Schufa scandal: millions of consumers affected by a hidden "shadow database"
A joint investigation by public broadcaster NDR and the Süddeutsche Zeitung, published in mid-July 2026, has caused considerable unrest in Germany. According to the report, Schufa — the country's dominant credit bureau — continues to store data on roughly 68 million people in a separate, little-known database, even though this information should long since have been deleted from the official credit file. For anyone applying for a loan, opening a bank account, or arranging a mortgage, this is not an abstract legal footnote — it is a question that can directly decide the interest rate and creditworthiness assigned to them.
What exactly was uncovered?
According to the NDR and Süddeutsche Zeitung investigation, Schufa runs a second, internal database alongside its regular credit file — one in which information that should have been deleted or that has legally expired is nonetheless retained. A Schufa spokesperson described a scale of 68 million affected people as "realistic" — more than three-quarters of everyone in Germany who has a Schufa record.
What kind of data ends up in the shadow database?
According to the reporting, the database mainly contains information that consumers had every reason to assume was long gone:
- Old loans and credit card contracts that were properly settled
- Garnishments (Pfändungen), some dating back years
- Personal insolvencies, even after the statutory deletion periods have passed
- Debts that the people concerned had already paid off long ago
Some of these records are reportedly up to ten years old — considerably longer than the standard deletion periods for credit data actually allow. According to the investigative reporters, Schufa officially uses this database for internal testing of new scoring models. The issue becomes more serious because, according to the report, banks, energy suppliers, and other payment service providers can gain access to the results of these tests — meaning supposedly deleted history could indirectly feed back into real creditworthiness decisions after all.
Why consumer advocates and data protection officials are alarmed
The core criticism concerns the data minimisation principle enshrined in the GDPR: personal data may, in principle, only be stored for as long as the original purpose requires it. Once a debt has been settled or a statutory deletion period has expired, the data should be removed — not moved into a second database.
The Federation of German Consumer Organisations (Verbraucherzentrale Bundesverband), speaking through its representative Claudio Zeitz-Brandmeyer, voiced scepticism about Schufa's practice. The concern: companies that gain access to such test results may be strongly tempted to use the data not only for testing purposes, but effectively for real credit decisions as well — even though that is not the officially intended use. That would mean old baggage a consumer long considered settled could keep influencing their creditworthiness without them ever finding out.
The Hessian State Commissioner for Data Protection, who is responsible for supervising Schufa, is now reviewing the matter in a preliminary proceeding. The central question is whether Schufa should have been obliged to actively inform affected individuals about the existence and use of this shadow database. Schufa itself defends its practice by pointing to applicable legal provisions, without so far resolving the underlying criticism of how long the data is retained.
What this means for your finances, in practical terms
For most people, Schufa is not some abstract construct — it is the invisible authority that quietly helps decide whether a loan application gets approved, and at what interest rate. Anyone currently comparing loan offers should be aware that a single outdated entry can noticeably worsen the rate on offer, even if the underlying debt was settled long ago. Banks price their terms based on risk — and a seemingly minor historical data point can, in practice, carry more weight than consumers assume.
The effect is even more significant for larger financing decisions. With a mortgage, even small differences in the assessed creditworthiness can shift the effective annual rate by several tenths of a percentage point — over a term of 20 or 30 years, that can add up to several thousand euros. When outdated data that shouldn't even exist any more is quietly at play in the background, consumers lose control over a factor that shapes one of the biggest financial decisions of their lives.
Some institutions also check creditworthiness before activating an overdraft facility or a credit card on a new current account. Anyone currently in the process of comparing current accounts or switching banks would do well to request their own free Schufa self-disclosure beforehand — it shows exactly what data is currently held in the official file. The newly revealed shadow database, however, also shows the limits of that self-disclosure: it only covers the official database, not necessarily internal testing procedures.
How consumers can respond
Even though the concrete consequences of the regulatory review remain to be seen, it is already worth taking a close look at your own credit data. Anyone who regularly requests their free self-disclosure under Article 15 of the GDPR can at least spot errors and outdated entries in the official database early on and demand corrections. If something looks off, it is worth contacting Schufa directly and, if the response is unsatisfactory, filing a complaint with the responsible data protection authority.
For anyone who is already putting their finances in order — say, because a larger loan is coming up or some extra money needs a sensible home — this is a good moment to review not just your credit standing but your account terms as well. A look at current offers for savings accounts costs nothing and shows whether your money is currently working as hard as it could, while the creditworthiness question keeps playing out in the background.
Bottom line: trust is good, verification is better
The Schufa shadow database case illustrates just how little consumers actually know about the data circulating about them behind the scenes — and how strongly that data can shape real financial decisions without any transparency. Until the data protection authority completes its review, those affected are left with one main option: staying alert, regularly checking their own self-disclosure, and not blindly trusting a single score when it comes to loan or account decisions. Anyone planning their next financial move should keep an eye on the current interest rate environment anyway — a structured comparison doesn't just secure a better rate, it also brings far more clarity about your own terms and conditions.