Your personal data while you are job hunting

The Personal Data (Privacy) Ordinance (Cap. 486) applies to recruitment and to employment. The Code of Practice on Human Resource Management, issued by the Office of the Privacy Commissioner for Personal Data, applies the 6 data protection principles to recruitment, to the time you are employed, and to the time after you leave. From the applicant's side, the notes below set out what you can ask for, what the other party should not do, and what to do when something is wrong. They follow the Commissioner's key-points summary pages of the Code, in the parts on recruitment, on current employees, and on former employees, and the Community Legal Information Centre's questions and answers on personal data privacy in recruitment, in human resource management, and at work. Checked 19 October 2026. The full PDF of the Code could not be obtained for this note. What follows is based on the summary pages and on the Community Legal Information Centre.

A job advertisement: identify who is hiring

1. The point in the Code. If a recruitment advertisement does not show the identity of the employer, or of the employment agency recruiting for the employer, the employer should not use that advertisement to collect an applicant's personal data, for example a CV.
2. The Community Legal Information Centre states that the company's email address, telephone number, or fax number, on its own, is generally not enough to identify the employer.
3. If the employer does not want to publish its identity, the compliant approaches are these. On the applicant's request, provide an application form that shows the employer's identity. Appoint a recruitment agency, name that agency in the advertisement, and have the agency receive the data. Leave only a telephone number, and state that the applicant may enquire before providing personal data.
4. Why it matters. The Community Legal Information Centre states that collecting personal data without disclosing who is collecting it is generally unfair collection, and may breach data protection principle 1. If you do not know who the other party is, you cannot exercise the right to see your data and the right to correct it.
5. What you can do. If an advertisement gives you no way to identify the employer or the agency, do not send a full CV first. Send a short enquiry, confirm the name of the organisation, and then submit.

The personal information collection statement

1. A recruitment advertisement that asks applicants to submit data directly should include a statement of the use. An example is that the personal data collected will be used for recruitment only.
2. Another form of statement says that the data will be used in accordance with the employer's personal data policy, and that a copy of the policy can be provided at once on request. The advertisement must then give the employer's contact details.
3. You can ask to see that policy, so that you know whether the data will be passed to a related company or to a third-party screening firm.

How much data is reasonable

1. The principle. The data collected should be enough for the purpose, and not more than that. It should be relevant to selecting a suitable person.
2. Data about relatives. The Community Legal Information Centre gives this example. If the employer wants to know whether a relative of the applicant works for a competitor, it only needs to ask whether any relative works in the same industry or in a similar industry. If the answer is yes, it can ask further. The employer does not need the relative's actual occupation, so it should not collect that.
3. A criminal record. The legislation does not fix a list of data that must be collected. It depends on the case. Some posts may need the applicant to declare whether they have a criminal record, for example where the duties include keeping valuables, or being in charge of a storeroom. The employer should first consider whether the purpose can be met without collecting that data.
4. A background check. The employer may add to the data through a security check or an integrity check. The check should be used to assess whether the person is suitable for the post, and the data should relate to the nature of the post.

A copy of the identity card: only after the Offer is accepted

1. The Code. An employer should not collect a copy of an applicant's Hong Kong identity card during recruitment, unless that person has accepted the Offer.
2. Question 8 of the Community Legal Information Centre's questions and answers says the same. In general, an employer may not collect a copy of the identity card during recruitment, unless the applicant has accepted the Offer.
3. What you can do in practice. If an online application form asks you to upload a copy of the identity card, leave it blank, or ask whether you may provide it after you accept the Offer. If you are asked to photocopy the card at the interview, you can politely state what the Code requires, and offer to provide the copy after you accept the Offer. If identity needs to be checked, you can show the card for inspection, and not leave a copy.
4. The handling of an identity card number, and the collection of a copy of an identity card by an employment agency, are the subject of dedicated questions and answers and of cases at the Office of the Privacy Commissioner for Personal Data. The matching entries on the Community Legal Information Centre have to be read by logging in to the Commissioner's website. This note did not obtain the original text. The official website does not set this out (checked 19 October 2026).

A pre-employment medical examination

1. An employer may collect health data on the selected candidate through a pre-employment medical examination, on 2 conditions. The data relates directly to an inherent requirement of the post. The employment is conditional on passing the examination.
2. The timing. The data should be collected only after the employer has issued a conditional Offer to the selected candidate.
3. What this means for you. If you are asked for medical records, or for a full medical report, before a conditional Offer has been issued, you can ask for the reason, and for the link to the post.

How long an unsuccessful applicant's data is kept

1. Personal data on an unsuccessful applicant may be kept for not more than 2 years from the date of rejection, and should then be destroyed.
2. The exceptions. There is a continuing reason to keep it, for example to meet a legal obligation, or the applicant agrees to keep it for more than 2 years. The Community Legal Information Centre explains that the 2-year period takes into account that an unsuccessful applicant may make an allegation or a complaint related to discrimination.
3. A talent pool. If the employer asks whether you agree to have the data kept in a talent pool for other posts, you may agree or you may refuse.

After you join: the statement, and disclosure

1. When you join, the employer may collect further data from you and from your family, for the employment, or to meet a requirement of the law.
2. Before collecting it, the employer should give you a personal information collection statement for the employment. The statement should set out the purposes of the data, the classes of person to whom the data may be passed, and your right to see the data and to correct it.
3. Data put together in the course of a disciplinary process, a performance appraisal, or promotion planning should be used only for a purpose directly related to that process. It should not be disclosed to a third party who has no legitimate reason to have it.
4. Unless the disclosure is directly related to the employment, or the law or a statutory body requires it, the employer should obtain consent before disclosing an employee's data to a third party. The data disclosed should not go beyond what is needed.
5. If a human resource function is outsourced, for example payroll, the employer should take steps so that the contractor protects the data.

After you leave: references and retention

1. Data on a former employee may be kept for not more than 7 years from the date of leaving, unless there is a continuing reason, or the retention is to perform a contract or a legal obligation.
2. As early as possible, the employer should keep only the data that the need to retain it actually requires.
3. A notice that a former employee has left should not disclose that person's identity card number.
4. A reference. Before the employer gives a third party reference information on a former employee, it should obtain the former employee's consent, unless the employer is satisfied that the third party making the request has already obtained that consent.
5. What this means for you. When a new employer checks with a former employer, you generally sign an authorisation. In that authorisation, you can name the referees who may be contacted.

A request to see your data

1. The right. Data protection principle 6 provides that a person has the right to find out whether a data user holds their personal data, and to ask to see it.
2. The time. Unless an exemption under the Ordinance applies, the data user must provide a copy within 40 days of receiving the request.
3. A performance appraisal. The Ordinance exempts some data related to employment, for example data used for staff planning, or for assessing a person's ability to do the job. An employee may therefore not have a right to a copy of a performance appraisal. The Community Legal Information Centre states that the exemption is discretionary, not mandatory. The employer may still choose to provide the copy.
4. How to ask. Make a written request to the organisation that holds the data. The form to use, and any fee that may be charged, were not checked against the official text for this note (checked 19 October 2026). Follow what the Office of the Privacy Commissioner for Personal Data and that organisation say.

What to do if something is wrong

1. Ask the organisation first. Ask it to state the purpose of collection, the scope of use, and the retention period, or ask it to delete data that is not needed.
2. Keep the evidence. A screenshot of the advertisement, the application form, the emails, and the interview notice.
3. Enquire with the Office of the Privacy Commissioner for Personal Data, or complain to it. The website has a complaint procedure and a form.
4. Publishing online another person's copy of an identity card, or similar data, may be a doxxing offence. The Privacy Commissioner has powers of criminal investigation and of prosecution. See the doxxing material on the Commissioner's website and on the Community Legal Information Centre.

Sources

• Office of the Privacy Commissioner for Personal Data, key-points summary pages of the Code of Practice on Human Resource Management: recruitment, current employees, and former employees (checked 19 October 2026)
• Community Legal Information Centre, personal data privacy, questions and answers on the recruitment process, questions 2, 3, 6, 7, 8, and 12 (checked 19 October 2026)
• Personal Data (Privacy) Ordinance (Cap. 486), as cited on the pages above