What might this look like in practice?
Fictional example: Sophie, 41, lives in Graz and wants to spread the cost of a new kitchen with a personal loan of 12,000 euros. She applies through her bank's app. A few minutes later the app says the application cannot be approved.
Sophie writes to the bank and asks whether the decision was automated and which credit bureau was consulted. She also requests her free data access report from the Austrian credit bureau KSV1870. It lists a debt collection entry for a gym membership she cancelled correctly years ago. She sends the bureau and the gym her cancellation confirmation and asks for the entry to be corrected. That does not guarantee a yes next time, but her next application will be assessed on accurate data.
What rights do you have after a refusal?
Even a good assessment does not oblige a lender to grant you credit. You do, however, have the right to understand the decision. Some of these rights already apply under the General Data Protection Regulation (GDPR). The new EU Consumer Credit Directive (EU) 2023/2225, which applies from 20 November 2026, adds more.
| Right | What you can ask for | Legal basis |
|---|---|---|
| Access | A free copy of your personal data; for automated decisions, also meaningful information about the logic involved | Art. 15 GDPR (EU) |
| Rectification | Correction of wrong data, in principle within one month | Art. 16 GDPR (EU) |
| Human review | A person reviews a fully automated decision; you can express your view and contest the decision | Art. 22 GDPR (EU) |
| Explanation of the assessment | Where the assessment involves automated processing: human intervention, a meaningful, comprehensible explanation of the assessment, the chance to give your view and a review of the assessment and the credit decision | Directive (EU) 2023/2225, from 20 November 2026 |
| Database check | If you are refused because of a database check: the result, the database consulted and the categories of data used, without undue delay and free of charge | Directive (EU) 2023/2225, from 20 November 2026 |
Each EU country has to write the directive into its own law, so the exact wording depends on where you live. It generally does not cover loans above 100,000 euros, except unsecured loans to renovate residential property. Lenders should only use information that is necessary and proportionate, such as income, expenses and existing commitments. Health data and information from social networks are excluded.
If the refusal concerned a buy now, pay later purchase, also read Buy now, pay later: what changes from 20 November 2026.
What is a credit score and what must be explained to you?
Credit bureaus collect data on how you pay your bills, for example SCHUFA, Experian or CRIF in Germany and KSV1870 in Austria. From this they calculate a score: a value meant to express how likely you are to meet future payments. Each bureau weights data differently, so your rating can differ from one bureau to the next.
Two rulings by the Court of Justice of the European Union (CJEU) strengthen your position. On 7 December 2023, in case C-634/21, the court held that a credit bureau automatically producing a score is itself an automated decision if a lender draws strongly on it to decide on a contract. On 27 February 2025, in case C-203/22, it ruled that you can ask for an explanation of the procedure and principles actually applied to reach your result. A bare mathematical formula is not enough.
If a bureau cites trade secrets, it cannot simply refuse on its own authority. It has to pass the protected information to the supervisory authority or the court, which then weigh up the interests involved.
In Germany, SCHUFA is gradually introducing a new score between 100 and 999; from 776 points, creditworthiness is rated “excellent”. Because the switch is gradual, a lender may still rely on another score.
How do you ask the lender and the credit bureaus?
- Ask the lender in writing: was the decision automated? Which credit bureau or register was consulted, and which data played a role? If the decision was automated, ask for a human review.
- Request your free access report from each bureau the lender names. In Germany, SCHUFA calls it a “Datenkopie nach Art. 15 DSGVO” and Experian and CRIF a “Selbstauskunft”. KSV1870 in Austria accepts requests online, by email or by post.
- Make the request in writing or through the bureau's online form rather than by phone. You do not need to give a reason.
- Only enclose a copy of your ID if the bureau cannot otherwise identify you, and black out details that are not needed.
- Note the date. In the EU, the reply must arrive within one month at the latest; in exceptional cases this can be extended to three months in total. In Switzerland, the usual deadline is 30 days.
Sample wording for the lender
“Dear Sir or Madam, my credit application of [date] was refused. Under Article 15 GDPR, please give me access to the personal data you hold about me and tell me whether the decision was made by automated means. Please name the credit bureaus or registers you consulted and the categories of data you considered, and explain in plain terms how the assessment was reached. If the decision was automated, I request a review by a person. My point of view: [short explanation]. Yours faithfully, [name, address, date of birth]”
Tip: The free access report is all you need to check your data; paid credit reports are not required. File the replies where you will find them again: Find invoices and letters again with clear file names.
How do you get wrong entries corrected?
Check every entry: are your name, address and date of birth right? Are there contracts you never signed? Is a debt you have paid still shown as open?
- Write to the bureau stating exactly which details are wrong and what they should say.
- Enclose evidence, such as a bank statement or confirmation from the creditor. For tips on making paper records legible, see Scan a document and check it.
- Also ask the company that reported the entry to have it corrected or deleted at the bureau.
- If you get no reply or are not satisfied, complain to your data protection authority. In the EU, it must tell you about the progress or outcome within three months.
Correction is free of charge. The Austrian data protection authority advises against requesting access and erasure at the same time. A sensible order is to see what is stored first and then correct it.
How long entries stay on file depends on the country and the type of entry. KSV1870 gives a range of 90 days to 7 years. In Switzerland, according to the federal data protection commissioner, a bureau's data must not be more than ten years old.
What applies in each country?
| Country | Main databases | How to get your data | If you get stuck |
|---|---|---|---|
| Germany | SCHUFA, Experian, CRIF | Free data copy or self-disclosure, informal request, no reason needed | Data protection supervisory authority; consumer advice centre (Verbraucherzentrale) |
| Austria | KSV1870 and other bureaus | Free access under Art. 15 GDPR, online, by email or by post | Complaint to the Datenschutzbehörde (DSB) |
| Switzerland | ZEK (members such as banks only), IKO for consumer credit, credit bureaus | Access under Art. 25 FADP, generally free, usually within 30 days | Conciliation, then civil court at your place of residence; report to the FDPIC |
| France | FICP at the Banque de France (credit repayment incidents, over-indebtedness cases) | From the Banque de France online, by post or at a branch, with a copy of your ID | Rectification with the reporting lender; complaint to the CNIL |
| Italy | Private credit information systems (SIC) | Access from the SIC operator or the reporting lender, reply within one month | Complaint to the Garante per la protezione dei dati personali |
| Spain | CIRBE at the Banco de España; shared credit information systems (debtor files) | Free risk report via the Banco de España e-office; free access from whoever holds your data | Complaint to the Banco de España (CIRBE) or the AEPD |
Tip: The EU directive does not apply in Switzerland. Swiss lenders must still check your ability to repay before granting consumer credit.
When should you get individual advice?
You can do the steps above on your own. If there is a dispute with a creditor, a large sum involved or a risk of over-indebtedness, get individual advice, for example from a consumer organisation or a debt advice service. This guide explains your rights in general and is not legal advice for your case.
Common mistakes
- Paying for access: a copy of your own data is free; paid credit reports are not needed to check it.
- Asking only by phone: without a written record, you can hardly prove later when you asked for what.
- Checking only one bureau: lenders consult different bureaus, and each one weights data differently.
- Sending a full, unredacted ID copy although the bureau could identify you without it.
- Applying straight away at another lender before a wrong entry is fixed: it may see the same error.
Your checklist
The checkboxes are for your own reference. No entries are sent to us. To keep a copy, print the page or save it as a PDF using your browser menu.
Common questions
Does the lender have to tell me why my loan was refused?
Lenders rarely say that a low score caused a refusal, notes the German consumer advice centre. If the decision was automated, the GDPR already gives you a right to meaningful information about the logic involved and to a review by a person. From 20 November 2026, the EU Consumer Credit Directive also provides for a comprehensible explanation where the assessment is automated. If the refusal is based on a database check, the lender must then tell you so.
Is a credit report from a bureau really free?
Yes, a copy of your own data under the GDPR is free of charge. You can request it informally and without giving a reason. The German consumer advice centres warn against paid offers for this free access. In Germany, a bureau may only charge for excessive requests.
How often can I ask a bureau for my data?
There is no fixed legal limit in Germany. You can ask again whenever your data has probably changed, and the German consumer advice centres recommend checking at least once a year. Keep your requests in writing so you can follow up if a reply is late or incomplete.
Do the new EU rules also apply in Switzerland?
No. Directive (EU) 2023/2225 is EU law and does not apply automatically in Switzerland. There, a lender must check your ability to repay before granting consumer credit, and the Federal Act on Data Protection gives you a right of access. For automated individual decisions, you can state your point of view and ask for a manual review. For scores, a bureau must disclose the basic assumptions of its calculation.
Sources and further information
Primary sources from public authorities, consumer organisations and providers. A source may be in another language; follow the guidance that applies to your service and where you live.
- European Commission: Data protection – information for individualsSource review date:
- European Commission: Consumer protection in financial servicesSource review date:
- EUR-Lex: Directive (EU) 2023/2225 on credit agreements for consumersSource review date:
- EUR-Lex: CJEU judgment of 27 February 2025, case C-203/22 (referring to C-634/21)Source review date:
- KSV1870: Help and contact for private individuals (German)Source review date:
- FDPIC (Switzerland): Credit and collectionSource review date:
- FDPIC (Switzerland): Knowing and asserting my rightsSource review date:
- Verbraucherzentrale (Germany): Requesting access from SCHUFA and other credit bureaus (German)Source review date:
