Paid debts at Schufa: how long entries may remain

What the ruling is about

Schufa does not have to delete data about paid debts immediately once payment has been proven. That was the decision of the Federal Court of Justice on 18 December 2025 (case reference I ZR 97/25). At the same time, the court described which storage periods it considers appropriate in principle: three years as a rule, 18 months under certain conditions, and less in special cases. For those affected, this is mixed news.

Schufa Holding AG is a credit reference agency, that is, a company that collects data about people's payment behaviour. Banks and other lenders are given access to these databases for a fee. From the data, Schufa calculates a score, a figure intended to express the risk of a payment default. Schufa's contractual partners report payment irregularities to it, such as unpaid debts. If a reported debt is later settled, it nevertheless remains stored.

Three old debts, one poor score

In the case decided, Schufa had kept three debts owed by a man on record for several years after they had been paid. On that basis, it classified his risk of payment default as "very critical". Lenders see this assessment when they make an enquiry to Schufa. The man regarded the lengthy storage as a breach of the General Data Protection Regulation (GDPR) and brought a claim.

During the proceedings, Schufa deleted the data. That settled the dispute about deletion, but not the dispute about money. The man continued to demand compensation for non-material damage, that is, for a disadvantage without a quantifiable monetary value. On top of that came reimbursement of his costs for pursuing the matter out of court.

The Regional Court of Bonn dismissed the claim. The Higher Regional Court of Cologne took a different view and awarded the claimant 1,040.50 euros plus interest. It allowed an appeal on points of law, that is, a review by the Federal Court of Justice. Schufa made use of this option and demanded that the claim be dismissed in full. The Federal Court of Justice set aside the Cologne judgment and referred the case back to the Higher Regional Court. Cologne therefore has to decide again, this time with the guidance from Karlsruhe.

The debtors' register is not Schufa

The core of the ruling is a distinction. The Higher Regional Court of Cologne had taken its lead from the deletion period for the debtors' register. This is a public register held at the enforcement court, in which debtors are entered, among other things, by order of the bailiff. An entry there is deleted after three years, or immediately once full payment is proven. In the view of the Cologne court, that period also set the maximum duration for Schufa.

The Federal Court of Justice disagreed. In this case, Schufa had not drawn on the debtors' register but had stored reports from its contractual partners, including details of the creditor and the amount and nature of the debts. The immediate deletion that the law prescribes for the debtors' register cannot be transferred to such data. The provision concerns only the entries in the register.

The difference from the case before the CJEU

Cologne had derived its view from a judgment of the Court of Justice of the European Union of December 2023. That case concerned the discharge of residual debt, that is, the remission of remaining debts after insolvency proceedings. Schufa had taken the information from the public insolvency announcements and stored it in parallel for longer than it appeared there. According to that judgment, it was not allowed to do so.

The thinking behind it: a deletion period applying to the public register should not be circumvented by someone copying the data and keeping it for longer. With reports from contractual partners, there is no such register period in the first place. That is why the reasoning does not apply here, according to the Federal Court of Justice.

Three years or 18 months: the periods

So how long may Schufa store the data? The Federal Court of Justice gives the Higher Regional Court some guidance on this. It considers fixed periods possible if they are the result of a standardised balancing of interests. What is meant is this: the interests of the credit reference agency and of the data subjects are weighed against each other for the standard case, while the individual case still remains in view.

As a benchmark, it points to the code of conduct of the German credit reference agencies, which the Hessian Commissioner for Data Protection and Freedom of Information approved with effect from 1 January 2025. These rules provide, as a starting point, for settled debts to be stored for three years. The period is shortened to 18 months where three conditions are met:

• No further negative data has been reported to the credit reference agency by that point.
• There is no information from the debtors' register or from insolvency announcements.
• The debt was paid within 100 days of the report.

In the view of the panel, this arrangement strikes an appropriate balance of interests in principle. The qualification is important: data subjects must be able to put forward special circumstances that give their interest in deletion substantially above-average weight. In that case, by way of exception, an even shorter storage period may be the appropriate one.

Deleting a Schufa entry: what applies now

For private individuals, the ruling above all brings clarity about what to expect. Anyone who pays a reported debt will not immediately be rid of the Schufa entry for it. The Federal Court of Justice has put an end to the hope that payment alone compels deletion.

At the same time, the ruling names periods that those affected can use as a guide. Anyone who pays within 100 days of the report and does not accumulate further negative reports afterwards falls under the shorter period. Under the code of conduct, that is 18 months. Otherwise it remains three years. Anyone with special circumstances justifying faster deletion can put them forward, first to the credit reference agency and, if necessary, in court. The ruling does not say what those circumstances might be.

And the money? If Schufa has stored data for longer than the balancing of interests permits, a claim for damages under Article 82 GDPR is in principle an option. That is the provision under which anyone who has suffered damage as a result of a data protection breach can claim compensation. Whether the claimant ultimately sees any money is now for the Higher Regional Court of Cologne to examine, along with the further requirements for such a claim.