Germany · Law
BDSG section 37a and scoring in Germany
From 20 November 2026, BDSG section 37a governs credit and behaviour scores in Germany. Banned data, explanations and the right to a human decision.
Section 37a of Germany's Federal Data Protection Act (BDSG) sets the rules for scoring, meaning probability values about a person's future behaviour used to decide on a contract, or about their ability and willingness to pay calculated by credit agencies. It applies from 20 November 2026, replacing section 31. It relies on the GDPR's opening clause to allow such score-based decisions, but bars scores built on special category data, age, gender, name, social network data, bank account flows or address data, excludes minors, and gives people rights to an explanation, to contest the decision and to have a person decide.
What it is
Section 37a is a new provision of the Bundesdatenschutzgesetz (BDSG), Germany’s Federal Data Protection Act. It was inserted by Article 3 of the law implementing the EU consumer credit directive (EU) 2023/2225, signed on 12 May 2026 and published as BGBl. 2026 I Nr. 139. From 20 November 2026 it replaces section 31 BDSG, the previous scoring rule, which is deleted.
The change follows the SCHUFA judgment of the Court of Justice of the EU in December 2023. The Court held that a score produced by a credit agency can be a decision based solely on automated processing under GDPR Article 22 where a third party such as a lender relies on it heavily to decide whether to enter into a contract. Section 37a gives German scoring a footing in the GDPR’s opening clause for decisions authorised by national law.
Who it applies to
Section 37a covers two kinds of probability value about a natural person.
- Behaviour scores. Values about a specific future behaviour of the person, created or used to decide on entering into, carrying out or ending a contract with them.
- Credit agency scores. Values about a person’s ability and willingness to pay, produced by credit agencies using information about claims.
The duties fall on the controllers that create the values, such as credit agencies, and on businesses that use them to decide whether to enter into, carry out or end a contract.
What it requires
When score-based decisions are allowed. Section 37a(1) says the right in Article 22(1) GDPR not to be subject to a solely automated decision does not apply, beyond the existing contract and consent exceptions, where such scores are created or used. That allowance holds only if the conditions in section 37a(2) are met.
Excluded data. A score may not be built on special categories of personal data, age, gender, name, data from the use of social networks, information on incoming and outgoing bank account payments, or address data.
No minors. Scores may not concern a person under 18.
Sound method and fixed purpose. The data used must be demonstrably significant for calculating the probability of the behaviour, based on a scientifically recognised mathematical-statistical method. The resulting scores may not be processed for any other purpose.
Claims data. For credit agency scores, section 37a(3) limits which unpaid claims can count, for example claims established by a court, acknowledged by the debtor, or reminded twice in writing at least four weeks apart with prior notice and not disputed.
Explanations on request. Under section 37a(4) the controller that creates the score must tell the person, on request and within the period in Article 12(3) GDPR, the personal data and criteria used, the weighting of the criteria that most influence the score, the meaning of the specific score, and the scores produced and their recipients. The information must be kept for one year.
Contest and human decision. Section 37a(5) gives the person the right to contest a decision based on the score, to state their own view and to have a natural person decide.
The same law also adds rules to section 30 BDSG for consumer credit. Where a creditworthiness assessment involves automated processing, the borrower can ask for human intervention, a clear explanation of the assessment and its logic, the chance to state their view, and a review of the assessment and the lending decision.
Key dates
- 7 December 2023. CJEU SCHUFA judgment (C-634/21).
- 12 May 2026. Implementing law signed, published in the Federal Law Gazette on 18 May 2026.
- 20 November 2026. Section 37a and the new section 30 rules apply, and section 31 is deleted.
- 2 December 2027. EU AI Act high-risk obligations apply to AI used for creditworthiness evaluation and credit scoring of natural persons.
How it relates to other frameworks
Section 37a is a German specification of GDPR Article 22, so the GDPR’s transparency and impact assessment duties apply alongside it. Where a score is produced by an AI system used to evaluate creditworthiness, the EU AI Act adds high-risk duties from 2 December 2027, supervised by BaFin for the financial firms it covers and otherwise by the Bundesnetzagentur under the KI-MIG.
In practice the work overlaps. A register of which models score people, a record of the data each one uses, a bias and explainability assessment, and a route for contested decisions to reach a person serve section 37a, Article 22 and the AI Act at once.
A note on this page
This is Aicura’s reading of section 37a BDSG. It is not legal advice and it is not the Act itself. Read the text in the Federal Law Gazette, and take advice on how it applies to your organisation.
Last reviewed 18 October 2026. This page explains the framework to support your governance work. It is not legal advice; read the official source for the authoritative text.
Questions
Why did Germany replace section 31 BDSG?
In the SCHUFA judgment of 7 December 2023 (C-634/21), the Court of Justice of the EU held that a credit agency's automated score can itself be an automated decision under GDPR Article 22 where a lender draws strongly on it. That put the old section 31 in doubt. Section 37a is built on the opening clause in Article 22(2)(b) GDPR, which lets national law authorise such decisions with suitable safeguards.
Which data can no longer be used for scores?
Section 37a(2) bars special categories of personal data under GDPR Article 9(1), age, gender, the person's name, personal data from the use of social networks, information on payments into and out of bank accounts, and address data. Scores may not be produced for minors, and the data used must be demonstrably significant for the prediction under a scientifically recognised mathematical-statistical method.
What must a scoring company tell a person?
On request, and within the GDPR's one-month period, it must explain in clear and plain language the personal data and criteria used, the weighting of the categories of criteria and of the individual criteria that most influence the score, what the specific score means, and the scores produced and who received them. It must keep the information needed to answer for one year.
Does section 37a apply to AI models?
It applies to any method that produces the probability values it describes, whether a traditional scorecard or a machine learning model. A model trained on any of the excluded data categories, or used for a minor, cannot produce a lawful score under it. Separately, AI used to evaluate the creditworthiness of natural persons is high-risk under the EU AI Act from 2 December 2027.
Start with the AI you run
Every framework begins with knowing which AI systems and agents you have. The AI register is free to start.