Before signing (or reviewing) the contract
1. Check that the contract names the specific register
The clause must identify by name the system to which the data will be reported: Asnef-Equifax, Badexcug-Experian or whichever applies. Generic wording — “credit default registers”, “solvency registers” — will not do: for the court it is as if you had never informed the customer. And without that information, every entry made without a prior payment demand is a potential adverse judgment. (SAP Vizcaya 265/2022, of 15 June)
2. Check that the clause contains all the information required by Article 13 GDPR
Naming the register is not enough. The clause must meet the rest of the requirements of Article 13 (in particular, 13(1)(e) and 13(2)): recipients, retention periods, data subject rights. An incomplete clause is the same as no clause at all, and it obliges you to send a prior payment demand. (SAP Orense 629/2021, of 29 December)
3. If the contract does not meet points 1 and 2, send a verifiable prior payment demand
Without a valid clause, the prior payment demand is not a courtesy: it is mandatory. It must warn the debtor, before registration, of the possible entry in that specific register. Sending it by burofax (certified fax with content certification) with proof of receipt costs you a few euros; not sending it can cost you an award of thousands. (SAP Vizcaya 136/2022, of 27 May)
You have the text ready to adapt in the annotated prior payment demand template.
Before reporting the debt
4. Confirm that the debt is certain, due and payable
Only debts that are beyond doubt may be reported. If there is an outstanding condition, a period that has not yet expired or any doubt about the existence of the debt, the registration is unlawful even though the debtor owes the money. (SAP Orense 231/2026, of 10 April)
5. Check that the debtor has not disputed the debt in writing
A complaint, a billing dispute form or ongoing proceedings turn the debt into a disputed one. Reporting a disputed debt is an unlawful act capable of infringing the right to honour as well, and that multiplies the cost of the mistake. (SAP Orense 385/2023, of 13 June)
6. Check that the amount is exact and up to date
Not a euro more, no miscalculated interest, no part payments left undeducted. The data must be accurate and up to date; inaccurate data must be rectified or erased without delay. A wrong amount turns a real debt into a registration that attracts compensation. (SAP Asturias 412/2024, of 3 October)
Before treating the file as closed
7. Complete the evidence file
Signed contract, invoices, statement of the debt, demand sent and proof of receipt. In claims of this kind, complying is not enough: the burden of showing that you complied falls on your company. Whatever you cannot prove does not exist as far as the judge is concerned. (SAP Asturias 412/2024, of 3 October)
8. Make sure you can retrieve that file years later
The claim may arrive long after the registration. If on the day of the hearing nobody can find the contract or the proof of receipt, your company loses even though it did everything right. Define where each file is archived and who is responsible for it. (SAP Madrid 123/2026)
9. Verify the debtor's identity before reporting
If there was identity impersonation and you register the person impersonated, fault is presumed against your company: to be relieved of liability you will have to evidence adequate due diligence measures. Cross-check identity and documentation before reporting, and leave a trace of that check. (SAP Madrid 273/2024)
After reporting
10. Set up a simple, free-of-charge erasure channel, with a log of incoming requests
The individual has the right to ask for their data to be erased, and you are obliged to provide a simple, free-of-charge procedure. Log every request with the date it came in: that log is both your stopwatch and your evidence. (SAP Barcelona 307/2023)
11. Reply expressly to every erasure request within one month
Even if you think the request is unfounded. Even if you hold no data on the applicant. The reply must be express and must arrive within one month (the further two-month extension is available only on grounds of complexity, and must be notified within the first month). Silence is penalised too. (SAP Barcelona 307/2023)
12. Remove or update the data immediately after payment
Once the debt is paid, the data in the register is inaccurate and must be erased or rectified without delay (Article 5(1)(d) GDPR). Processing that began lawfully can cease to be lawful through the mere passage of time. Every extra day in the register is compensation accruing. (SAP Asturias 412/2024, of 3 October; SAP Alicante 33/2024)
How to use this list
- Make it a mandatory step in the process: nobody reports an unpaid debt without having gone through it.
- Record who went through it and when. That trail is evidence of diligence.
- If one point fails, do not report: put it right first. A delayed entry costs nothing; an improper registration costs thousands of euros.
- Review it whenever your standard contract, your demand template or the register you report to changes.
Indicative model. It is no substitute for legal advice. Read the no legal advice statement. © ILP Abogados — www.ilpabogados.com
How many of these 12 points does your company fail today?
The Exposure Test measures it in twelve questions and gives you an estimate in euros of your annual exposure to claims for improper registration, using the criteria applied by the Provincial Courts of Appeal.
Take the Exposure Test