Press & research

On 26 August 2026 the privacy organisation noyb formally sent SCHUFA a cease-and-desist notice and, according to its own statements, is preparing a collective action. The allegation: the credit agency maintains an archive of historical data alongside its production database — which noyb calls a “shadow database” — and does not disclose those data in access requests under Art. 15 GDPR. noyb relies on European Court of Justice case law requiring the data copy to be a complete and faithful reproduction of all processed data. SCHUFA refers to an archived dataset with retention periods of up to ten years.

Through selbstauskunft.de, NLTS Global Analytics operates one of the highest-reach independent portals for requesting SCHUFA data copies and has technically supported more than one million disclosure requests since 2020. From that operational experience we frame the matter as follows:

First: which data a disclosure must cover is not a legal nicety, but the core of the right of access. Consumers can only check and challenge entries if they see them in full. A disclosure whose scope the agency itself defines by relevance criteria misses that purpose.

Second: our own surveys show how wide the gap between the right of access and disclosure practice already is. In a Civey study we commissioned (April 2026, n = 5,000), 53.0% of Germans have never tried to request a free data copy; only 19.7% know their right to obtain it free of charge. At the close of our two-year SCHUFA monitoring (2023–2025), 20.7% of respondents said they had already been affected by outdated or incorrect entries, and 66.3% disagreed that their data are in safe hands with SCHUFA. If the allegation of incomplete disclosures is confirmed, it would meet a public that already mostly distrusts how the agency holds data.

Third: regardless of the outcome of the proceedings, the case reaffirms what we have argued since founding: transparency, data quality and understandable procedures are the benchmarks against which an agency with SCHUFA’s market position must be measured. Simple, complete and intelligible access to one’s own data copy is the prerequisite for data subjects to exercise their GDPR rights at all.

“For years we have seen consumers request their disclosure and then wonder why long-settled matters still affect their credit standing without appearing in the disclosure. The noyb notice asks exactly the right question: does the consumer get the full truth about their data — or only the slice the agency deems relevant?”, says Frank Drescher, Managing Director of NLTS Global Analytics.

For journalists: our survey data (Civey study 2026, SCHUFA monitoring 2023–2025) are available on request: info@nlts.eu.

In early 2024, the potential sale of SCHUFA Holding AG — involving investor groups such as EQT — returned to public attention. In parallel, Germany’s Federal Cartel Office reviewed competition aspects.

From NLTS Global Analytics’ perspective, the debate underscores how central credit agencies are to society: millions of consumers depend on credit decisions. Regardless of ownership, transparency, data quality and understandable procedures remain the key benchmarks for us.