Incorrect SCHUFA entry: When is you entitled to damages under the GDPR?

Jonas Buchholz
by Jonas Buchholz · 27.09.2025

Can an early or unfounded SCHUFA entry lead to a claim for damages?

The Federal Court of Justice (BGH) has ruled in a principle decision: Yes, if the entry causes demonstrable disadvantages or the loss of control over one’s own data has already occurred. The ruling of May 13, 2025 (Case No.: VI ZR 67/23) lowers the hurdles for those affected and significantly increases the liability risk for reporting companies.

The case: Premature SCHUFA notification with serious consequences

An enforcement agency reported a titled claim to the SCHUFA, even though the debtor’s right of appeal was still running. The affected person claimed that the resulting negative SCHUFA entry had massive economic consequences for him, including the loss of credit cards and the failure of a real estate financing. He sued for 5,000 euros in damages under Art. 82 GDPR. After the Higher Regional Court of Koblenz had dismissed his claim, he appealed to the BGH.

The BGH's decision: Loss of control over data is already damage

The BGH reversed the decision of the Koblenz Higher Regional Court and made clear that the requirements for an intangible GDPR damage cannot be set too high. The BGH’s key findings are groundbreaking:

  1. Damage does not have to be „serious“, but specifically: The plaintiff had sufficiently substantiated the loss of his credit cards and the impending termination of business relationships with concrete disadvantages. A high materiality threshold, as the Higher Regional Court set it, is not required.
  2. The „loss of control“ over data is a separate type of damage: This is the crucial point of the judgment. The BGH emphasized that the mere fact that personal data were unlawfully disclosed to third parties (here, SCHUFA) can constitute immaterial damage in the form of „loss of control.“ Therefore, affected individuals do not necessarily have to prove that a loan has been lost. The unlawful disclosure in itself is the damage.

Implications for companies

  • Liability risk for all reporting companies: This judgment does not only affect debt collection companies, but all companies that report data to credit agencies such as SCHUFA (banks, telecommunications providers, energy providers, online retailers with installment payments, etc.).
  • The threshold for damages claims has dropped: Since the mere loss of control constitutes damage, it becomes easier for those affected to claim compensation. The burden of proof is eased.
  • Process reliability is essential: Companies must ensure absolutely that their internal processes only allow data reporting to SCHUFA once all legal requirements (e.g. § 31 BDSG) have been met without question. Premature or erroneous reports are a direct financial risk.
  • Documentation and testing: Every reporting process must be documented in full. There must be a clear examination of whether the claim is undisputed and whether the debtor has been sufficiently warned.

SCHUFA record & GDPR damages compensation – What you need to know

  • What exactly is an „immaterial damage“ under the GDPR?
    This is a non-financial disadvantage, such as loss of reputation, discrimination, stress, or simply the mere loss of control over one's own data.
  • How high can the damages for a false SCHUFA entry be?
    This is a case-by-case decision. The range extends from a few hundred to several thousand euros, as the initial judgment in this case shows with 5,000 €. The severity of the offense and its impact on the affected person are crucial.
  • Who is liable for the false notification – my company or SCHUFA?
    The reporting company is primarily responsible for the unlawful transmission of data, as the data protection controller.
  • When can I report an unpaid debt to the SCHUFA?
    The requirements are strict. As a rule, the claim must be undisputed; the debtor must have been given at least two written warnings; and there must be a minimum of four weeks between the first reminder and the notification.
Conclusion: BGH strengthens consumer rights and increases pressure on companies

The BGH’s ruling is a clear signal: careless or flawed handling of data reporting to credit bureaus will no longer be tolerated. Recognizing „loss of control“ as a separate form of damage opens the door to a new wave of GDPR damages claims. For companies, this means that compliance with strict reporting requirements and accurate process documentation are more important than ever.

Check the mandatory fields –
Step-by-step in the webinar

If you would like to be there or to ask your questions:
Get in touch – the registration details will follow shortly.

Contact us

FAQ

Can a false or premature SCHUFA entry trigger a claim for damages under the GDPR?

Yes. According to the judgment of the Federal Court of Justice described in the article, a claim for damages can be made if the unlawful disclosure caused concrete disadvantages or a loss of control over personal data has already occurred.

What does „loss of control“ over personal data mean?

It refers to the unlawful transfer of personal data to third parties, which results in the affected person losing control over its use. According to the article, even this loss of control can constitute immaterial damage within the meaning of Article 82 GDPR.

Do the affected individuals have to prove particularly serious damage?

No. According to the decision outlined in the article, a high materiality threshold is not required. However, the damage must be specifically demonstrated. In the underlying case, the loss of credit cards and the impending disadvantages in business relationships were cited, among other things.

Who is liable for an unlawful report to the SCHUFA?

Under the article, the reporting company is generally responsible for unlawful transmission as the data protection controller. This can, for example, apply to banks, telecommunications companies, energy providers, or online retailers.

When is an open claim to SCHUFA to be reported?

The requirements are strict. The article specifically states that the claim must be undisputed in principle, the debtor must have been repeatedly warned, and certain time requirements must be met. Before making any report, the legal requirements should be carefully examined.

What should companies take into account organizationally when dealing with SCHUFA reports?

Companies should establish clear review and approval processes and document each notification in a comprehensible manner. Before submitting any information, it is essential to verify that all legal requirements are met and that the underlying claim can actually be reported.