Objection and complaint against SCHUFA

No, and this difference determines the whole further course of action. SCHUFA Holding AG is a private company, not a public authority – so there is no objection in the administrative-law sense, no Widerspruchsbescheid (ruling on the objection) and no action before a Verwaltungsgericht. Your rights arise from the General Data Protection Regulation (Datenschutz-Grundverordnung, DSGVO): rectification of inaccurate data (Article 16 GDPR), deletion of unlawfully stored data (Article 17 GDPR) and objection on grounds relating to your particular situation (Article 21 GDPR). If the company does not respond, your point of contact is the data protection supervisory authority – and you may approach the one at your place of residence under Article 77 GDPR.

That depends on what is wrong with the entry – and the choice determines the standard your request is measured against. If the entry is factually incorrect (wrong amount, wrong person, long since paid), demand rectification under Article 16 GDPR (DSGVO) – which, incidentally, also covers the right “to have incomplete personal data completed”. If the entry is unlawful, for example because the requirements of § 31 Abs. 2 BDSG were not met, demand deletion under Article 17 GDPR. And if it is about the fact that your particular situation makes the processing unreasonable, the way forward is objection under Article 21 GDPR. Name the right expressly in your letter.

This cannot be answered with a single figure, and any source that does so is misleading you. The claim itself is real: on 13 May 2025 the Federal Court of Justice ruled (VI ZR 67/23), in a case concerning a premature SCHUFA report, that a loss of control over one's own data – even a merely brief one – can in itself be non-material damage under Article 82 GDPR (DSGVO). It did not set an amount: what matters are all the circumstances of the individual case – the nature, gravity and duration of the infringement and its specific consequences for you. The “€4,000 to €5,000 under BGH case law” circulating online comes from lower-court decisions, not from a table set by the highest court. Having it checked: yes. Planning around a sum: no.

No. SCHUFA is based in Wiesbaden, which is why the Hessian supervisory authority acts as the lead authority – but that is not decisive for your complaint. Article 77 GDPR (DSGVO) allows you to complain to the supervisory authority of the member state of your habitual residence, your place of work, or the place of the alleged infringement. In practice, this means: you can contact the data protection supervisory authority of your own federal state (Bundesland), in your own language and without a lawyer. The complaint can be made free of charge and informally; describe the facts, name the entry you are complaining about, and enclose your previous correspondence. This is the most effective lever you have without any risk of costs.

Both, and at the same time. This is the step at which most cases take needlessly long. The entry was reported not by SCHUFA but by the company – the bank, the mobile phone provider, the debt collection agency. If that company withdraws the report, the entry is removed, and in practice this is often considerably faster than a dispute with the credit reporting agency, which does not even know the facts of the matter itself. So write to both at the same time: to SCHUFA demanding rectification or deletion, and to the creditor demanding that it withdraw the report. Enclose the same evidence with both and refer each to the other letter.

SCHUFA maintains an ombudsman office for out-of-court conciliation. It is free of charge for you and is worth considering if your request has been refused and you do not want to go to court straight away. There are two things you should know about it. First: the ombudsman office is a body set up by the company itself, not an independent authority – that does not rule out a fair procedure, but it does distinguish it from the supervisory authority. Second, and more importantly: it is not a precondition for the complaint under Article 77 GDPR (DSGVO). You can pursue both side by side, or go directly to the data protection supervisory authority, and both cost nothing.

Under Article 12 GDPR (DSGVO), a response must be given without undue delay, but in any case within one month of receiving your request. An extension of a further two months is only permitted for complex requests – and you must be informed of this within the first month, stating the reasons. The deadline is therefore not meant to simply pass without a response, and if that happens, it is itself an infringement you can cite in a complaint. In practice: set your own deadline of two to three weeks in your letter, note the date you sent it, and if nothing comes back, follow up once in writing before involving the supervisory authority.

Not automatically noticeable, but you have an entitlement to it, and it is almost always overlooked. Article 19 GDPR (DSGVO) obliges the controller to “communicate any rectification or erasure of personal data … to each recipient to whom the personal data have been disclosed” – unless that proves impossible or involves disproportionate effort. Therefore, demand this expressly and at the same time ask to be told who received the data. Without this step, it can happen that the entry has disappeared from SCHUFA, but the incorrect picture lives on at the bank that previously retrieved it – and you cannot find the reason for your next refusal.