General Civil Law2026-10-31

Credit refused over your Schufa score: what information does Schufa owe you?

The bank says no and points to the credit check. What Schufa owes you, the hurdle the Federal Court of Justice set on 21 October 2026, and what applies on top from 20 November 2026.

The bank’s letter runs to two sentences: the loan is declined, the reason being the outcome of the credit assessment. You request your Schufa file and receive a number, but no explanation of how that number came about. Here you will read what you can demand, where the duty to inform stops, and how I obtain that information for you.

In short

Keep two separate claims apart. The copy of your data — which data is stored, where it comes from, who it was disclosed to and what score was calculated — is something Schufa owes you on request, free of charge and, as a rule, within one month. The explanation of the procedure itself, that is, which criteria shaped your score and with what weight, has until now rested on Article 15(1)(h) GDPR and presupposes that the score was a decisive factor in the decision on your contract. From 20 November 2026, section 37a(4) BDSG gives you this content in its own dedicated list, which, on its wording, is triggered simply by the fact that such scores are produced about you.

How I can help you

I draft the request so that it names the content you are entitled to, rather than triggering the standard file disclosure.
I analyse the letter of refusal and tie it, in time, to the transmission of your score to the company.
I examine Schufa’s reply to see whether it meets the claim or merely writes around it.
I have incorrect, settled or outdated entries corrected or erased.
I lodge a complaint with the data protection authority and bring proceedings if the letter does not hold up.
I assess whether, alongside the right of access, a claim for damages comes into consideration.

What Schufa owes you without any further condition

Article 15 GDPR gives you the stored data, the purposes of the processing, and the recipients to whom your data has been disclosed. Added to this, under Article 15(1)(g) GDPR, where the data was not collected from you, is any available information as to its source — with a credit reference agency this is the usual case, meaning the body that reported the entry. Article 15(3) sentence 1 GDPR requires a copy of this data to be provided.

The time limit is set out in Article 12(3) GDPR: without undue delay and in any event within one month of receipt of your request. An extension by two months is possible, but only if Schufa informs you within the first month and gives reasons for the delay. The information is free of charge under Article 12(5) GDPR; for further copies a reasonable fee based on administrative costs may be charged under Article 15(3) sentence 2 GDPR.

What this package does not contain is the logic behind the number. That is precisely where the dispute begins.

The hurdle: your score must have driven the refusal

Article 15(1)(h) GDPR gives you meaningful information about the logic involved, as well as the significance and the envisaged consequences — but expressly in relation to automated decision-making within the meaning of Article 22 GDPR. This claim therefore turns on the features of Article 22(1) GDPR: a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects the data subject.

That the calculation of a score by a credit reference agency can itself be such a decision was held by the Court of Justice of the European Union in its judgment of 7 December 2023 (C-634/21, SCHUFA Holding — Scoring). The Federal Court of Justice (BGH) built on this in four judgments of 21 October 2026 (I ZR 227/25, I ZR 228/25, I ZR 229/25 and I ZR 230/25). The outcome cuts both ways: the Senate accepted that Schufa’s conduct satisfies the features of profiling and of a decision. What remained open was the significant effect — and because the appeal court had made no findings on this point, Schufa’s appeals succeeded; the judgments were set aside and the cases referred back. According to the Senate, the decisive question is whether it depends decisively on the score that the third party to whom the score is transmitted enters into, performs or ends a contractual relationship.

For you this means: without a connection to a specific adverse contractual decision, this claim will, as a rule, not hold. Anyone merely curious about the workings of their own score will get nowhere via Article 15(1)(h) GDPR.

What you must set out — and what is presumed in your favour

The burden of pleading and proof lies with you. In the judgments mentioned, however, the Federal Court of Justice made clear that, in view of the EU-law principle of effectiveness, the requirements must not be set too high. To begin with, it is enough to plead that Schufa transmitted a score to a company and that, in temporal connection with this, an adverse decision was taken in the initiation or performance of a contractual relationship with that company or an associated company. Once this is pleaded and, where necessary, proved, there is a factual presumption that the company’s decision was decisively based on the score.

In practice we therefore work with three documents: the letter of refusal with its date and exact sender, the copy of your data showing the transmission to that particular company and the value transmitted, and your request with proof of delivery. One further point concerns the wording, and this is my assessment from practice in making such requests, not a statement of the Senate: a request that merely asks for “information about the logic” does not identify what is owed — the content demanded must be named, so that the letter can later stand up as the form of order sought in proceedings.

What applies on top from 20 November 2026

By Article 3 of the Act of 12 May 2026 (BGBl. 2026 I No. 139), section 31 BDSG is repealed and a new section 37a BDSG inserted; the provision enters into force on 20 November 2026. Under section 37a(4) BDSG, controllers who produce such probability scores must, on request and within the time limit of Article 12(3) GDPR, state in clear and plain language: the personal data and criteria used, the weighting of the categories of criteria and of the individual criteria relative to one another that most strongly influence the score, the significance of the particular score, and the scores produced and their recipients. The information required for this must be kept for one year. Section 37a(5) BDSG gives you, as against the controller, the right to contest the decision, to put forward your own point of view, and to obtain a decision by a natural person.

Alongside this, a second line of attack emerges. Section 37a(2) BDSG prohibits, for the production of scores, among other things special categories of data, age, sex, names, data from the use of social networks, information on incoming and outgoing payments on bank accounts and address data, and it excludes scores about minors. Anyone who obtains the information can therefore ask not only how the calculation was done, but also whether it was permitted at all. For the lender’s side, the same Act brings additional duties in the case of automated creditworthiness assessment — that is a subject in its own right, which I examine separately within the engagement.

A typical case

A self-employed client applies for a car loan. Two days later the refusal arrives, the reason given being the outcome of the internal assessment. The copy of her data from Schufa shows that, on the day of the enquiry, a score was transmitted to that very bank, and it also shows a debt paid in full two years ago that is still recorded as a negative entry. In a single letter we request both: the information about the logic, naming each item of content, and the correction of the entry. Schufa replies with a general letter about its procedure. That is not yet the information owed; we set a deadline, lodge a complaint with the supervisory authority and prepare proceedings. The temporal proximity between transmission and refusal is the core of what is pleaded.

Common mistakes

The letter of refusal is not kept, or the refusal is given only orally. Without a date and sender, the anchor for the presumption is missing.
The request is framed as a plea for an explanation of the score. It must name the content demanded item by item, otherwise the later form of order sought in proceedings also remains too vague.
Enquiries are made only with the bank. The bank does not owe the logic of the Schufa procedure; it has duties of its own, which are to be kept separate from this.
A general information letter from the credit reference agency is accepted as fulfilment. Describing the procedure only in general terms does not yet name the criteria and their weight in your case — this can be challenged rather than left to stand.
Money is spent on offers to improve the score before it is even established which entries are driving the number.
Damages are claimed without setting out any damage. Article 82(1) GDPR requires material or non-material damage.

Frequently asked questions

Does Schufa have to disclose its calculation formula to me?

No. Article 15(1)(h) GDPR requires meaningful information about the logic involved, as well as the significance and the envisaged consequences, not the handing over of the algorithm. From 20 November 2026, section 37a(4) BDSG spells out the content specifically: the data and criteria used, the weighting of the most strongly influential criteria, the significance of the score, and the scores produced and their recipients. A formula does not appear in this list.

How long may Schufa take to answer?

Under Article 12(3) GDPR it must answer without undue delay, and in any event within one month of receipt of the request. An extension by a further two months is permitted where the complexity or number of requests makes it necessary — in which case it must inform you within the first month and give reasons for the delay. If both are absent, the time limit has been missed.

What does the information cost me?

Nothing. Communications and actions under Articles 15 to 22 GDPR are provided free of charge under Article 12(5) GDPR. Only in the case of manifestly unfounded or excessive requests may a reasonable fee be charged or the action refused, and the burden of demonstrating this lies with Schufa.

Is the information of any use to me if the entry is simply wrong?

Yes, it is the preliminary step. Only once you know which data is stored and where it comes from can you demand, under Article 16 GDPR, the correction of inaccurate data and the completion of incomplete data, and under Article 17 GDPR, erasure — for instance because the data is no longer necessary for the purpose or was processed unlawfully.

Can I complain instead of bringing proceedings?

Both are possible and do not exclude one another. Article 77(1) GDPR gives you the right to lodge a complaint with a supervisory authority, without prejudice to any other judicial remedy. A complaint costs nothing but does not secure an enforceable order — the right of access itself you enforce before the civil court.

Your next step

Gather three things: the letter of refusal with its date, your current copy of your Schufa data and, if you have it, any correspondence so far. Send me these documents and I will tell you whether the route via Article 15(1)(h) GDPR is viable in your case, or whether we use the list that applies from 20 November 2026 — and I will draft the request so that it can later stand up as the form of order sought in proceedings. Depending on the starting position, I will also examine correction, erasure and damages; further subjects in this area can be found under Civil law.

What a first assessment costs I will tell you in advance; my fee is otherwise governed by the RVG or by agreement, and where you have legal expenses insurance I will handle the request for cover. I work throughout Germany, by video or telephone. This article provides general information and is no substitute for advice in your individual case.

This article provides general information and is no substitute for legal advice in an individual case. Last updated: 2026-10-31.

Christian Czirnich, Rechtsanwalt (attorney at law), Kirchseeon near Munich

Tell me what your Schufa report says – I will take a look.

I read every message myself and usually reply on the next working day. What you write to me is covered by legal professional privilege from the first word, even if no engagement comes about. The initial assessment is free of charge.