Requesting Your Credit Report: Step by Step and Your Rights

A credit report shows which data credit agencies have stored about you and what assessment they derive from it. You can request this information through your right of access under the GDPR. This guide describes the procedure, the deadlines and what you can do with the reply.

The most important points in brief

• The right of access applies to all companies that process data about you, not only to credit agencies.
• The reply must in principle be given within one month.
• You receive a copy of the data in a structured form.
• The information covers, among other things, purposes, recipients and storage period.
• The form and application route follow the details of the respective agency.

What does the information under the GDPR cover?

The right of access under Article 15 of the GDPR goes beyond a simple copy of your data. The Bavarian data protection authority describes the following components in its information sheet for data subjects.

• The purposes for which your data is processed.
• The recipients or categories of recipients. Recipients already known must be named specifically.
• The planned storage period or the criteria used to set it.
• The origin of the data, if it was not collected directly from you.
• A copy of the data, meaning a structured reproduction rather than a photocopy.
• Information on further rights of data subjects and on your right to complain to the supervisory authority.

Which deadlines apply?

The deadlines are the core of the procedure. They help you judge a missing or late reply.

The information sheet is dated December 2024. Before you apply, check whether the supervisory authority has published further guidance.

How do you make the request?

1. Write to the credit agency or company and request information under Article 15 GDPR.
2. Give your name, date of birth and address so the company can identify you clearly.
3. Note the date of the request, because the one-month period starts from then.
4. Check the reply for completeness: purposes, recipients, storage period, origin and copy of the data.
5. Challenge incorrect data in writing with the controller and keep the documents.

Typical mistakes when applying

Many requests fail not because of the right itself but because of small details. Common mistakes are incomplete identity details, sending the request to the wrong body and missing proof of dispatch. Avoiding these points makes it easier to monitor the deadline.

• The request goes to a body that does not process the data.
• Name or address is missing, which delays the matching of your identity.
• Dispatch is not documented, so the start of the deadline remains disputed.

What can you do with the reply?

Check the stored entries, information on accounts and contracts, and the score value where it is shown. Whether and how a score appears in the information depends on the respective agency. You can object to errors in writing with the controller. If a reply is missing or incomplete, you can turn to the competent data protection authority.

What does the one-month period mean in practice?

The period starts when your request is received. It is a maximum deadline, not a waiting period, so the company should reply without delay. Only if it has to extend the deadline may it take up to two further months, and then only in exceptional cases such as particularly complex requests or a large number of applications.

The date of receipt therefore matters. Document it with proof, such as a dispatch receipt or a written confirmation of receipt.

Frequently asked questions

What is the difference between the information and the score?

The information shows the stored data. The score is an assessment calculated from it. The basics of the new credit score are explained in What the new credit score 2026 means for you (in German).

Can I calculate my creditworthiness myself?

A separate article (in German) covers what the new score allows consumers to do. Read it if you want to compare the information with your own assessment.

What happens if the reply does not arrive?

After the one-month period you have a reason to follow up. Document your request and its dispatch. A complaint to the data protection authority is possible if no reply or an incomplete reply arrives.

Do I have to give a reason for my request?

According to the information sheet, the right of access is a right of the data subject. A reason is not part of the request. Still, formulate the request clearly and precisely so that it can be processed quickly.

Which parts of the reply are especially important?

The details on the origin of the data and on the recipients are especially revealing. They show where information comes from and to whom it was passed on. Also check the storage period, because it shows how long an entry remains visible.

Who is responsible for the reply?

The company that processes the data is responsible. For a credit agency this is the agency itself, and for a contract partner it is that company. If you are unsure whom to contact, a short look at the provider’s data protection notice helps.

What you can do now

1. Set up a file for requests, deadlines and replies.
2. Send the request to every body where you suspect data is held.
3. Compare the replies and note any differences.
4. Clarify errors in writing before you use them in other procedures.

Related articles

• What the new credit score 2026 means for you (in German)
• Can I calculate my creditworthiness myself? What the new score allows (in German)
• Garnishment exemption 2026: what stays protected in your account (in German)
• Money, account and credit: the overview for young adults (in German)

Sources: Bavarian State Office for Data Protection Supervision, information sheet on the right of access (German) (status December 2024).

Last updated: November 2026. This guide is general information, not individual advice.