Understanding your situation
What you need to prepare
- ✓Rejection letter or notification from the bank/insurer (including date and reference number)
- ✓Your original application or a summary of what you applied for
- ✓Any credit report you can obtain (SCHUFA, Experian, Equifax, TransUnion - request a free copy under GDPR Article 15)
- ✓Evidence supporting your creditworthiness: payslips, tax returns, bank statements, employment contract
- ✓Documentation of any errors in your credit file that may have affected the decision
- ✓Correspondence with the institution about the rejection
- ✓Name and registered address of the financial institution (for formal correspondence)
⏰ Deadline
There is no hard deadline for invoking GDPR Article 22 rights, but act promptly - ideally within 30 days of the rejection. If you plan to file a complaint with your national Data Protection Authority (DPA), most DPAs expect you to first contact the data controller. For EU AI Act obligations, full enforcement for high-risk systems begins 2 August 2026, but GDPR rights apply now.
🏛️ Authority
The financial institution itself (first step: formal appeal to its Data Protection Officer). National Data Protection Authority: UODO (Poland), BfDI (Germany), CNIL (France), ICO (UK), AEPD (Spain), Garante (Italy), AP (Netherlands). Financial regulators: BaFin (DE), AMF/ACPR (FR), FCA (UK), KNF (PL).
⚖️ Legal basis
GDPR Article 22(1): right not to be subject to solely automated decisions with legal or significant effects. GDPR Article 22(3): right to obtain human intervention, express your point of view, and contest the decision. GDPR Articles 13(2)(f) and 14(2)(g): right to meaningful information about the logic involved. GDPR Article 15(1)(h): right of access to information about automated decision-making. EU AI Act (Regulation 2024/1689) Annex III, Category 5(b): credit scoring classified as high-risk AI. From 2 August 2026, AI Act obligations apply: risk management (Art. 9), human oversight (Art. 14), deployer obligations (Art. 26), and right to explanation (Art. 86). Already enforceable: Art. 85 right to lodge a complaint with market surveillance authorities. CJEU SCHUFA ruling (C-634/21, December 2023): automated credit scoring can itself constitute an Article 22 GDPR decision.
Expert tips
- 1Send your appeal directly to the institution's Data Protection Officer (DPO) - they are legally obligated to respond. You can usually find the DPO's contact details in the institution's privacy policy.
- 2Explicitly invoke GDPR Article 22 in your letter. Use the exact phrase: 'I exercise my right under Article 22(1) GDPR not to be subject to a decision based solely on automated processing.' This triggers specific legal obligations.
- 3Request a detailed explanation of which factors led to the negative decision - not just a generic score. Under GDPR Articles 13-15, the institution must provide 'meaningful information about the logic involved.'
- 4Request human review of your case. Under GDPR Article 22(3), you have the right to obtain human intervention, express your point of view, and contest the automated decision.
- 5If the institution refuses or provides an inadequate response within 30 days, file a formal complaint with your national Data Protection Authority. Include copies of your original appeal and the institution's response.
- 6Mention the EU AI Act classification of credit scoring as high-risk AI (Annex III, 5(b)). While full enforcement begins August 2026, referencing it signals awareness and may prompt a more serious response.
- 7Request a copy of your full credit file from the relevant credit reference agency (SCHUFA, Experian, etc.) under GDPR Article 15 - this is free and may reveal errors feeding the algorithm.