How will the GDPR influence debt collection? Will collection companies still be allowed to collect and process personal data? - Yes! That is the conclusion of a new White Paper, recently published by the German Association of Debt Collection Companies (BDIU).


The GDPR will apply from 25th May 2018. As of that day, debt collection agencies in Europe need to ensure they're compliant with this new legislation. What does this mean in practice? On behalf of the BDIU, Dr. Kai-Uwe Plath (LL.M. New York) examined the requirements of the General Data Protection Regulation to business activities of debt collection agencies. His most important findings:

  • Under the regime of the GDPR, Debt collection companies are entitled to collect and process personal data required for collecting the debt.

  • Processing personal data remains legal without consent, as long as it is nesessary to enforce the rights of a third party (i.e. creditors) or for performance of a contract.

  • According to the GDPR, the enforcement of claims is a “legitimate interest”.
  • Profiling remains possible for debt collection agencies.

An English translation of the most important parts of the White Paper can be found here.

The original version of the White Paper (German language) can be found here.