What Hong Kong's Personal Data (Privacy) Ordinance means for your job application

Every time you send a CV in Hong Kong, you're handing someone your name, contact details, work history, and often your salary expectations and HKID number. Most job seekers spend real effort getting their CV right for the Hong Kong market, then never ask what happens to that information after the application closes, who's allowed to see it, or whether they have any say in how long it's kept.

The answer is that you do have rights here, set out in Hong Kong's Personal Data (Privacy) Ordinance, and they apply whether you're applying directly to a company or through a recruitment agency. Most job seekers have never read them, and most job ads don't explain them.

This article covers what the Ordinance actually requires when your data is collected for a job application, and where a properly run recruitment agency changes the picture for the better rather than adding another party who has your CV.

Whoever collects your data has to identify themselves

The Ordinance's fairness requirement means an organisation collecting your personal data has to tell you who they are. A job advertisement that only gives a reply-to email or a PO box, with no named employer and no named agency, sits in a grey area the Privacy Commissioner's own guidance flags directly: job applicants can't exercise their data-access rights if they don't know who's holding their data in the first place.

This is where a recruitment agency actually helps rather than complicates things. Hong Kong's Code of Practice on Human Resource Management is explicit that when an agency is engaged to run a search, it's enough for the agency to be identified in the advertisement, and the underlying employer doesn't have to be named. That means a confidential search run through a licensed agency is the compliant way to keep an employer's identity private while still meeting the law's transparency requirement toward you. An anonymous box-number ad trying to do the same thing isn't.

You should be told why your data is being collected

Before or when your data is collected, you're entitled to a Personal Information Collection Statement: a plain statement of what your data will be used for. In a recruitment context this is usually as simple as a line confirming your data will be used for recruitment purposes only. If a job ad or an agency's intake form doesn't include anything like this, that's a fair question to raise before you send your CV anywhere.

Your data has to be handled securely, whatever form it's in

The Code of Practice requires that job applicants' personal data be collected, processed, and stored securely, regardless of whether it's electronic, photographic, or paper. This obligation sits with whoever is holding your data at the time: the employer if you applied directly, the agency if you applied through one.

A separate layer applies specifically to licensed agencies. Under the Employment Ordinance, a licensed employment agency in Hong Kong is required to maintain a proper record of the job-seeker information it holds, as part of the same licensing framework that requires it to hold a valid EAA licence in the first place. Working with a licensed agency means your data sits inside a regulated record-keeping obligation on top of the general Ordinance requirements, not instead of them.

You can ask to see what's held on you

You have the right to request access to, and correction of, the personal data an organisation holds about you. Once you make a formal data access request, the organisation is required to respond within 40 days, unless a specific exemption applies. This applies to CVs and application data sitting with a recruitment agency the same way it applies to data sitting with an employer directly.

Your data shouldn't sit there indefinitely

Once a specific recruitment exercise concludes, an unsuccessful applicant's personal data should be erased unless the applicant has separately agreed to it being kept for future opportunities. If you're regularly getting contacted about roles you applied for months or years ago with no memory of agreeing to that, it's a reasonable thing to ask the agency or employer about directly.

• Ask who's collecting your data and whether they're named, not just a box number or generic email
• Check whether you were given a clear statement of what your data will be used for
• Ask what happens to your CV if you're not shortlisted this time
• Confirm the agency you're speaking to holds a current EAA licence if you're unsure: here's how to check

Final thoughts

The Personal Data (Privacy) Ordinance gives job seekers in Hong Kong real, specific rights over their information: identification, purpose disclosure, security, access, and erasure. A licensed recruitment agency isn't a workaround to those protections. Used properly, it's a compliant way to keep a search confidential on the employer's side while still meeting every one of those obligations to you.