Background checks have become a routine part of recruitment in Hong Kong, particularly in sectors where trust, financial responsibility or regulatory oversight are central to the role. Yet the legal landscape governing the collection and use of personal data is strict and complex. Employers must comply with the Personal Data (Privacy) Ordinance, sector-specific rules, and growing expectations of transparency. Missteps, such as collecting unnecessary data or failing to obtain consent, can lead to regulatory scrutiny and reputational risk. Below is a clearer look at the key issues employers should consider when screening criminal records, public-domain information and references.
A criminal conviction history is personal data under the PDPO and can only be collected where necessary and directly relevant to the job. Roles involving high ethical standards or sensitive responsibilities – such as financial services, legal work or childcare – are more likely to justify such inquiries. However, unlike some other jurisdictions, Hong Kong offers almost no independent method for verifying criminal records.
The Hong Kong Police Force can issue Certificates of No Criminal Conviction only for visa or adoption applications, and these are sent directly to government authorities. Employers cannot rely on CNCCs for employment checks.
Some employers may consider asking candidates to make a data access request to the Criminal Conviction Data Office. This is legally permitted but offers limited assurance: the request must be made in person, responses may be verbal if no record exists, and any written information is provided only to the applicant. Employers should also be aware that under the Rehabilitation of Offenders Ordinance, candidates may withhold spent convictions for most jobs, except in certain regulated professions.
The practical outcome is that employers may ask about convictions but cannot require documentary proof. Any request must be proportionate and clearly explained.
Reviewing a candidate’s publicly available profile – social media, company registers or professional bios – is now standard practice. But public availability does not equate to unrestricted use. Under the PDPO, using personal data for a “new purpose” without consent is unlawful.
Before using publicly accessible information, employers should take the following into account: the original purpose of publication, any restrictions set by the individual, and whether the candidate could reasonably expect the data to be used in recruitment. Public information may also be outdated or misleading, and relying on it without verification risks unfair assessments.
Employers should inform candidates that public-domain data may be reviewed and offer an opportunity to correct inaccuracies. If the purpose of publication is unclear, explicit consent should be obtained. Where third-party screening providers are used, contracts must obligate them to comply with all applicable data-protection rules.
Reference checks remain an important tool for verifying suitability, and in some sectors, such as banking, they are mandatory. The Mandatory Reference Checking Scheme requires authorised institutions to exchange conduct-related information covering the previous seven years for certain roles.
For all other positions, employers must obtain express consent before contacting a candidate’s current or former employer. Information originally collected for internal HR purposes cannot be legally reused for third-party background checks without permission.
Aside from compliance, obtaining consent is a matter of professionalism. Contacting a current employer without informing the candidate can seriously damage trust before employment even begins.
Effective screening requires structure, restraint and transparency. Before collecting any data, employers should consider the following:
Clear internal policies, training for HR teams and consistent documentation practices help ensure that screening remains compliant and defensible.
In Hong Kong’s tightly regulated environment, responsible background checking is essential. Employers that conduct consistent checks, communicate openly with candidates and uphold strong privacy standards can reduce risk while strengthening trust.
Ultimately, informed hiring does not require intrusive data collection; it only requires careful judgement, transparent processes and respect for personal privacy at every step.
How Access Financial Empowers Recruiters, End-Clients, and Talent in Hong Kong
Access Financial specialises in enabling companies, recruiters, employees, and independent contractors to operate globally with full compliance and peace of mind. In Hong Kong, we provide comprehensive Employer of Record (EOR) solutions as well as visa sponsorship support for talent relocation.
Our team continuously monitors labour legislation and the latest developments in Hong Kong’s immigration policies. This allows us to help clients eliminate operational headaches by assuming responsibility for onboarding, tax and legal compliance, payroll administration, relocation support, and other employment-related obligations.
To learn more about how our Hong Kong solutions can support your business needs, simply complete the form — one of our specialists will get in touch to offer a tailored solution.