Legal entity or natural person?
Short answer: information about a BV or NV does not fall under the GDPR (AVG); information about an individual, sole trader or partner in a VOF does. That distinction determines what you may request and record.
What lawful basis do you need?
For credit information about individuals, business customers generally rely on:
- Legitimate interests: you want to assess a credit risk before supplying goods or services or providing finance. You must balance this interest against the data subject's privacy and document that assessment.
- Performance of a contract: the assessment is necessary to process an application.
- Legal obligation: for example, mandatory checks in regulated sectors.
Consent sounds straightforward, but in a commercial relationship it is rarely freely given and is therefore an uncertain basis.
Your obligations at a glance
- Inform the data subject in your privacy notice that you may request credit information and why
- Limit yourself to what is necessary — data minimisation: no full dossier for a €200 order
- Keep data no longer than necessary and specify a retention period
- Facilitate rights: access, rectification and objection
- No fully automated decision with legal effects without human intervention (Article 22 GDPR (AVG))
- Enter into a data processing agreement where applicable
How CreditCheck.nl handles this
We supply credit information about individuals exclusively to business customers with a demonstrable lawful basis, and never publicly through the website. Every delivery includes the source and reference date. Information about legal entities — including insolvency notices — is publicly accessible.
Frequently asked questions
Can I check a sole trader without further justification? Business details from the Business Register are public, but as soon as information can be traced back to the business owner as an individual, the GDPR (AVG) applies.
May I share screening results internally? Only with employees who need them for the credit decision, and for no longer than necessary.
Must I tell the data subject that I have carried out a check? You must be transparent about the processing; a rejection based on credit information should be accompanied by an explanation.
From explanation to a company file
- Check a company's creditworthiness
Combine registration details, annual accounts, payment history and insolvency information before doing business.
- Credit report: example and request
View a clearly fictional file, its sources and limitations, and request credit information.
Sources and scope
Examples and policy choices in this article are illustrative, not a current quotation, fixed standard or financial or legal advice. The editorial revision date relates to the summary, structure and source references; it is not a reference date for the underlying data.
| Primary source | What is it used for? |
|---|---|
| EUR-Lex — General Data Protection Regulation | Legislative text, including legal bases (article 6), information obligations and automated decisions (article 22). |
| KVK (Dutch Chamber of Commerce) — checking business partners | Company identification and checks on business partners. |
Source links support the topic mentioned, but do not automatically substantiate all percentages, time frames or examples in this article. Check current terms and rules with the responsible authority.
Request credit information with sources and reference dates
