How long is a credit reference agency permitted to retain data relating to a debt that has already been paid? (DSB 2026-0.084.179, 19 March 2026)

1. Facts of the case

A credit reference agency held the data of a debtor (the complainant in the data protection complaint) in its credit database. The debtor settled the debt, which had been outstanding since March 2022, in full in August 2025. Despite the debt having been paid, the credit reference agency continued to keep the debtor’s record in its database with the note ‘positively settled’. One month after settling his debt, the debtor requested the erasure of his data in accordance with Article 17 of the GDPR. The credit reference agency refused this request. The debtor then lodged a complaint with the DPA.

2. Decision of the DPA

The DPA assessed the continued storage of data in the light of Article 6(1)(f) of the GDPR. According to this provision, processing is permitted if

• there is a legitimate interest,
• the processing is necessary, and
• the interests of the data subject do not override those interests.

Credit reference agencies generally have a legitimate interest in processing creditworthiness-related data for the purpose of protecting creditors.

With reference to the ECJ judgement in the SCHUFA case (joined cases C-26/22 and C-64/22), the DPA clarified that even payment histories that have already been settled may still be relevant to creditworthiness for a certain period of time. When balancing the interests, particular consideration must be given to the potential creditors’ interest in information and the impact of the storage of such data on the data subject.

In the specific case, the debt had remained outstanding for over three years and had only been settled in full following debt collection proceedings. The DPA continued to regard this as a circumstance objectively relevant to creditworthiness. As only around one month had elapsed since the payment, and as the inclusion of recent payment defaults is necessary for a comprehensive credit report, the interest in creditor protection prevailed. The storage of the debtor’s data was therefore lawful.

3. Conclusion

The complaint was therefore dismissed. At the same time, the DPA set a time limit: payment history data with a positive outcome may still be stored, but must be deleted no later than one year after full repayment. In doing so, the DPA is guided by the one-year retention period set out in Section 256 of the Insolvency Act (IO) and applies the principles of the ECJ’s SCHUFA ruling to other payment history data.

About the author:
Ms Mag. Sylvia Unger has been a solicitor for over 25 years and founded her own law firm, ‘Unger Rechtsanwälte’, in 2011.

Her areas of specialism include employment law, company law, contract law and payment transactions law. She is the (co-)author of several specialist books, gives lectures on employment law, company law and payment transactions law, and advises companies across a wide range of sectors.