Alternative Credit Data and Compliance

Define alternative data by its source and purpose

Alternative credit data commonly means information beyond traditional bureau credit files, such as verified rental payments, utility histories, cash-flow characteristics or selected transaction signals. The label does not create a special exemption from data protection or lending regulation. The creditor should identify the exact data, how it was generated, whether it measures repayment capacity and how its use affects consumers with little conventional credit history. GDPR applies whenever personal data is processed in its scope, including derived profiles and scores. For in-scope agreements, CCD2 Article 18 governs the creditworthiness assessment under national measures generally applying from 20 November 2026. Different national reporting laws may constrain access to specific datasets.

Assess relevance rather than novelty

A payment record may be relevant to regular outgoings, but it can also reflect shared household costs, financial hardship or billing disputes. Purchasing a commercially available data feed does not prove that every feature is accurate or suitable for underwriting. Document what the source covers, what is missing, how far back it looks and which decision questions it can reasonably inform. Under GDPR Article 5, purpose limitation, data minimisation and accuracy require attention to collection and use. CCD2 Article 18 requires the use of relevant and accurate information and includes restrictions on the categories of personal data that may be processed in creditworthiness assessments. Review the actual enacted text and national implementation when designing features.

Establish the processing ground and transparency

The data owner, aggregator and creditor may have different controller or processor roles. Determine these roles by who decides the purposes and essential means of processing, not only contractual terminology. GDPR Article 6 requires an appropriate lawful basis and Articles 13 and 14 impose transparency duties as applicable. Sensitive or inferred information may raise additional constraints; a lawful basis for one purpose does not automatically authorise repurposing for credit pricing or marketing. If data comes through an account information service, payment-services consent under PSD2 must be analysed separately from GDPR lawful basis. Be explicit about which entity receives raw transactions and which receives only an assessed indicator.

Test fairness and proxy effects

Alternative sources may help evaluate applicants who lack bureau records but may also disadvantage groups whose payment patterns reflect circumstances unrelated to willingness or ability to repay. A feature such as postcode, device behaviour or usage hours may operate as a proxy for a protected characteristic or correlate with vulnerability. Test outcome differences and error rates under the applicable discrimination, consumer protection and data protection rules. The analysis should cover false negatives, missing-source applicants and consumers unable or unwilling to connect an account. A model that improves predictive performance overall may still warrant restriction or redesign if data use is disproportionate or its explanations are inadequate.

Manage automated decisions and correction requests

When alternative data drives an automated eligibility decision, review GDPR Article 22, the SCHUFA judgment and relevant safeguards in light of how decisive the model output is. Maintain the ability to identify and correct source errors, mapping failures and mistaken identity associations. Consumers may exercise rights of access, rectification and other applicable data protection rights, although their scope depends on circumstances. If a rent feed reports the wrong amount or a cash-flow parser double-counts transfers, the lender should know which source to challenge and whether the decision must be re-evaluated. Preserve versioned feature definitions so investigators can reproduce material processing steps.

Build a documented alternative-data gate

Before launching a new dataset, assess legal permission, collection notices, necessity, integrity, security, retention, predictive relevance and consequences for consumers. Require a clear purpose owner and an accessible consumer challenge process. Pilot models on representative records and separately inspect thin-file or missing-data populations. Include change controls for third-party schema updates and source withdrawal. Where high-risk processing merits a GDPR data protection impact assessment, assess that duty under Article 35 rather than treating every alternative feed identically. Revisit the framework when products, lawful bases, models or CCD2 implementing measures change. Maintain traceable findings rather than generic assertions that alternative data is inherently more inclusive. For example, a recurring payment from a payroll account may be a stronger indicator of stable income than a newly inferred lifestyle score, but only after identity, frequency and exclusions are checked. An internal control should make that comparison explicit. Establish what happens when a data subject disputes the underlying event and whether the lender can offer a proportionate alternative evidence route. Avoid treating the presence of an alternative-data source as a reason to retain every raw attribute after the decision. Both lawful collection and lawful continued use require independent justification.

Frequently asked questions

Related research

credit data and credit reporting compliance overview ↗

Open Banking Data and Credit Decisions ↗