On 26 August 2026 the privacy organisation noyb formally sent SCHUFA a cease-and-desist notice and, according to its own statements, is preparing a collective action. The allegation: the credit agency maintains an archive of historical data alongside its production database — which noyb calls a “shadow database” — and does not disclose those data in access requests under Art. 15 GDPR. noyb relies on European Court of Justice case law requiring the data copy to be a complete and faithful reproduction of all processed data. SCHUFA refers to an archived dataset with retention periods of up to ten years.
Through selbstauskunft.de, NLTS Global Analytics operates one of the highest-reach independent portals for requesting SCHUFA data copies and has technically supported more than one million disclosure requests since 2020. From that operational experience we frame the matter as follows:
First: which data a disclosure must cover is not a legal nicety, but the core of the right of access. Consumers can only check and challenge entries if they see them in full. A disclosure whose scope the agency itself defines by relevance criteria misses that purpose.
Second: our own surveys show how wide the gap between the right of access and disclosure practice already is. In a Civey study we commissioned (April 2026, n = 5,000), 53.0% of Germans have never tried to request a free data copy; only 19.7% know their right to obtain it free of charge. At the close of our two-year SCHUFA monitoring (2023–2025), 20.7% of respondents said they had already been affected by outdated or incorrect entries, and 66.3% disagreed that their data are in safe hands with SCHUFA. If the allegation of incomplete disclosures is confirmed, it would meet a public that already mostly distrusts how the agency holds data.
Third: regardless of the outcome of the proceedings, the case reaffirms what we have argued since founding: transparency, data quality and understandable procedures are the benchmarks against which an agency with SCHUFA’s market position must be measured. Simple, complete and intelligible access to one’s own data copy is the prerequisite for data subjects to exercise their GDPR rights at all.
“For years we have seen consumers request their disclosure and then wonder why long-settled matters still affect their credit standing without appearing in the disclosure. The noyb notice asks exactly the right question: does the consumer get the full truth about their data — or only the slice the agency deems relevant?”, says Frank Drescher, Managing Director of NLTS Global Analytics.
Update, 12 September 2026: The deadline set by noyb for cease-and-desist declarations expired on 9 September 2026. According to consistent media reports, SCHUFA rejected the demands in a 26-page reply and stated that it would “defend” the retention of historical data “in court”; noyb has since announced that it will file an injunction action. The core question — what scope a data disclosure under Art. 15 GDPR must have, and how long historical data may be retained — is therefore likely to be decided by the courts. From our perspective that is welcome: a supreme-court clarification creates the binding force that self-commitments have so far failed to deliver. The procedural turn does not change our assessment — complete, intelligible data disclosures remain the standard against which the agency must be measured.
For journalists: our survey data (Civey study 2026, SCHUFA monitoring 2023–2025) are available on request: info@nlts.eu.