Request your free SCHUFA data copy

For the data copy (Datenkopie), yes – as a legal entitlement, not as a gesture of goodwill. Article 15(3) GDPR (DSGVO) entitles you to “a copy of the personal data undergoing processing”; a “reasonable fee” may be charged only for further copies. So anyone who checks once a year pays nothing. Do not confuse it with the BonitätsAuskunft for €29.95: that is a different product for a different purpose – for passing on to third parties – and therefore contains less, namely a summarised assessment instead of your full data. Anyone who buys it to check their own data pays for less information.

Everything stored about you: identification data and addresses, contract data such as current accounts, credit cards, mobile phone and instalment contracts (the so-called positive data), any negative entries with their date and the reporting company, data from public registers such as the register of debtors, the enquiries made by companies, and your score values. The distinction among the enquiries matters: a conditions enquiry for credit terms is not visible to other companies and has no effect on the score, whereas an actual loan enquiry does. Anyone comparing offers should therefore explicitly insist on a conditions enquiry.

Article 12(3) GDPR (DSGVO) requires a response without delay, and in any event within one month of receipt of your request. Only if the matter is complex or many requests have been made may this be extended by a further two months – and you must be informed of this within the first month, together with the reasons. A silent lapse of the deadline is therefore not provided for. If it happens nonetheless, you have two options, neither of which costs anything: chase it up in writing, setting a deadline, and – if that achieves nothing either – lodge a complaint with the data protection supervisory authority under Article 77 GDPR (DSGVO). You can submit it to the authority of your place of residence.

You can, but you should not – in your own interest. The data copy is deliberately complete: it contains your contractual relationships, accounts, enquiries and score values, that is, far more than a landlord needs, or should be allowed to see, for assessing your ability to pay. Anyone who passes it on voluntarily discloses data that nobody could demand knowledge of. The BonitätsAuskunft exists for exactly this purpose: it costs €29.95, but precisely because of that it contains only a summarised assessment without your individual data. That is the real point of the price difference – not more service, but less disclosure.

An identity check is permissible and sensible – otherwise anyone could request your data. However, you need not disclose more than necessary in doing so: for identification, name, date of birth and address are enough. You are allowed to redact everything else, in particular the ID and access number, the serial number, your height and eye colour. This is not a trick, but simply applying data minimisation to your own case. If a query comes back saying the copy was redacted too heavily, add back specifically what is missing – but do not let yourself be persuaded to send a fully legible copy of your ID if identification also works without one.

Partly – and how far, is currently unresolved by the courts. Article 15(1)(h) GDPR (DSGVO) entitles you to “meaningful information about the logic involved, as well as the significance and the envisaged consequences” of automated decisions. What this means in concrete terms is the point of dispute: is a generally understandable explanation enough, or must the information be detailed enough for you to recalculate the value yourself? The Federal Court of Justice (Bundesgerichtshof, BGH) heard arguments on this on 18 June 2026 in five proceedings (I ZR 226/25 to I ZR 230/25) – a decision has not yet been issued. Request the information explicitly all the same; and be wary of any source that promises you the exact formula.

At least once a year – and cost is no argument against it, because the first copy in the year costs nothing in any case. The reason is practical: otherwise an incorrect or outdated entry only comes to your attention once it actually causes harm – with a loan application, a tenancy agreement, a mobile phone contract. At that point the matter is urgent, and corrections take weeks. A second occasion for an unscheduled report is any unexpected refusal: if a contract or loan is refused for no apparent reason, request the data copy immediately and, at the same time, have the refusing company explain what it based its decision on.

First follow up in writing, referring to Article 15 GDPR (DSGVO) and setting a deadline of two weeks. If nothing changes, the complaint to the data protection supervisory authority under Article 77 GDPR (DSGVO) is the most effective lever you have without a lawyer: it is free of charge, possible without any particular form, and you can lodge it with the authority of your place of residence – you do not have to approach the authority where the company is based. Keep in mind that SCHUFA is not an authority: there is no objection in the administrative-law sense and no action before an administrative court. The route runs via data protection law and, if necessary, via the civil courts.