Schufa shadow database: What businesses can do

According to experts, Schufa's secret data collection violates data protection laws. A lawyer explains how to proceed if you want to know more about your data from the credit agency.

You applied for a loan for your business, but the bank rejected you? This is happening more and more frequently lately . The financial institution may have based its decision on data from Schufa, a credit bureau that shouldn't even exist anymore. A previously unknown Schufa database raises data privacy concerns: Millions of older records are stored beyond the legally mandated deletion periods and used for testing purposes. Those affected are currently unaware of the existence of this database – even when they submit a credit report request.

Data collection despite transparency promises

According to recent research by Norddeutscher Rundfunk and Süddeutsche Zeitung, Schufa apparently maintains a previously unknown collection of historical consumer data alongside its regular database. Millions of citizens are affected, whose data – such as information on settled loans, garnishments, or personal bankruptcies – which was originally supposed to be deleted, is apparently still stored beyond the legally prescribed retention periods.

In March 2026, Schufa introduced its new credit score with the aim of replacing the previously opaque methodology with verifiable criteria. It has now emerged that an additional data collection, previously concealed from the public, apparently still exists. This contradicts the company's own commitment to transparency . Anyone promising transparency must also guarantee it in the use and storage of data.

Data is stored for corporate clients.

According to research, Schufa uses this historical data to test , for corporate clients such as banks , telecommunications providers, energy suppliers, and retailers, how the new credit score would have been retrospectively applied to a specific day in the past. The aim is to demonstrate the reliability of the new Schufa score. Schufa states that this use is contractually limited to testing and verification purposes. Contractual partners are required to delete the data after use.

You might also be interested in:

Operations management

Optician wins against data privacy challenger

Operations management

Online shops: The cancellation button is now mandatory

Operations management

Digitization of aerial work platform rental: Flexible and paperless

Data protection law violated

According to lawyer Hendrik Frank, this shadow database violates several principles of the General Data Protection Regulation (GDPR).

• memory limitation (Article 5 paragraph 1 letter e GDPR):
  Personal data may, in principle, only be stored for as long as it is necessary for the original purpose. Storage without cause for future testing purposes not the specifications.
  
  
• Right to erasure / Right to be forgotten (Article 17 GDPR):
  Once the claim has been settled, personal data should be deleted after the deadline has expired. deleted will be. Its continued existence in a hidden database contradicts this principle.
  
  
• Transparency and right to information (Article 15 GDPR):
  Even when requesting a copy of their data, affected individuals will not receive a copy. no information regarding existing historical data. "This is particularly problematic from a data protection perspective," the lawyer emphasizes.
  
  
• Loss of control as intangible damage:
  According to established case law of the highest courts, even the Loss of control about one's own data a replaceable intangible Schaden to Art. 82 DSGVO justify this – regardless of whether there is also a concrete instance of abuse.

Rights of the persons concerned

"Should it be confirmed that personal data is being retained and used for purposes beyond the scope of the statutory retention periods, and for purposes no longer covered by the original purpose for which it was collected, data subjects generally have rights under the GDPR," explains attorney Frank. "These include the right of access under Article 15 GDPR , which must expressly extend to such ' historical' data, the right to erasure under Article 17 GDPR , and – depending on the individual case – the right to compensation for non-material damages under Article 82 GDPR due to the loss of control over one's own data."

How best to react

Anyone wishing to find out whether and to what extent Schufa has stored historical data about themselves can request a complete data copy in accordance with Article 15 GDPR and specifically ask about the storage and use of historical data or data already assumed to be deleted .

Source: De Backer & Frank Lawyers

DHB now also available digitally! Simply click here and register for the digital German Crafts Journal (DHB)!