Post AG (Court of Justice of the European Union 2023, C-154/21)
- F.F. v Österreichische Datenschutzbehörde and CRIF GmbH (Court of Justice of the European Union 2023, C-487/21)
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Art. 17Right to erasure (‘right to be forgotten’)In forcecited in 4 of our articles
1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; (b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing; (c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2); (d) the personal data have been unlawfully processed; (e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject; (f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1). 2.
Official text (excerpt) · last checked 2026-08-12 · Read the full text in our law library · Verify at eur-lex.europa.eu
Cited in 12 court opinionsMost recently applied by a court: 2025
Leading cases:
- TU and RE v Google LLC (Court of Justice of the European Union 2022, C-460/20)
- Proximus NV v Gegevensbeschermingsautoriteit (Court of Justice of the European Union 2022, C-129/21)
- Agentsia po vpisvaniyata v OL (Court of Justice of the European Union 2024, C-200/23)
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: How to Submit a Data Deletion Request (2026)
Art. 21Right to objectIn forcecited in 2 of our articles
1. The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. 2. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. 3. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes. 4.
Official text (excerpt) · last checked 2026-08-12 · Read the full text in our law library · Verify at eur-lex.europa.eu
Cited in 11 court opinionsMost recently applied by a court: 2025
Leading cases:
- Mousse v Commission nationale de l'informatique et des libertés (CNIL) and SNCF Connect (Court of Justice of the European Union 2025, C-394/23)
- Agentsia po vpisvaniyata v OL (Court of Justice of the European Union 2024, C-200/23)
- Proceedings brought by J.M (Court of Justice of the European Union 2023, C-579/21)
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Art. 22Automated individual decision-making, including profilingIn forcecited in 2 of our articles
1. The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. 2. Paragraph 1 shall not apply if the decision: (a) is necessary for entering into, or performance of, a contract between the data subject and a data controller; (b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or (c) is based on the data subject's explicit consent. 3. In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision. 4.
Official text (excerpt) · last checked 2026-08-12 · Read the full text in our law library · Verify at eur-lex.europa.eu
Cited in 6 court opinionsMost recently applied by a court: 2025
Leading cases:
- OQ v Land Hessen (Court of Justice of the European Union 2023, C-634/21)
- CK v Magistrat der Stadt Wien (Court of Justice of the European Union 2025, C-203/22)
- Maximilian Schrems v Meta Platforms Ireland Limited (Court of Justice of the European Union 2024, C-446/21)
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Search our record of EU legislation — GDPR, ePrivacy, AI Act and more, from EUR-Lex →
Sources and References
- Art. 15 DSGVO, Auskunftsrecht der betroffenen Person (Verordnung (EU) 2016/679)(eur-lex.europa.eu).gov
- Art. 16 DSGVO, Recht auf Berichtigung(eur-lex.europa.eu).gov
- Art. 17 DSGVO, Recht auf Löschung(eur-lex.europa.eu).gov
- Art. 21 DSGVO, Widerspruchsrecht(eur-lex.europa.eu).gov
- Art. 22 DSGVO, Automatisierte Entscheidungen im Einzelfall einschließlich Profiling(eur-lex.europa.eu).gov
- § 31 BDSG, Schutz des Wirtschaftsverkehrs bei Scoring und Bonitätsauskunfteien(gesetze-im-internet.de).gov
- § 3 InsBekV, Löschungsfristen für Veröffentlichungen in Insolvenzverfahren(gesetze-im-internet.de).gov
- Bundesgerichtshof, Pressemitteilung Nr. 233/2025 zu Urteil I ZR 97/25 vom 18.12.2025(bundesgerichtshof.de).gov
- EuGH, Urteil vom 07.12.2023, C-634/21 (SCHUFA Scoring, Art. 22 DSGVO)(curia.europa.eu).gov
- EuGH, Urteil vom 07.12.2023, C-26/22 und C-64/22 (Speicherung von Insolvenzdaten)(curia.europa.eu).gov
- Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit, Beschwerde bei der Aufsichtsbehörde (Art. 77 DSGVO)(bfdi.bund.de).gov