Correcting a Wrong SCHUFA Entry: Your Article 16 GDPR Right, Explained
A SCHUFA entry being wrong in fact, an already-repaid debt that was never removed, a claim listed at the wrong amount, a previous tenant or a name mix-up attached to your file, is a genuinely different problem from a debt collection letter that skipped the legal steps required to become a SCHUFA entry in the first place. For this kind of factual error, Article 16 GDPR gives you a direct right to demand correction, not just deletion. Start by requesting a free Datenkopie under Article 15 GDPR, available as often as several times a year through meineschufa.de, so you can actually see what's on file and by whom it was reported. Once you've identified the specific error, SCHUFA is legally required to respond within one month under Article 12(3) GDPR, extendable by up to two further months for genuinely complex cases if they tell you why. If SCHUFA doesn't correct it, you can escalate to their own Ombudsfrau free of charge, or file a complaint with the Hessischer Beauftragter für Datenschutz und Informationsfreiheit (HBDI), the specific authority responsible for SCHUFA since the company is headquartered in Wiesbaden, Hesse, not Bavaria.
The Official Rule
Not every wrong-feeling SCHUFA entry is a procedural problem, and it’s worth being precise about which kind of error you’re actually dealing with. A collection letter that skipped the legal reminder steps before being reported is a procedural issue, covered elsewhere. This page is about a different, genuinely common problem: the data itself being factually wrong, a debt that was already repaid but was never removed from your file, a claim listed at an inflated amount, or, in a genuinely disruptive scenario for newcomers, a previous tenant’s or a similarly named person’s information attached to your record by mistake.
The starting point is seeing exactly what SCHUFA has on file. Under Article 15 GDPR, you can request a free Datenkopie, a full self-disclosure of your data, through meineschufa.de, and this is available multiple times a year, not as a one-time check. Once you’ve identified a specific, factual error, Article 16 GDPR gives you a direct right to demand correction, not merely deletion, since a correction (fixing the actual figure or removing data that belongs to someone else) is often the more accurate remedy than a blanket deletion request.
SCHUFA doesn’t get an indefinite amount of time to respond. Article 12(3) GDPR requires a response within one month of your request, extendable by up to two further months for genuinely complex cases, as long as you’re told the reason for the delay within that first month. If they simply don’t act, or refuse without a real explanation, you have two free paths forward: SCHUFA’s own Ombudsfrau, an internal review process that can order verification or a correction, and a formal complaint to the Hessischer Beauftragter für Datenschutz und Informationsfreiheit (HBDI), the actual supervisory authority for SCHUFA specifically, since the company is headquartered in Wiesbaden, Hesse, not Bavaria. That’s a genuinely useful detail to get right, since Bavaria’s own BayLDA handles complaints about Bavarian companies and landlords, not SCHUFA’s own conduct.
| Entry type | Retention period |
|---|---|
| Repaid credit contract data | 3 years after full repayment |
| Account or contract closure notice | Immediate deletion once reported |
| Credit inquiries (Anfragen) | 12 months |
| Concluded insolvency proceedings | 6 months after completion |
| Factually incorrect data | Immediate deletion once confirmed wrong |
What Real People Say
Consumer finance guides that walk through this process consistently point to the same recurring error types: a loan that was fully repaid but the closure notice never reached SCHUFA, an old address or account still attached to your file after a move, and, less often but more disruptively, data that genuinely belongs to a different person entirely, a mix-up that newcomers with common transliterated names sometimes report more frequently than the general population. The consistent advice is to treat the free Datenkopie as a routine check rather than something you only request once you already suspect a problem, since several of these errors are only noticed by actually reading the full file rather than being flagged to you proactively.
On the escalation path, guides note that the HBDI has faced a genuinely high volume of SCHUFA-related complaints in recent years, and some consumer advocates have publicly criticized how quickly those complaints get resolved. That’s not a reason to skip the complaint, since it remains a real, free, and legally grounded escalation path, but it’s worth setting realistic expectations about the timeline rather than assuming an immediate resolution.
Step by Step
- Request your free Datenkopie under Article 15 GDPR through meineschufa.de, uploading identity verification and allowing a few days for it to arrive.
- Read through it carefully for factual errors: repaid debts still listed, amounts that don’t match your own records, or entries connected to an address, account, or name that isn’t actually yours.
- Submit a written correction request under Article 16 GDPR, citing the specific entry and the specific error, by post, phone, or through SCHUFA’s own service portal.
- Track the one-month response deadline under Article 12(3) GDPR, and note that a genuine extension of up to two further months requires SCHUFA to tell you why within that first month.
- If SCHUFA doesn’t act, contact their Ombudsfrau first, a free internal review step that can order verification or a correction.
- If that doesn’t resolve it, file a formal complaint with the HBDI in Hesse, not Bavaria’s BayLDA, since Hesse is where SCHUFA itself is headquartered and supervised.
Compliance Note
This page explains the general legal framework under EU and German data protection law for correcting a factually wrong credit bureau entry, current as of mid-2026. It is not legal advice, and the specific facts of your case, including whether an entry is genuinely incorrect or simply unwelcome, determine what remedy actually applies. For a disputed case that doesn’t resolve through these channels, consult a Verbraucherzentrale or a lawyer specializing in Datenschutzrecht.
FAQ & Common Pitfalls
How is this different from the rules about a collection letter turning into a SCHUFA entry?
They're two genuinely different mechanisms. The collection letter threshold is about procedure: whether a creditor followed the required steps (two written reminders, a four-week gap, an advance warning) before reporting a genuine, undisputed debt. This page is about content: whether the data itself is factually correct at all, regardless of procedure, for example a debt that's already been repaid but never removed, an amount that's simply wrong, or a previous tenant's or a similarly named person's information attached to your file by mistake. A procedural violation and a factual error can both exist, but they're challenged on different grounds.
How often can I request my free Datenkopie, and where?
You can request it through SCHUFA's official channel at meineschufa.de, and it's free, available several times a year rather than as a one-off. The process involves uploading identity verification and waiting a few days for it to arrive, and it's worth doing this proactively, not just after you've already suspected a specific error, since it's the only way to actually see everything currently on file and confirm who reported it.
What happens if SCHUFA just ignores my correction request?
You have two free escalation paths. First, SCHUFA has its own Ombudsfrau, a free, internal review process that can order verification of a disputed entry or mandate a correction. Second, and separately, you can file a formal complaint with the Hessischer Beauftragter für Datenschutz und Informationsfreiheit (HBDI), the state data protection authority with jurisdiction over SCHUFA specifically, since the company is headquartered in Wiesbaden. Be aware that HBDI complaint volumes about SCHUFA have genuinely been high, so processing times can run longer than you'd expect from a straightforward request.
Why would I file with a Hessian authority instead of Bavaria's BayLDA?
Because German data protection complaints go to the authority with jurisdiction over the specific company you're complaining about, not the state where you personally live. SCHUFA Holding AG is headquartered in Wiesbaden, Hesse, so the HBDI is its supervisory authority nationwide, regardless of whether you're in Munich or anywhere else in Germany. Bavaria's BayLDA is the right authority for a different situation entirely, like a Munich landlord improperly demanding your data, not for SCHUFA's own conduct.