AI credit scoring and GDPR compliance: What organisations need to know

Automated credit scoring is not new. Lenders have long used algorithms to assess creditworthiness, relying on pre-defined rules and traditional credit bureau data. 

Modern AI credit scoring represents a fundamental shift in approach. Machine learning models can analyse much larger datasets and identify more complex patterns than traditional scoring systems. However, where AI influences access to credit, errors or unfair outcomes can have a significant impact on individuals. Organisations therefore need to understand how personal dataInformation which relates to an identified or identifiable natural person. is being used, how much weight to give to AI determined outcomes, and what safeguardsWhen transferring personal data to a third country, organisations must put in place appropriate safeguards to ensure the protection of personal data. Organisations should ensure that data subjects' rights will be respected and that the data subject has access to redress if they don't, and that the GDPR principles will be adhered to whilst the personal data is in the... are in place. 

This blog explores the main GDPR risks of AI credit scoring and how organisations can use these systems compliantly, including the different requirements that apply under UK and EU data protection lawAny law, statute, declaration, decree, directive, legislative enactment, order, ordinance, regulation, rule or other binding restriction (as amended, consolidated or re-enacted from time to time) that relates to the protection of individuals with regards to the Processing of personal data.. 

Key takeaway: AI credit scoring must comply with GDPR requirements for transparency, fairness, accuracyIn data protection terms, the concept of ensuring data is not incorrect or misleading., and lawful processing. Organisations should assess how automated scores influence lending decisions, identify whether GDPR rules apply, and put appropriate safeguards in place. EU and UK requirements differ, particularly for significant decisions made without meaningful human involvement. 

• AI credit scoring in data protection law
• The GDPR risks of AI credit scoring
• How to use AI credit scoring in compliance with the GDPR

What are the GDPR requirements for AI credit scoring?

EU GDPR 

Under Article 22 of the EU GDPRRegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons regarding the processing of personal data and on the free movement of such data (General Data Protection Regulation)., individuals have specific protections where decisions are based solely on automated processing and have a legal or similarly significant impact on them. 

The Court of Justice of the European Union’s Schufa judgment confirmed that generating a credit score can itself fall within Article 22 where another organisation relies heavily on that score when making its decision. 

This means organisations need to look beyond who formally approves or rejects an application and consider how much influence the automated score has in practice. 

Under the EU AI ActThe EU Artificial Intelligence Act was approved by the EU Council on 21 March 2024. A world-first comprehensive AI law, intended to harmonise rules for the development, deployment, and use of artificial intelligence systems across the EU., AI systems used to assess creditworthiness or establish their credit scores are generally classed as high-risk, with exceptions including systems used to detect financial fraud. 

UK position

On 5 February 2026, changes introduced by the Data (Use and Access) Act 2025 came into force, replacing Article 22 of the UK GDPRThe UK General Data Protection Regulation. Before leaving the EU, the UK transposed the GDPR into UK law through the Data Protection Act 2018. This became the UK GDPR on 1st January 2021 when the UK formally exited the EU. with Articles 22A-D. 

Organisations now have greater scope to make significant, solely automated decisions using personal data that is not special category dataTypes of personal data listed in Article 9(1) GDPR that are considered sensitive and thus require extra protection. Article 9(1) lists data relating to: • racial or ethnic origin • political opinions • religious or philosophical beliefs • trade union membership • genetic data • biometric data • health • sex life • sexual orientation Where these types of personal....

However, safeguards still apply. Individuals must be able to: 

• Receive information about the decision 
• Make representations 
• Obtain human intervention from someone with the knowledge and authority to review and, where appropriate, overturn the automated decision  
• Contest the outcome 

More restrictive rules continue to apply where special category data is involved. 

For organisations operating in both the UK and EU, this means the same credit scoring processA series of actions or steps taken in order to achieve a particular end. may be subject to different automated decision-making rules in each jurisdiction.

What are the GDPR risks of AI credit scoring?

AI credit scoring can create several data protection risks, particularly where automated outputs have a significant influence on lending decisions. 

• Lack of transparency
  Traditional credit scoring models are often easier to explain because individual factors and thresholds can be identified more clearly. Complex AI models may assess multiple variables and their interactions at once, making it harder to understand which factors influenced a score or explain why an individual received a particular outcome. 

• Bias and unfair outcomes
  AI models may reproduce bias contained within historic data or perform less accurately for groups that are poorly represented in the dataset.
  Risk can also arise where apparently neutral information acts as a proxy for characteristics that should not influence lending decisions. For example, if historic lending data shows lower approval rates for applicants from certain postcodes, an AI model may learn to associate those areas with higher risk and continue that pattern in future decisions. 

• Inaccurate data and predictions
  Credit scores may rely on data from several sources, so incorrect, outdated or mismatched information can affect an outcome before the AI model has even processed it. 

• Excessive data use
  AI systems can draw on a much wider range of information than traditional credit scoring, potentially including utility payment patterns, social media activity or digital platform usage. This increases the risk that organisations process more personal data than is necessary to assess creditworthiness. 

• Weak human oversight
  Where staff rely too heavily on automated recommendations, human review may become a formality rather than a genuine safeguard. 
  

How do AI credit scoring risks differ between FinTechs and traditional banks?

The risks associated with AI credit scoring can vary depending on an organisation’s technology, data, and operating model. 

FinTechs may have greater flexibility to adopt AI models but less historical customer data to draw on. This can increase reliance on alternative data, such as Open Banking transactions, eCommerceThe buying or selling of products or services online. activity, or behavioural information. As a result, they may need to pay closer attention to whether that data is necessary, transparent, and supported by an appropriate lawful basisIn the event of processing personal data, an appropriate rationale in order to process personal data.. 

Traditional banks often hold larger volumes of long-term customer data but may need to integrate newer AI models with legacy systems. Where data and decision-making are spread across multiple systems, it can become harder to trace how an outcome was reached and ensure human reviewers have the information they need to challenge it.  

1. Conduct a DPIA and map the decision-making process 

A Data Protection Impact AssessmentA formal documented assessment which allows decision-makers to identify, manage and mitigate any data protection risks associated with a project. (DPIA) is required where processing is likely to result in a high risk to individuals’ rights and freedoms.  

Map the full decision-making process, not just who formally approves or rejects an application. Include what data enters the model, what it’s designed to predict, and how much influence its output has over the final decision. This will help establish whether human involvement is meaningful, which automated decision-making rules apply, and where additional safeguards may be needed. 

Review the DPIA if the model, data sources, or way the score is used changes. 

Learn more about DPIAs 

2. Confirm your lawful basis and data use

Identify and document the lawful basis for each relevant processing activity. Don’t assume the same basis automatically covers collecting personal data, generating a credit score, and using that score to make a lending decision. 

Also consider whether all the data being used is genuinely necessary. This is particularly important where AI introduces alternative data sources or creates new inferences about individuals. 

Where special category data is involved, additional conditions and restrictions may apply. 

Documenting the reasoning helps demonstrate accountabilityPerhaps the most important GDPR principle, which requires controllers to take responsibility for complying with the GDPR and, document their compliance. and makes it easier to reassess the position if the way the system is used changes. 

3. Test for accuracy and unfair outcomes 

Testing should take place before deployment and throughout the system’s lifecycle. 

Monitor whether: 

• The source data remains accurate and relevant 
• The model continues to perform as expected 
• Error rates are acceptable 
• Outcomes differ significantly between groups 
• Updates to the model or dataset have changed its behaviour 

Unexpected differences should be investigated to understand what is causing them and whether changes are needed. 

4. Make human review meaningful

If human review is part of the process, staff need enough information and authority to challenge the automated recommendation. 

They should understand what factors influenced the score, when the model may be unreliable, and what other information should be considered before reaching a decision. 

It can also be useful to monitor how often reviewers disagree with automated recommendations. If decisions are almost never changed, consider whether the review process is genuinely independent or has simply become a procedural step.

5. Explain decisions and make them easy to challenge

Individuals should understand: 

• When AI has influenced a decision 
• The main factors behind the outcome 
• What they can do if they think the decision is wrong 

This information should be reflected across relevant customer communications, including the Privacy NoticeA clear, open and honest explanation of how an organisation processes personal data. and, where appropriate, decision letters or outcome notifications. 

Avoid overwhelming people with technical detail. Focus on what they need to understand the decision and challenge it effectively. 

There should also be a clear process for correcting inaccurate information, providing additional evidence or requesting human review. 

Guide to updating Privacy Notices for AI 

6. Review third-party providers

Using an external AI or credit scoring provider does not remove your data protection responsibilities. 

Before adopting a system, establish: 

• What data the provider uses 
• How the model has been tested 
• How accuracy and bias are monitored 
• Whether the provider can provide enough information for you to explain individual outcomes 

You should also know when the provider changes its model or data sources, as this could affect your original risk assessment. 

If a supplier cannot give you enough information to understand the system or meet your own GDPR obligations, treat this as a compliance risk. 

Bank Due Diligence checklist 

Using AI credit scoring responsibly

AI can help organisations make faster and more sophisticated credit assessments, but it can also make decisions harder to understand and challenge. 

Organisations need to know where automationA process or a system that operates automatically. influences the process, test the outcomes it produces and make sure individuals have a meaningful route to question decisions. 

Regular review is also important. As models, datasets and suppliers change, the risks can change with them. 

The DPO Centre has extensive experience working with finance and insurance organisations to manage the risks associated with AI.
Contact us to find out how our DPOs and AI specialists can support you.  

In case you missed it…

• GDPR & AML: Why Financial Services must align KYC, CDD, and data protection 
• GDPR compliance in white label banking 
• Bank due diligence: Data protection checklist for providers