Correcting an incorrect SCHUFA entry

The reason you are pushing back – and the choice makes a real difference for you. Rectification under Article 16 GDPR (DSGVO) applies where an entry is factually inaccurate: the wrong amount, the wrong date, the wrong status, the wrong person. The entry as such was allowed to come into being, only its content is not correct. Deletion under Article 17 GDPR (DSGVO) applies where the entry should never have come into being at all – for instance because the requirements of § 31 Abs. 2 BDSG were not met, because there were not two reminders, or because you had disputed the debt. So always check deletion first: it goes further, and a corrected negative entry remains a negative entry.

There is a clear legal limit: under Article 12 GDPR (DSGVO), a response is due without undue delay, and in any event within one month. An extension by a further two months is permitted only for complex matters, and you must be told about this within the first month, stating the reasons. In practice it often takes longer than necessary, because SCHUFA does not know the underlying facts itself and has to ask the reporting company – which is exactly why it is worth writing to the creditor in parallel. In every case, note the date you sent your letter: you will need it if you later involve the supervisory authority or assert claims.

The second, almost unknown part of Article 16 GDPR (DSGVO). Besides the rectification of inaccurate data, the provision also entitles you to the “completion of incomplete personal data – including by means of providing a supplementary statement”. In practice this means: if the dispute over accuracy cannot be resolved – for instance because the creditor and you describe the facts differently – you can require that your view be stored alongside the entry. It is then visible to anyone who retrieves the entry. This does not replace a deletion and is weaker than a rectification, but it is far better than an unexplained negative entry – and it is an entitlement, not a favour.

Mix-ups are more common than people assume, especially where there is the same name, a similar date of birth or a previous shared address. Two things help. First: set out concretely why the matter cannot belong to you – a different place of residence at the relevant time, no contractual relationship with the company, a different date of birth. Second, and this is often forgotten: state all your previous names and addresses. After a marriage, divorce or move, two sets of records sometimes exist side by side, and as long as only one of them is checked, the error keeps reappearing. Also write to the reporting company: it can clarify the mix-up fastest.

You do not have to prove it in the judicial sense, but in practice you get nowhere without evidence – and there is a simple reason for that: SCHUFA does not know the underlying matter, only the report. The more concretely you show what applies instead, the faster the matter can be clarified. Useful items are dated proof of payment, bank statements, cancellation or credit-note confirmations and your correspondence with the creditor. If you lack a piece of evidence, request it from the reporting company – it has to be able to prove the circumstances of the report in any case, if it relies on § 31 Abs. 2 BDSG.

Then three routes remain open, and all of them are free. First, the supplementary statement under Article 16 GDPR (DSGVO): your account is stored alongside the entry, even if the rectification itself remains refused. Second, SCHUFA's ombudsman office (Ombudsstelle), as out-of-court conciliation. And third – independently of that, and usually the most effective – the complaint to the data protection supervisory authority under Article 77 GDPR (DSGVO), which you can lodge with the authority for your place of residence. While you are at it, check once more whether deletion is not actually the right claim: an entry that did not meet the requirements of § 31 Abs. 2 BDSG has to disappear completely, not merely be put right.

At your request: everyone who has already received the entry. Article 19 GDPR (DSGVO) obliges the controller to “communicate the rectification or erasure of personal data … to each recipient to whom the personal data have been disclosed” – unless this proves impossible or involves disproportionate effort. Demand this expressly in your letter and, at the same time, have them name who received the data. Without this step, the entry at SCHUFA may long since be correct while the bank that retrieved it earlier keeps working with the wrong figure – and you never find out, because refusals do not have to be justified.

A claim under Article 82 GDPR (DSGVO) may come into consideration, and the Federal Court of Justice (Bundesgerichtshof, BGH) confirmed on 13 May 2025 (VI ZR 67/23) that even a – merely brief – loss of control over your own data can amount to non-material damage. Do not, however, expect a fixed amount: the BGH has set no tariff, but instead requires all the circumstances of the individual case to be taken into account – the nature, gravity and duration of the infringement and its concrete consequences. Ranges circulating online such as “€4,000 to €5,000 according to BGH case law” come from individual lower-court judgments and are not a benchmark. Gather evidence of the consequences, have it reviewed – and do not plan around a specific sum.