How to remove your data from SCHUFA (GDPR Art. 17)
This guide shows how to ask SCHUFA to erase the personal data it holds about you, using your rights under Article 17 (erasure) and Article 21 (objection) of the GDPR. It is free, and you can send it yourself in a few minutes.
What SCHUFA is
SCHUFA is a credit-reference and business-information company (SCHUFA Holding AG, Germany). Companies of this type typically keep identification and address data, payment and credit history, and company or director records, gathered from public registers, lenders and other business sources.
A general description based on the company’s category and its own privacy notice. It is not a statement about whether the company holds data about you.
Credit bureau
- Company
- SCHUFA Holding AG · Germany
- Privacy / DPO email
- datenschutz@schufa.de
- Privacy policy
- app.pro-sma.aws.schufa.de (opens in a new tab)
- Verified
- 20 October 2026
- Contact read on
- app.pro-sma.aws.schufa.de (opens in a new tab)
Contacts were read on the company’s own pages on the date shown. Companies change them, so check the source before you send.
Step by step
- 01
Prepare your details
Note the email addresses and name the company may know you by. Do not send identity documents unless the company asks and explains why (Art. 12(6) GDPR).
- 02
Send the request
Use the form or the email address above. The monthly plan can send the request for you. Keep a copy and the date: it starts the clock.
- 03
Wait up to one month
The company must reply without undue delay and within one month (Art. 12(3) GDPR). For complex or numerous requests it can extend that by up to two further months, but it must tell you within the first month.
- 04
Follow up if needed
If there is no answer, send a short reminder quoting the date of your first request and ask for written confirmation that the erasure is complete.
- 05
Complain to the supervisory authority
If the company refuses without a valid reason or stays silent, you may lodge a complaint (Art. 77 GDPR) with the authority in the country where you live or work, or where the problem occurred.
Ready-to-send letter
The letter to SCHUFA is part of the GDPR kit
The GDPR kit fills in your details, writes the Art. 15 access, Art. 17 erasure and Art. 21 objection requests for SCHUFA in English or Italian and, after you approve, sends them for you and tracks the one-month deadline.
Where to complain
You can complain to the data protection authority of the country where you live, work or where the infringement took place (Art. 77(1) GDPR). SCHUFA is based in Germany, whose authority is:
Federal Commissioner for Data Protection and Freedom of Information (BfDI) (opens in a new tab)
Find your national authority in the EDPB members list (opens in a new tab)
What to expect
- Credit bureaus can lawfully keep some credit and payment data despite a request. Art. 17(3) lets a controller refuse where processing is needed for a legal obligation or for legal claims, and accurate negative information is often retained for a set period. They should still answer, explain the legal basis they rely on and confirm what they hold (Art. 15).
Do it for every broker in a few clicks
The GDPR kit in the monthly plan takes your details once, writes the requests for every company in the directory in English or Italian, sends them for you after you approve and reminds you when a deadline passes.
Related guides
Other companies in the same category.
Frequently asked questions
Do I have to pay SCHUFA to delete my data?
No. Under Art. 12(5) GDPR the request is free of charge. A company can only charge a reasonable fee, or refuse, if requests are manifestly unfounded or excessive.
How long does SCHUFA have to reply?
One month from receiving your request (Art. 12(3) GDPR). The period can be extended by up to two further months for complex or numerous requests, but the company must tell you why within the first month.
What if SCHUFA refuses or does not answer?
Send a short reminder quoting the date of your first request. If you still get no valid answer, you can complain to a supervisory authority (Art. 77 GDPR), usually the one in your own country, and you may seek a judicial remedy (Art. 79 GDPR).
Should I use the email address or the web form for SCHUFA?
SCHUFA publishes a privacy contact email address but no request form, so send the letter there and keep the sent message as proof of the date.