One of the most frequent questions in our reader inbox: „I have an old overdue record at the Credit Bureau, how do I clear it?” The short answer surprises some. If the debt is real and unpaid, the record stays until full settlement plus 4 years. If the debt was settled long ago or the data is wrong, you have a legal right to free deletion, but the procedure is nothing like the one promoted by firms charging 1,800 lei for a „quick fix”.
This guide covers everything you need to know in 2026 to act on your own or to decide when you actually need a lawyer.
Quick answer
• Negative data clears automatically 4 years after the overdue balance is fully paid
• Positive data clears 4 years after the loan contract is closed
• Direct GDPR request to the Bureau is free, 30-day response window
• A lawyer is needed only for complex cases (identity theft, contested record)
• Intermediary firms promising „quick deletion for 1,800 lei” do nothing you cannot do yourself
What the Credit Bureau stores
Biroul de Credit SA was founded in 2004 by a consortium of 25 commercial banks. It is a centralized database that collects the credit history of Romanian consumers. Operations follow NBR Regulation 6/2018, which spells out what data may be reported, how long it stays, and how it can be corrected.
The Bureau holds three data types: positive (loans taken and paid normally), negative (overdue beyond 30 days, court enforcement, garnishment), and inquiries (each time a bank checks your profile before a new loan).
Exact storage windows
Positive data on closed loans: 4 years from closure, deleted automatically. Negative data on settled overdue: 4 years from settlement, deleted automatically. Active overdue: stays as long as the debt is open, the clock starts only on full payment. Inquiries by lenders: 6 months. Erroneous data: deleted on verification via a GDPR request. Stolen identity records: deleted on proof of police complaint and prosecution start.
Key detail for settled overdue records: the 4-year clock starts on the day the last amount due is paid, not on the original due date. Someone who cleared an overdue in March 2022 has the record visible until March 2026, not March 2020.
Cases where you can legally request deletion
You have a firm right to deletion in four concrete situations, each with its own procedure.
1. Erroneous data
The bank reported the amount, date or status incorrectly. A frequent case: a payment made on the last due day is processed late, and the overdue appears in the Bureau even though money left your account on time. Proof here is simple: account statement with transaction date. You send a GDPR request to the Bureau and a parallel one to the lender.
2. Data no longer needed
The 4-year legal retention has passed, but the data still shows. Rare, because the Bureau auto-deletes. If you see this, it is a technical error and you correct it via a request.
3. Stolen identity
Someone took out a loan in your name using forged documents. You need a criminal complaint filed with the Police, a prosecution-start order, and only then the deletion request to the Bureau. The procedure takes 3-6 months but works with certainty.
4. Payment made but not reflected
Different from bank error: here you paid, the bank confirmed receipt, but the Bureau does not get the update. You send the lender an immediate update request, with a copy to the Bureau.
Step-by-step procedure
The standard process, valid for any of the four legitimate cases, has four chronological steps.
Step 1, initial request. Fill in the GDPR form on the official birouldecredit.ro site, in the „Your rights” section. Attach a copy of your ID and supporting documents (account statement, payment confirmation, criminal complaint). Send by email to [email protected] or by registered mail to the Bureau's office at Calea Victoriei 155, Bucharest.
Step 2, waiting for the reply. The Bureau has 30 calendar days to reply under GDPR art. 12. The reply comes on the channel you used. If the data is confirmed as erroneous, deletion applies within 7 business days.
Step 3, possible refusal. If the Bureau finds your case outside the listed grounds, it refuses in writing. The refusal is not final. You file a complaint with ANSPDCP within 30 days, free, with the same documents plus a copy of the Bureau's reply.
Step 4, possible court action. Only in exceptional cases, after the ANSPDCP route is exhausted, you go to civil court. Legal costs can be recovered if your action succeeds. This is where a lawyer is needed.
Real cost of deletion
Costs vary widely depending on case complexity and who handles it.
Direct GDPR request: 0 lei, fit for erroneous data and old settled overdue. Lawyer consultation: 250-450 lei, useful to avoid filing mistakes. Lawyer representation at ANSPDCP: 600-1,450 lei, when the Bureau refused the initial request. Lawyer for court action: 1,800-4,700 lei, for stolen identity with litigation. „Intermediary firms”: 1,000-3,250 lei, not needed.
The intermediary firms that pop up on Google when you search „credit bureau deletion” do one thing: fill in the GDPR form on your behalf, the same form you can complete yourself in 20 minutes. Charging 1,800 lei for a free procedure is, in many cases, exploitation of consumer unfamiliarity with their rights. ANPC logged 47 complaints on this topic in 2024, per the ANPC annual report June 2025, p. 89.
The Andrei case, Cluj, February 2025
Roman Dumitrescu, former BCR risk analyst: "An acquaintance, Andrei, 38, small entrepreneur in Cluj, called me in February 2025 with a typical problem. In 2019 he had taken a 23,450 lei personal loan from Raiffeisen, fell into overdue for 4 months in 2020 (pandemic, lost income), then cleared everything in November 2021 with a final 7,860 lei payment. In 2025, when he tried to take out a mortgage, BCR rejected the file because „the Credit Bureau report shows overdue history”. The 4-year clock would expire in November 2025. Nine months to go.
Andrei did two things in parallel. First, he filed a GDPR request with the Bureau asking for status update, explaining the overdue was long settled and no longer relevant. Second, he sent additional notes to BCR as a mortgage file attachment, with an updated Bureau extract showing the overdue closed since 2021. The Bureau confirmed the status in 18 days. BCR re-analyzed and approved the mortgage at the standard rate, not at a penalty rate. The lesson: the 4-year period exists, but until it expires you have the right to ask that your report reflects reality accurately, overdue settled, not active."
Mistakes that delay deletion
First and most expensive: paying intermediary firms before trying the free GDPR route. You lose 1,000 to 3,000 lei for something you would have obtained on your own.
Second, sending a request without supporting documents. The Bureau receives daily vague requests like „please delete my data”. The refusal comes as standard. Always attach a copy of your ID, payment proof, and a short explanation with concrete facts.
Third, waiting past 30 days without escalating. If the Bureau does not reply within the GDPR window, that is already a breach of rights and your ANSPDCP complaint becomes stronger.
Fourth, confusing „negative data deletion” with „creditor rehabilitation”. Even when the Bureau deletes the overdue, that does not force the original bank to give you back your good-customer standing. Two separate procedures.
How to shorten the deletion time
A few practical tactics that work.
Before sending the request, obtain an updated Bureau extract. Free once a year under GDPR art. 15, via the form on birouldecredit.ro. The extract shows you exactly what data is recorded, with date, amount and lender. A request based on concrete data has far better odds.
Send the request in parallel to the lender and to the Bureau. Many waste time only on the Bureau without attacking the source. If the bank updates the report to the Bureau, the data changes in the next automatic send, within 30 days.
Document everything with reference numbers and dates. Email with delivery confirmation has legal weight. A phone call has none, do not use it.
Frequently asked questions
My overdue was settled in 2020. Why does it still show in 2026? Check the exact last-payment date. If the final payment was after June 2022, the 4-year window has not expired. If it is older, you have a solid case for a GDPR update request.
The bank sold the receivable to a collector. Who deletes from the Bureau? Current reporting moves to the collector. Your request goes to the collector as current reporter and to the Bureau as data controller. The original bank no longer has standing.
Can I take a loan while I still have data in the Bureau? Yes, but the evaluation will weigh the history. A normally paid loan is neutral or slightly positive. An old settled overdue is neutral after 2 years. An active overdue almost certainly blocks approval.
How many parallel inquiries can I have in the Bureau? No legal limit. In practice, more than 4-5 inquiries in 30 days lower your internal score at most banks, signaling „desperate loan hunt”.
Is an online request to the Bureau valid without signature? Yes, if you send it from the email address associated with your ID and attach a copy of your ID. The Bureau accepts simple electronic signature for routine GDPR requests.
Related
• How to rebuild your credit score after overdue
• Your rights when taking a loan
• When refinancing is worth it
• Compare personal loans
• Early repayment calculator
Editor's note: „Credit Bureau deletion is not magic. It is a clearly regulated right under BNR 6/2018 and GDPR. Time limits are fixed, the procedure is standardized, the real cost is zero for the direct request. The only real barrier is consumer ignorance of their own rights, and on that ignorance the intermediary firm industry is built. With half a day of reading the official Bureau guide and a well-documented email, you solve on your own what others charge 2,000 lei to solve.”