Hong Kong credit checks: when are you collecting too much candidate financial data?

Hong Kong credit checks become excessive when you collect more financial information than a candidate’s role reasonably requires. Under Hong Kong’s Personal Data (Privacy) Ordinance (PDPO), you must be able to demonstrate that financial screening serves a legitimate recruitment purpose and that the information you collect is proportionate to that purpose. Even with a candidate’s consent, you could breach privacy requirements if you request unnecessary financial details.

If you’re hiring for financially sensitive roles, you need to determine how much information is necessary to assess risk without intruding unnecessarily into a candidate’s private finances.

When are employment credit checks justified in Hong Kong?

You can justify credit checks when a candidate’s financial circumstances have a direct bearing on their professional responsibilities.

For example, if you’re hiring a finance director with authority over company funds, checking for bankruptcy proceedings or significant outstanding judgments may be reasonable. If you’re recruiting a marketing executive without financial responsibilities, requesting their entire borrowing history would be considerably harder to justify.

If you operate in regulated financial services, you may have stronger grounds for conducting financial screening.

Hong Kong’s Securities and Futures Commission (SFC) considers financial status, solvency and financial integrity when assessing whether individuals are fit and proper to perform regulated activities.

The SFC’s Fit and Proper Guidelines identify circumstances such as undischarged bankruptcy and failure to meet judgment debts as relevant considerations.

However, you should never automatically interpret financial difficulties as evidence of dishonesty.

In Veremark’s 2025 screening data, adverse financial history checks flagged discrepancies in 7.4% of cases. These findings show that financial screening can identify information worth investigating, although a discrepancy alone does not establish that someone is unsuitable for employment.

You still need to understand what each finding means for the specific role you’re recruiting for.

Where does your financial screening become excessive?

Hong Kong’s PDPO establishes a clear standard for the personal information you can collect.

Data Protection Principle 1 (DPP1) requires you to ensure personal data collection is necessary, adequate and no more than the stated purpose requires.

The Privacy Commissioner for Personal Data’s Code of Practice on Human Resource Management reinforces this requirement. Any additional information you obtain through security vetting or integrity checks must be relevant to the nature of the job.

You risk crossing that boundary in several situations.

Applying identical credit checks to every candidate

You might find it easier to use a standard screening package across every position, but doing so can lead you to collect more information than you need.

For example, if you request financial reports from customer service candidates simply because they work for a bank, you may struggle to justify the checks without identifying financial risks associated with their actual responsibilities.

Requesting detailed financial records without a specific reason

You might reasonably need to establish whether a candidate has an outstanding bankruptcy order.

That does not automatically justify asking for several years of bank statements, credit card transactions, mortgage balances or personal spending details.

By collecting these records, you could gain access to sensitive information about a candidate’s relationships or health that has little relevance to your hiring decision.

Collecting financial information too early

If you request extensive financial disclosures from every applicant at the initial application stage, you increase your exposure to unnecessary personal data.

You can reduce this risk by conducting relevant checks once a candidate reaches the final selection stage, ideally following a conditional offer where practical.

Using credit scores as automatic rejection criteria

If you automatically reject candidates below a particular credit score, you risk overlooking the circumstances behind their financial history.

A poor credit rating can result from unemployment, unexpected expenses or previous financial hardship.

You should establish whether the information genuinely affects the candidate’s ability to perform the role before making a decision.

Why candidate consent does not remove your privacy obligations

You need appropriate candidate authorisation to access credit information through employment screening services. However, consent does not give you unrestricted permission to collect financial data.

Before conducting Hong Kong credit checks, you should clearly explain why you need the information, whether providing it is compulsory and how you intend to use it.

You should also tell candidates who may receive their information, how long you will retain it and how they can request access to or correction of their personal data.

These requirements reflect the PDPO’s collection and transparency obligations.

Hong Kong credit reporting provider TransUnion offers an example of a more controlled process.

Through its Credit Report Sharing Platform, you can receive credit reports that candidates have authorised for release to your organisation. The employment version also conceals certain personal information, including credit card numbers.

This allows you to access relevant financial information while reducing unnecessary disclosure.

Nevertheless, you must still be able to justify why you need the report in the first place.

Why you need to limit how long you retain financial information

Your privacy obligations continue after you have made a hiring decision.

Under DPP2, you must avoid retaining personal information longer than necessary for its intended purpose.

A Hong Kong case illustrates the consequences of getting this wrong.

In a case published by the Privacy Commissioner in February 2025, a financial institution collected unnecessary personal information from outsourced staff and applied a uniform seven-year retention period.

The Privacy Commissioner found breaches of several data protection requirements, including those covering excessive collection, notification and retention.

Although the case concerned employee identification data rather than credit reports, you should apply the same principle to your financial screening practices.

You need retention periods that reflect the information’s purpose and any applicable legal or contractual requirements.

For example, TransUnion’s employment credit report service terms require participating employers to delete reports within 12 months of receipt.

If you keep complete financial reports indefinitely in case they become useful later, you expose your organisation to avoidable privacy risks.

How can you keep your credit screening proportionate?

You should define your screening requirements according to each position’s actual exposure to financial risk.

From our experience of conducting background checks at Veremark, a role-specific approach helps you justify which checks are necessary and interpret findings more consistently.

Establish a documented reason for each check

Identify the financial responsibilities that justify screening. If you’re hiring for regulated positions, record the applicable requirements.

Where a narrower bankruptcy or public-record search can address your concern, consider whether you actually need a full consumer credit report.

Limit who can access financial information

Make sure only authorised personnel involved in your hiring decision can access sensitive findings.

Where appropriate, you can provide hiring managers with relevant screening outcomes rather than complete financial documents.

As covered in Veremark’s guide to what happens during a background check, you should align screening requirements with the responsibilities and regulatory obligations of the role.

Give candidates an opportunity to explain findings

Before you make an adverse hiring decision, check that the information is accurate and give the candidate a reasonable opportunity to explain any findings.

You should also apply these controls when working with external screening providers. Outsourcing your checks does not remove your responsibility for protecting candidate information.

Keep your screening proportionate with Veremark

You can use financial screening to protect your organisation when the checks are relevant to the position and supported by clear requirements. Collecting unnecessary information increases your privacy exposure without necessarily improving your hiring decisions.

With Veremark, you can manage employment background checks through screening services tailored to your hiring requirements.

Book a demo with Veremark to explore how you can outsource your background checks, reduce the administrative burden on your team and take a more proportionate approach to candidate screening.