After Discharge, When Does the TU Record Clear? Two Clocks, Two Instruments — and the Longer One Is Not in the Bankruptcy Ordinance

Last updated: 4 September 2026

The short version

Discharge and the credit record are two different things running on two different clocks under two different instruments — and the longer clock is not in the Bankruptcy Ordinance at all.

• The Bankruptcy Ordinance (Cap. 6) governs your status. The bankruptcy begins on the day the court makes the order and ends automatically when the relevant period expires: 4 years for a first bankruptcy, 5 for a repeat, and the court may stop the clock running for up to a further 4 or 3 years if a valid objection is upheld.
• How long the record is kept is set somewhere else entirely — in a code of practice approved by the Privacy Commissioner under s.12 of the Personal Data (Privacy) Ordinance (Cap. 486) and notified by notice in the Gazette. Public record data about a bankruptcy — the declaration and the discharge alike — may be kept for up to 8 years, running from the relevant declaration of bankruptcy, not from discharge. ⚠ Eight years is the ceiling the code permits, not a guaranteed deletion date (see section four).
• So in the ordinary case — a first bankruptcy, discharged on time — the public-record entry outlives the discharge by about four years.
• There is a second, five-year clock for account repayment data, and it has two starting points. Code clause 3.4B lets an agency retain the data until the earlier of clause 3.4B.1 — five years from final settlement of the amount written off (or of the amount payable under a scheme of arrangement through the Official Receiver) — or clause 3.4B.2, five years from the discharge as notified by you to the credit reference agency and evidenced — either by a certificate of discharge, which the Court of First Instance issues, or by a written notice in which the Official Receiver states that he does not object to that certificate being issued. The Official Receiver's online application for that letter costs nothing and needs no account — but it covers only bankruptcies in which he is himself the trustee.
• There are two Selected credit reference agencies on the Hong Kong Association of Banks' list, which states its own last-updated date as 14 November 2024. Readers call one of them "TU"; the regime is not one agency.
• The eight years is not in any Ordinance, so changing it needs no legislature. The Commissioner may revise the code, approve someone else's revision of it, or withdraw approval outright — each by a notice in the Gazette. ⚠ Be exact about where the consultation sits: the prior consultation s.12(9) requires is attached to approving a code and to approving a revision; withdrawal of approval under s.12(4) is not in that list, and what s.12(5) requires for a withdrawal is a Gazette notice.
• When to apply is your decision: what follows explains how the clocks run, which document sets them, and who can move them.

"Discharged" and "cleared" are two different things

Bankruptcy is a status created by a court order and ended automatically by the passage of time. A credit record is data held by a private company. Two different Ordinances govern them, and the one that governs the record is not the Bankruptcy Ordinance.

Start with what the Ordinance says about the beginning and the end. Section 30 provides that the bankruptcy of a person against whom a bankruptcy order has been made "commences with the day on which the order is made;" and continues until he is discharged under section 30A or 30B. Read it for what it is: an account of when a status starts and stops. It does not mention any record, anywhere.

Discharge is automatic — but subsection (1) cannot be read alone. Section 30A(1): "Subject to this section and section 30AC, a bankrupt is discharged from bankruptcy by the expiration of the relevant period." That opening qualifier is where subsection (3) and the non-commencement order live. Reading (1) by itself produces a false four-year answer.

And the "or 30B" in that sentence is a second route, not a formality. Section 30B(1) provides that "Notwithstanding that the relevant period has not yet expired", a bankrupt who "has not previously been adjudged bankrupt may, at any time", and one who "has been previously adjudged bankrupt may, not less than 3 years after the date of the bankruptcy order, apply to the court for an order discharging him from bankruptcy." So four years and five years are the periods on the automatic route. They are not a floor beneath which a discharge cannot happen. Section 30B(2) then lists ten situations in which "The court shall not make an order under this section" — among them a previous voluntary arrangement, a failure to disclose a beneficial interest in property or a liability, a failure to co-operate with the trustee, and a relevant period that has not commenced to run under a non-commencement order — and s.30B(3) and (4) require notice to the trustee and to every creditor, with the trustee or a creditor free to object on the s.30A(4) grounds. An early discharge is therefore not there for the asking. But it exists, and s.30 points straight at it.

The periods are in s.30A(2): 4 years for a person who has not previously been adjudged bankrupt, and "where a person has been previously adjudged bankrupt, the period of 5 years, beginning with the commencement of the bankruptcy."

There is a difference between the two authentic texts here. The English attaches "beginning with the commencement of the bankruptcy" only to limb (b). The Chinese attaches 「自破產開始起計的」 to limb (a) and limb (b) separately. Both texts are equally authentic (Cap. 1 s.10B), so the four-year period also runs from the commencement of the bankruptcy — the day the order was made.

Now the other side: who holds the record. There are two Selected credit reference agencies — PingAn OneConnect Credit Reference Services Agency (HK) Limited and TransUnion Credit Information Services Limited — on a list maintained by the Hong Kong Association of Banks, which states its own last-updated date as 14 November 2024. The scheme began service on 26 April 2024 with three, and one of the three exited on 31 July 2024.

Who set the eight years, and why you will never find it in the Bankruptcy Ordinance

Because it is not in any Ordinance. It sits in a code of practice approved under s.12 of the Personal Data (Privacy) Ordinance — and the Commissioner may revise it, approve someone else's revision of it, or withdraw approval, at any time, by a notice in the Gazette, with no legislative step at any point.

The duty is in the privacy statute, not the bankruptcy one. Cap. 486 s.4: "A data user shall not do an act, or engage in a practice, that contravenes a data protection principle unless the act or practice, as the case may be, is required or permitted under this Ordinance." And the principle about how long data may be kept is DPP2(2): "All practicable steps must be taken to ensure that personal data is not kept longer than is necessary for the fulfillment of the purpose (including any directly related purpose) for which the data is or is to be used."

Read it again and notice what is missing: there is no number in it, in either authentic text. It is a purpose-relative standard. It cannot tell a reader a date. The figure has to come from an instrument that turns "necessary for the purpose" into a number — and that is exactly what an approved code under s.12 does.

How the code gets its authority. Section 12(1) lets the Commissioner approve and issue codes of practice; s.12(2) requires that, where he approves one, he "shall, by notice in the Gazette" identify the code and specify the date its approval takes effect. The code in this field sets a retention period of 8 years for public record data about a bankruptcy, running from the relevant declaration of bankruptcy. One clause covers both the declaration and the discharge, and it fixes one period for both, anchored to the declaration — so being discharged does not restart, shorten or stop it.

Changing the figure needs no legislation. Section 12(3) lets the Commissioner "from time to time revise the whole or any part of any code of practice prepared by him under this section;" and approve any revision of a code approved under the section. Section 12(4) goes further: "The Commissioner may at any time withdraw his approval from any code of practice approved under this section." Under s.12(5) the withdrawal is likewise notified in the Gazette. One Gazette notice, no legislation, three possibilities: revise it, replace it, or end it.

That is not the same as a free hand. Section 12(9) requires the Commissioner, before approving a code and before approving a revision of one, to consult such bodies representative of the affected data users, and such other interested persons, as he thinks fit. The extension of that duty from approvals to revisions was moved on the floor of the Legislative Council on 27 July 1995, the Secretary for Home Affairs telling the Council that the amendment carried the same consultation requirement across to revisions of a code made by the Privacy Commissioner.

The code recites that it was first notified in the Gazette in February 1998, took effect on 27 November 1998, and was revised four times — 8 February 2002, 23 May 2003, 1 April 2011, and 28 December 2012 (effective 1 January 2013). It has not been revised since 1 January 2013.

There is a second movable surface inside the same instrument. Clause 3.1.8 permits an agency to collect the further types of personal data set out in Schedule 3, which the Commissioner may amend from time to time — and Schedule 3, in the fourth revision, is a heading with nothing under it. So it is not only the period that can be moved without legislation. The scope of the file is on the same mechanism, and the slot for widening it is already cut.

And a third source of movement, from the Government itself. In a written reply of 24 April 2024 the Secretary for Financial Services and the Treasury recorded that the Privacy Commissioner's Office was comprehensively reviewing the Ordinance and formulating legislative proposals including one that would oblige a data user to set its own written policy on how long it keeps personal data. No timetable was given.

How much force does a code of practice actually have?

An approved code does not have the force of law, but it is not merely voluntary either. Section 13 sets a middle position.

Section 13(1): "A failure on the part of any data user to observe any provision of an approved code of practice shall not of itself render the data user liable to any civil or criminal proceedings". The code's clauses are not offences.

Section 13(2) runs the other way. Where it is proved that at a material time there was a failure to observe a provision the specified body considers relevant to a matter that must be proved, "that matter shall be taken as proved in the absence of evidence that such requirement was in respect of that matter complied with otherwise than by way of observance of that provision." In plain terms: prove the breach of the code, and the burden shifts — the matter is taken as proved unless the data user shows it met the requirement some other way.

Section 13(4) adds something that matters practically: "specified body" includes the Administrative Appeals Board and its chairman, both added by 18 of 2012 s.6. That is why the decided material in this field sits at that tribunal and not in the courts.

The tribunal has supplied the other half. In an appeal numbered in 2014, with written reasons handed down in March 2016 (the credit reference agency concerned was TransUnion; the appeal was dismissed), the Board's position was that a code approved under s.12 is practical guidance that assists proof and is not subsidiary legislation; that exceeding the code's retention period raises a presumption of a breach of DPP2(2); but that nothing in the Ordinance gives any legal effect to COMPLYING with the code, and there is no immunity clause — so the test remains DPP2(2) itself. In short: an agency that stays strictly inside the code is not thereby safe.

So what does a breach lead to? The sequence is: presumption under s.13(2) → the Commissioner may serve an enforcement notice under s.50 → failing to comply with the notice is the offence, and that offence has a section of its own. Section 50A(1) provides that a data user who contravenes an enforcement notice commits an offence and is liable "(a) on a first conviction— (i) to a fine at level 5 and to imprisonment for 2 years; and (ii) if the offence continues after the conviction, to a daily penalty of $1,000; and (b) on a second or subsequent conviction— (i) to a fine at level 6 and to imprisonment for 2 years; and (ii) if the offence continues after the conviction, to a daily penalty of $2,000." Section 50A(2) supplies a defence — it is for the data user charged "to show that the data user exercised all due diligence to comply with the enforcement notice" — and s.50A(3) creates a further offence for a data user who complies and then intentionally repeats the same act or omission. The Government's reply of 9 June 2021 records that a data user who does not meet the requirements of an enforcement notice is referred by the Commissioner to the Police for criminal investigation and prosecution.

Fines are stated as levels, and the amounts attached to the levels can be moved. The amount for each level is in Schedule 8 to the Criminal Procedure Ordinance (Cap. 221), and s.113B(3) of that Ordinance provides: "The Chief Executive in Council may by regulation amend the amounts set out in Schedule 8 to reflect his opinion of the effect of inflation on the value of the amounts set out in the Schedule since the date when the Schedule came into operation or since the date that the amounts in the Schedule were last amended." Not a resolution, and not a free hand: a regulation made by the Chief Executive in Council, and only to track inflation.

Two clocks: one runs by itself, the other has two starting points and you control one of them

The eight-year public-record clock runs whatever you do. Of the five-year clock's two starting points, the one you control is notification. ⚠ Three things to add. Clause 3.6 says an agency may thereafter retain the data for the listed periods — a ceiling, not an instruction to hold it for the whole eight years — and Cap. 486 s.26 and DPP2(2) continue to apply underneath. The five-year clock also runs from final settlement under clause 3.4B.1, whichever comes first. And clause 3.7 cuts the other way: where the s.62 statistics-and-research exemption applies to consumer credit data held by the agency — the code's own example is data used to develop a consumer credit scoring model intended to be of general application — the data may continue to be retained for as long as that exemption applies, notwithstanding any provision of the code to the contrary. The footnotes to clauses 3.2, 3.3, 3.4A, 3.4B and 3.6 are each expressly subject to clause 3.7. That does not mean an identified bankruptcy may sit in a lender-facing credit report for ever — see the next paragraph on clause 3.8 — but it does mean the eight years cannot be written as an unconditional, exceptionless deletion date.

There is a further distinction, which is not in that table and which is what most readers are actually asking about: what an agency holds in its database and what a lender sees in a credit report are two different things. The two clocks above govern retention (clauses 3.3 to 3.7). What may be disclosed is governed separately, by clause 3.8. For account data the ordinary rule in clause 3.8.2.2A is that a credit report must not contain account repayment data created more than 2 years before the account termination date, in the case of a terminated account, or more than 2 years before the date the report is provided, in the case of an account that is not terminated. There is a proviso, and bankruptcy readers land inside it: where there has been a material default, or a write-off due to a bankruptcy order made against the individual, within the 5 years before the report is provided, the report may in addition contain the default data and/or the outstanding balance at the time of that write-off. So: data may be held for a permitted purpose without every historical field appearing in every lender-facing report — and data retained under the clause 3.7 exemption for model development is not the same thing as an identified bankruptcy being shown to a lender.

Why does one run by itself and the other not? It follows from the code's own structure.

Public record data is data the agency takes from the official record, so it has a source independent of you and its clock can run unconditionally. Account repayment data is different. Nothing carries the fact of your discharge to the agency by itself: the credit provider is not told, and the court notifies nobody of its own motion.

One thing has to be said here that the usual account of this leaves out: Hong Kong's own bankruptcy legislation does contain a discharge-side publication route. Rule 92(2) of the Bankruptcy Rules (Cap. 6A) provides that "The discharged bankrupt may require the trustee to give notice of the discharge by the specified means", and r.92(3) that any such requirement "shall be addressed to the trustee in writing and the trustee shall notify him forthwith as to the costs of the advertisement and is under no obligation to advertise until that sum has been paid." So the way out is not unprovided for. It has to be asked for by the discharged bankrupt and paid for by him, and what it produces is an advertisement — not a notice addressed to a credit reference agency. So on the discharge side the code hangs its starting point on the one event that reliably reaches the agency — you, walking in with the certificate.

⚠ One sentence here is easy to get wrong, so it is stated precisely. Clause 1.29 is a definition of termination of the account: an amount written off in full or in part is not treated as repayment, so a written-off account is not thereby a terminated one. It does not say, and does not have the effect of saying, that the written-off amount can never afterwards be settled. The code says the opposite nearby: setting the same pair of starting points for material-default data, clause 3.3 applies them irrespective of any write-off by the credit provider, in full or in part, at any time after the default occurred. So the accurate statement is this: final settlement remains a live starting point after a write-off, the period ends at the earlier of the two (clause 3.4B), and where there has been no final settlement notification is simply the one of the two you control.

The code names two documents as evidence:

• a certificate of discharge from the Court of First Instance; or
• a written notice in which the Official Receiver states that he does not object to that certificate being issued to you. The code names no court in the second limb.

And the first of those documents is not the code's creation. It is made by rule 92(1) of the Bankruptcy Rules (Cap. 6A): "Where it appears to the court that a bankrupt is discharged, whether by expiration of time or otherwise, the court shall, on his application, issue to him a certificate of his discharge, and the date from which it is effective." Read the words "on his application": the court does not issue it of its own motion. You have to ask for it.

What to do, and what happens when a step fails:

• Get the document. The Official Receiver's Office runs an online application for that letter. It costs nothing and needs no registered account — its own page describes logging in to the Office's public portal with your bankruptcy case name and case year plus your personal particulars, and being sent a one-time password by SMS or email.
• But that service has a limit. The Office states that the service covers only bankruptcies where the trustee is the Official Receiver himself, and that in any other case the approach must be made to whoever the trustee is, directly. But that branch is not a dead end: the code names two documents as evidence (below), and the first of them — a certificate of discharge from the Court of First Instance — is created by Cap. 6A r.92(1) and does not depend on who your trustee is; the court must issue it "on his application". So a reader whose trustee is a private practitioner is on the first document's route, not the second's. The Judiciary issues a bilingual guidance note on applying for a certificate of discharge, together with the affidavit form the note refers to. This site's summary:

1. Get the no-objection letter. The discharged bankrupt goes to the Official Receiver's Office, or to the trustee's own office where the trustee is someone else, and obtains a letter of no objection. 2. Get the affidavit form and swear it. The form of affidavit is available from the Resource Centre for Unrepresented Litigants at the High Court; it is sworn before a Commissioner for Oaths at the High Court Building (Room LG159, LG1). 3. Exhibit the papers. The no-objection letter and the applicant's Hong Kong identity card are exhibited to the affidavit. 4. File it. The affidavit is filed at the High Court Registry counters as an ex parte application, and the note states that the court makes no charge for the application. 5. Language. The certificate issues in Chinese; an applicant who wants an English certificate files an affidavit in English. 6. Collect it. Collection is from the Masters Clerks Office (Room LG115, LG1) after three weeks, during office hours, in person or by someone authorised in writing (the letter of authorisation stating that person's name and identity card number), quoting the court case number; and the applicant is contacted by telephone, where one is given, if the application needs further rectification. A lost certificate is not replaced.

The affidavit form itself is the Judiciary's form under rule 92 of the Bankruptcy Rules (the form states that it was revised in May 2018). Its paragraph 1 is pre-printed for a deponent for whom more than four years have passed since the bankruptcy order — the first-bankruptcy, four-year automatic route set out above; its paragraph 3 is pre-printed as the Official Receiver / my trustee, with the inapplicable one to be deleted, and the letter exhibited; and paragraph 4 is the copy identity card.

⚠️ Two boundaries: First, the no-charge statement is about the court. Whether a trustee in private practice charges for producing a no-objection letter is not addressed by the note. Second, the three weeks is the Judiciary's collection interval, not a pledge for a case that needs further work — the note's own step 7 contemplates an application needing rectification.

• Lodge it with the agencies — each of them. The code, in its 2013 edition, is singular throughout: the agency the individual notifies is written as one agency. But the HKMA's Supervisory Policy Manual module IC-6 §6.3 now writes the duty in the plural — account repayment data retained by the agencies until five years from the discharge as notified to them — and the module's own title changed from the singular to the plural between V.6 and V.7. HKAB's consumer FAQ says a consumer is entitled to a free report from each Selected agency in any 12-month period, counted separately for each of them, and should ask the individual agencies about application procedures. The second Selected agency says the same of itself, in Chinese, in its own FAQ: hand us the discharge order, or we do not know the bankruptcy has ended. In practice the obligation runs to each agency separately.

⚠ But the Code of Practice for the Multiple Credit Reference Agencies Model, V.4 of 15 May 2025, adds a layer. Clause 3.5(1) of that code lets a data subject ask a Selected CRA directly to correct an error or omission in the consumer credit data of his that the agency holds or controls. And clause 3.5(4) addresses this exact situation: where a clause 3.5(1) request relates to the update of bankruptcy status after discharge of bankruptcy, or to any other public record data, the Selected CRA must comply with it in accordance with the CCD Code — and if it corrects the record in its possession or control, it must notify the relevant Subscribed Members and the requestor under clause 3.5(2)(a)(ii) to (iv) and inform the other Selected CRAs of that correction.

The clause says the correcting agency must inform the other Selected CRAs. It does not say the other agency must then amend its own record without a separate request, and it does not say you can stop there. One filing does not necessarily correct both. The safe two-step is: ask a Selected agency for the update, then obtain your free report from each agency separately and check whether both have been updated — and file directly with the other one if it has not.

• And if you file nothing? The five-year clock does not start from the notification point (clause 3.4B.2), though clause 3.4B.1's final-settlement point is unaffected; and the eight-year clock runs anyway.

The UK Information Commissioner's Office tells a discharged UK bankrupt that they must tell each of their own lenders, one by one, because nobody will do it for them. The same two-layer asymmetry, with only the addressee different — the agency here, the lenders there. You do have to act — but Hong Kong is not alone in requiring it.

Where to take it, and how to reach them. The contact details for both Selected agencies are published on the Hong Kong Association of Banks' Selected CRA list (<https://www.hkab.org.hk/en/industry-infra/selected-cra>; the page states its own last-updated date as 14 November 2024):

- PingAn OneConnect Credit Reference Services Agency (HK) Limited — <https://www.paoccra.com.hk/> · cra_contact@paoc.com.hk · (852) 2271 6268 · Room 1603/04, 16/F, Landmark NEO, 123 Hoi Bun Road, Kwun Tong, Hong Kong - TransUnion Credit Information Services Limited — <https://www.transunion.hk> · hkcontact@transunion.com · (852) 2577 1816 - The Privacy Commissioner for Personal Data — complaints: <https://www.pcpd.org.hk/english/complaints/policy/complaint_policy.html>; section 66 legal assistance: <https://www.pcpd.org.hk/english/complaints/legal_assistance/assistance.html> - The Judiciary — guidance notes and affidavit form for a certificate of discharge: <https://www.judiciary.hk/doc/en/court_services_facilities/hc/guidance_notes_for_application.pdf>

The arithmetic: who waits longest? (The answer is the opposite of what you would guess)

The reader who cooperated and was discharged on time carries the public record for four years after discharge. The reader who was objected to and suspended to the statutory maximum carries it for none.

The inputs, stated as inputs. The bankruptcy commences on the day the order is made (s.30). The relevant period is 4 or 5 years from the commencement of the bankruptcy (s.30A(2), settled by the Chinese text). Where a valid objection is upheld the court may order that the relevant period cease to run for a further period not exceeding 4 years for a first bankruptcy or 3 for a repeat (s.30A(3)). The arithmetic: 4 + 4 = 8 and 5 + 3 = 8 — both routes cap at eight years from the order. Section 30B lets a bankrupt apply for a discharge before the relevant period has expired, which is why the top row of the table can be discharged earlier than year 4. And the code sets eight years from the relevant declaration of bankruptcy.

Cooperation buys a shorter bankruptcy and a longer overhang.

Every "year 8" in that table is the outer limit the code permits, not a date on which deletion is guaranteed. Clause 3.6 says the agency may retain; Cap. 486 s.26 and DPP2(2) require erasure once the data is no longer required; and clause 3.7 makes its own exception for data covered by the s.62 exemption. So the table answers "no later than", not "gone by".

Two limits:

One: the code's trigger word is not the Ordinance's. Cap. 6 speaks of the order, and of a person adjudged or adjudicated bankrupt. The code speaks of the relevant declaration of bankruptcy. On the ordinary facts the two dates are the same day — but the code does not define its term. So the code's own words should not be read as automatically meaning the order date.

Two: the non-commencement row is a live mechanism, and it can leave the end date indeterminate. Section 30AB(5): "This section only applies to a bankrupt against whom a bankruptcy order is made on or after 1 November 2016." That fixes the temporal scope: every bankruptcy order since that date is capable of falling within the mechanism. A non-commencement order must specify that the relevant period is treated as not commencing to run on the date of the bankruptcy order and specify terms to be complied with before it does — and neither s.30AB nor s.30AC contains a long-stop. ⚠ Scope is not frequency. Such an order still requires the specified failure, an application by the trustee and an order of the court.

Which is why the Official Receiver's total of eight years is the ceiling of the objection route only.

What does the law give you against an accurate entry? Updating the discharge status is one route; deletion is another

Four things get talked about as one, and they have to be separated first: (a) updating your bankruptcy status after discharge; (b) correcting public-record data that is inaccurate; (c) deletion once the permitted retention period or the purpose has come to an end; and (d) deletion of a historically accurate record before that point.

(a) is not a denial that the bankruptcy happened — it is a request to add or update the discharge, and MCRA Model code clauses 3.5(1) and 3.5(4) cover that request expressly (section four above). (b) has machinery of its own in the CCD Code: clause 3.20 requires an agency receiving a correction request about public record data to verify the accuracy of that data against the relevant public records wherever practicable, and if no such verification is obtained within 40 days of the request, the public record data must on expiry of the 40 days be deleted or otherwise amended as requested — except where the individual alleges an inaccuracy that is not apparent on the face of the public records, in which case it is for the individual to prove it. (Clause 3.19 sets the same 40-day mechanism for data supplied by a credit provider.)

As for (d) — asking for an accurate historical bankruptcy to be deleted — the s.22 gate is that the data is inaccurate, and a bankruptcy that genuinely happened is, on the face of the public record, accurate; so that route ordinarily ends in a written, reasoned refusal, with s.25(2) capable of requiring an annotation to travel with it. That is not a guarantee, because (a), (b) and (c) end elsewhere — and (c), s.26, is a free-standing duty, dealt with below.

The first gate is really two, and both are inside the same subsection. Section 22(1)(a) requires that a copy of the data has already been supplied in compliance with a data access request — the two steps are sequenced by the statute — and s.22(1)(b) requires that "the individual, or a relevant person on behalf of the individual, who is the data subject considers that the data is inaccurate". An accurate bankruptcy does not get through (b).

There is a third and prior gate, and no tribunal added it. It is in the statute, and s.22(1) flags it in its own opening words — "Subject to subsections (1A) and (2), where—". Section 22(1A), added by 18 of 2012 s. 15, provides: "If a person is a relevant person in relation to an individual only because the person has been authorized in writing by the individual to make a data access request on behalf of the individual, the person is not entitled to make a data correction request." In plain terms: a written authority to ask for somebody else's data does not carry with it an authority to ask for it to be corrected. The Administrative Appeals Board reached the same result on s.22 in an appeal numbered in 2017 and decided on 28 April 2020, in which the appeal was dismissed. For someone correcting their own record that gate is satisfied — but it is also why an access authority alone does not let anyone have a third party's entry corrected.

What the route does guarantee is a document, on a deadline. Section 25(1) requires a data user who refuses to comply with a data correction request to inform the requestor, "not later than 40 days after receiving the request, by notice in writing inform the requestor— (a) of the refusal and the reasons for the refusal;".

And the refusal is not necessarily the whole of what s.25 produces, because the next subsection adds something. Where the personal data a correction request relates to "is an expression of opinion" and the data user "is not satisfied that the opinion is inaccurate", s.25(2) requires that data user to "make a note, whether annexed to that data or elsewhere— (A) of the matters in respect of which the opinion is considered by the requestor to be inaccurate; and (B) in such a way that that data cannot be used by a person (including the data user and a third party) without the note being drawn to the attention of, and being available for inspection by, that person", and to "attach a copy of the note to the notice referred to in subsection (1) which relates to that request." Section 25(3) defines "expression of opinion" to include "an assertion of fact which— (a) is unverifiable; or (b) in all the circumstances of the case, is not practicable to verify." On a credit file, a note that travels with the data and has to be put in front of anyone who uses it is a materially different remedy from a bare refusal — so a refusal is not necessarily the only outcome available. Whether a particular public-record entry is an expression of opinion turns on the case.

And erasure? The Ordinance has erasure — but as a duty on the data user, not a right you exercise. Section 26(1): "A data user must take all practicable steps to erase personal data held by the data user where the data is no longer required for the purpose (including any directly related purpose) for which the data was used", subject to two exceptions. The Ordinance gives a data access request and a data correction request. It gives no "erasure request" to match them.

But "no erasure request" does not mean s.26 is toothless. Section 26 is a requirement under the Ordinance. Section 64A(1): "A data user who, without reasonable excuse, contravenes any requirement under this Ordinance commits an offence and is liable on conviction to a fine at level 3." Section 64A(2) disapplies that for (a) a contravention of a data protection principle, (b) a contravention that already constitutes an offence under the sections it lists, and (c) a contravention of a requirement under Part 6A or 9A — and s.26 is none of the three. So contravening s.26 is itself an offence, with no enforcement notice needed first; whereas a contravention of DPP2(2) has to go the enforcement-notice route under s.50, precisely because s.64A(2)(a) carves the data protection principles out. Those are two routes, not one. (The amount of a level 3 fine is set in Schedule 8 to the Criminal Procedure Ordinance (Cap. 221).)

The Commissioner's own current published position is consistent with that structure. In a case note uploaded in February 2026:

The code does contain a deletion mechanism. In a written reply of 11 June 2014 the Secretary for Financial Services and the Treasury told the Legislative Council that where fraudulent use of the data is confirmed, the credit provider must, under the code, instruct the agency to remove that loan record from its database as quickly as is reasonably practicable, and to leave no trace of its history there.

Read what that is and is not. It is a real deletion route, and it leaves no history. It is exercised by the credit provider, not by you; it is keyed on confirmed fraudulent use of the data by a third party; and an accurate record of your own bankruptcy is outside it.

And the Ordinance gives one more thing, which is not a request at all. It is a claim. Section 66(1) entitles an individual who suffers damage by reason of a contravention "(a) of a requirement under this Ordinance; (b) by a data user; and (c) which relates, whether in whole or in part, to personal data of which that individual is the data subject" to "compensation from that data user for that damage". And s.2(4) provides that a reference to a data user having "contravened a requirement under this Ordinance" includes "any case where the data user has done an act, or engaged in a practice, in contravention of a data protection principle" — and DPP2(2), the retention principle, is a data protection principle. Section 66(2) declares that the damage "may be or include injury to feelings"; s.66(3) gives the data user a defence of reasonable care; and s.66(5) provides that proceedings "are to be brought in the District Court but all such remedies are obtainable in those proceedings as would be obtainable in the Court of First Instance." So the full answer is three things: a written, reasoned refusal within 40 days; an annotation where the entry is an expression of opinion; and — where data is kept longer than DPP2(2) permits and that causes damage — a claim for compensation in the District Court.

The Ordinance also provides assistance on that route. Section 66B(1) lets a person who may bring s.66 proceedings apply to the Commissioner for assistance in respect of them; s.66B(2) lets the Commissioner grant the application if he thinks fit, in particular where the case raises a question of principle, or where it is unreasonable — having regard to the complexity of the case, or the applicant's position in relation to the respondent or another person involved, or any other matter — to expect the applicant to deal with it unaided; and s.66B(3) provides that the assistance may include giving advice, arranging for advice or assistance by a solicitor or counsel, arranging representation, and any other form of assistance the Commissioner considers appropriate. (Section 66B(5) also gives the Commissioner a first charge for the expenses of any assistance provided.) The PCPD's published time limits (this site's summary):

- The complaint period is two years, and it does not run from the act. The PCPD states that the time limit for lodging a complaint is two years from the date of the complainant's actual knowledge of the privacy-intrusive act or practice, and recommends lodging as soon as possible. - A refusal to investigate is notified within 45 days. Where the Commissioner refuses to carry out, or decides to terminate, an investigation under s.39(2), the complainant is notified in writing of the refusal and its reasons within 45 days of receiving the complaint — and the PCPD fixes the start of that period itself: it runs from the date the PCPD received enough information to satisfy the s.37 criteria for a complaint, being the date named in its letter accepting the complaint. - An appeal is 28 days on your side, 14 on the data user's. A complainant may appeal to the Administrative Appeals Board against a refusal to investigate or a termination (s.39(4)), or against a decision not to serve an enforcement notice after an investigation (s.47(4)); under s.9 of the Administrative Appeals Board Ordinance the notice of appeal must reach the Board's Secretary within 28 days of receiving notice of the Commissioner's decision. A data user appealing against service of an enforcement notice has 14 days from service, under s.50(7). - The costs risk is real. Under ss.21(1)(k) and 22 of the Administrative Appeals Board Ordinance the Board may award costs against an appellant it is satisfied has conducted the case in a frivolous or vexatious manner, and against another party where in all the circumstances it would be unjust and inequitable not to. - The limitation period for a s.66 claim is six years, running from the wrongful act. The PCPD's legal-assistance page states that because the Ordinance does not specify a time limit for proceedings under s.66, the Limitation Ordinance (Cap. 347) applies: in general the right to sue the data user is lost once six years have run from the accrual of the cause of action, which the PCPD puts as six years from when the wrongful act was committed.

⚠️ The two periods are different things and neither substitutes for the other: two years is the period for complaining to the Commissioner; six years is the limitation period for going to court.

⚠️ Complaining first is a general condition of applying to the Commissioner for legal assistance — the PCPD states that an aggrieved individual must in general lodge a s.37 complaint and obtain a decision on it from the Commissioner or her delegates before applying for assistance, and may apply once the Commissioner has concluded the complaint. It is not a precondition of a s.66 claim itself.

And the complaint route has its own section numbers. A complaint is made under s.37; s.38 obliges the Commissioner, on receiving one, to carry out an investigation of the data user (subject to s.39, which sets out when he may refuse to carry out or terminate an investigation begun by a complaint); and s.50 is the enforcement notice.

The accuracy gate does work — there is a documented case running the other way. A 2018 case note records that a lawyer appointed as trustee of a bankruptcy was recorded by the agency as the defendant in the civil lawsuit; the Commissioner found that the agency had not taken reasonably practicable steps to keep the complainant's credit report accurate, in breach of Data Protection Principle 2(1); the entry was removed after the Office's intervention, the agency revised its measures, and a warning letter was served. Two things are true at once: bankruptcy court cases are written into credit reports as public-record data — here so bluntly that the trustee was recorded — and the entry came off because it was WRONG, not because anybody wanted it gone.

Before you start: in a 2015 appeal the appellant asked to be heard in private precisely because he did not want people reading the decision to learn about his credit history; the Board recorded that such an application would have been refused, and allowed him a pseudonym only. Appealing about your credit record is itself a public act.

What else follows you after discharge — and the longest-running one is not in Hong Kong law at all

Hong Kong law does contain a post-discharge waiting period: five years, in eight named Ordinances, and every one of them is switched off if the creditors were paid in full. The credit record's eight years is longer, starts earlier, has no such exception — and is in no Ordinance.

The eight chapters, named: Cap. 542 (Legislative Council) · Cap. 547 (District Councils) · Cap. 576 (Rural Representative Election) · Cap. 344 (Building Management) · Cap. 304 (Hong Kong Arts Centre) · Cap. 472 (Hong Kong Arts Development Council) · Cap. 161B and Cap. 161F (Medical Council elections). Three shared properties: five years, running from discharge, and disapplied where the creditors were paid in full.

One of the eight is the one an ordinary flat owner is most likely to meet. Building Management Ordinance (Cap. 344), Schedule 2 paragraph 4(1)(a): a person is not eligible to be appointed to a management committee if he "is an undischarged bankrupt at the time of the appointment or has, within the previous 5 years, either obtained a discharge in bankruptcy or entered into a voluntary arrangement within the meaning of the Bankruptcy Ordinance (Cap. 6) with his creditors, in either case without paying the creditors in full;". And paragraph 4(3) adds a self-declaration duty — every appointed member must, "within 21 days after the appointment, lodge with the secretary of the management committee a statement, in such form as the Land Registrar may specify, stating that he does not fall within the description of subparagraph (1)(a) or (b)." — with paragraph 4(4) supplying the consequence: "A member of the management committee who fails to comply with subparagraph (3) shall cease to be such member." No notice, no hearing, no discretion.

Three columns, and the comparison writes itself:

Every one of the eight named post-discharge disqualifications runs for five years, and every one is shorter than the credit record's eight-year ceiling; and the longest-running of them is the one written in no Ordinance at all.

But do not leave over-warned — a whole category really does end at discharge. The bars keyed on the words "undischarged bankrupt" — company director, trustee in bankruptcy, liquidator, MPF trustee among them — switch off; and several provisions readers hear about are not bars at all, but factors a regulator must have regard to. On employment: Cap. 159 s.53 bars a solicitor EMPLOYER, not the bankrupt. For the bankruptcy framework itself, see this site's bankruptcy guide.

And several things survive discharge entirely. They are a set, not a single duty.

• Section 30A(8) requires a discharged bankrupt to continue to give information about his affairs and to attend on the trustee for the purpose of completing the administration of the estate, "and if a discharged bankrupt does not comply with the requirements of this subsection, he shall be guilty of a contempt of court and may be punished accordingly on the application of the trustee."
• Section 30A(9) lets the court, "as a condition of granting the discharge, order the bankrupt to continue to make contributions to his estate in such amount and for such period as it considers appropriate but not exceeding a period of 8 years from the date the bankruptcy order was made" — and s.30B(5) applies s.30A(8) and (9) to an early discharge as well. Note that this is a second eight years running from the date of the bankruptcy order. On the ordinary facts it is ordinarily expected to begin on the same date as the code's eight years, but it is not "the same anchor": the code's term is the relevant declaration of bankruptcy. Either way the two are unconnected.
• Section 139 ("Criminal liability after discharge or composition"): "Where a bankrupt has been guilty of any criminal offence he shall not be exempt from being proceeded against therefor by reason that he has obtained his discharge or that a voluntary arrangement has been approved."
• Rule 92(5) of the Bankruptcy Rules (Cap. 6A): "A discharge under section 30A, 30B or 30C of the Ordinance does not release the bankrupt from any obligation arising under a confiscation order made under section 3 of the Drug Trafficking (Recovery of Proceeds) Ordinance (Cap. 405)."

Why a code and not a statute? The history runs the opposite way to what you would assume

The Legislative Council did not set a period and hand it to the regulator to administer. It built a power to issue codes, and four years later the regulator used it — and the one law-reform recommendation ever carried out on this subject was to WIDEN the file, not to protect the consumer.

1994. The Law Reform Commission report that produced Cap. 486 recorded that in the UK Registrar's 1991-92 complaint figures consumer credit data was the largest single category, at 32%, and named the gap in Hong Kong in terms: "Hong Kong presently has no legislation providing protection against defective credit records nor in any other sphere of private sector activity, exacerbating the lack of more general data protection legislation." It then recommended a general framework plus a sectoral code on one subject only — and that subject was identity-card numbers and other personal identifiers. The report made no recommendation about consumer credit data.

1995. The Council enacted the code-making power without a word about the sector that would become its principal use. The Hansard of the sitting of 27 July 1995 does not mention credit reference agencies or consumer credit data.

1998. The Commissioner issues the code. Four years after the power, from the regulator, into the gap the report had named and not filled.

2002 — and this is the step that inverts the expected story. The Government's own register of the implementation of Law Reform Commission recommendations, item 41:

Implemented without legislation, in the Government's own record. And what was the recommendation? From the same July 2002 report, Recommendation 11:

Read the direction. That was a report about debt collection practices, and its only recommendation on consumer credit data was to keep EXPANDING the sharing of it, on an argument about bad debts. That step was not a consumer-protection measure.

A second thread runs through the same history: the code's evidential force drifted at every step. The Commission's 1994 Recommendation 9.4 was that sectoral codes "should not be given legal force, nor the power to qualify the provisions of the data protection law, but compliance with a sectoral code approved by the Privacy Commissioner should be taken into account in determining whether there has been a breach of the principles", adopting the UK Registrar's formula that breach of a code would not of itself amount to a breach of a principle. Section 13 as enacted keeps the second half and replaces the first with its opposite: proved breach raises a rebuttable presumption against the data user, and nothing gives compliance any effect at all. And the level was set deliberately, on the floor: on 27 July 1995 the Secretary for Home Affairs told the Council that the amendment to clause 13(2) "reduces the evidential presumption that a breach of a code of practice is a breach of a requirement of the Bill", for consistency with the Bill of Rights Ordinance. Chosen twice, in opposite directions, and the second choice is the one in force.

Why has nobody legislated? Three independent answers, each named and dated:

• A written reply of 2 December 2020, from the Secretary for Financial Services and the Treasury, stating that the Administration has no plan to establish a legal framework specific to consumer credit reference agencies, and that the HKMA and the industry associations would instead further enhance the security of personal credit data and the protection of consumer interests through the Code of Practice and the Industry Code.
• The implementation register, item 41, quoted above — "without legislation".
• Bills. No bill has been titled on credit reference agencies, and the parent Ordinance has been amended exactly twice since the code was first issued in February 1998.

How do other places do it? Hong Kong's code is more formal than the UK's arrangement, not less

On credit-reference-file retention, Hong Kong's period is the longest of the three jurisdictions below. On the form of the instrument, Hong Kong's gazetted code outranks what the UK has — because the UK's six years is not in any enactment at all.

The credit reference agency's file and the public insolvency register are different records.

(1) Credit-reference-file retention

Of those three — Hong Kong 8, the UK 6, Australia 5 — Hong Kong's is the longest.

No UK enactment or statutory instrument fixes a period for which a credit reference agency may hold, or must delete, credit information about an individual. That is not the same as saying the UK has no rule at all.

(2) The public insolvency register — a different record

The England and Wales rule, in its own words:

against Insolvency Act 1986 s.279(1): "A bankrupt is discharged from bankruptcy at the end of the period of one year beginning with the date on which the bankruptcy commences."

Set that beside Cap. 6 s.16: "Notice of every bankruptcy order, stating the name, address and description of the debtor, the date of the order, and the date of the petition, must be published by the specified means by the Official Receiver." and beside Cap. 6A r.92(2): "The discharged bankrupt may require the trustee to give notice of the discharge by the specified means." Three verbs, and the difference is then plain. England deletes: the rule says "must delete". Hong Kong on the way in publishes, and s.16 makes it mandatory. Hong Kong on the way out publishes too, but r.92(2) puts it in the discharged bankrupt's hands — he may require it, and under r.92(3) he pays for it. Hong Kong legislates on both sides. What it does not do on the way out is require anything to be deleted, or make anything happen by itself.

And what is structurally unusual is not the number. Australia's provision expressly takes whichever ends later of a period running from becoming bankrupt and a period running from the bankruptcy ending; Singapore's and England's run from discharge. Hong Kong's clause — the code's eight years for public record data — has no discharge limb at all.

Hong Kong law is perfectly capable of anchoring a period to discharge: the eight disqualification Ordinances in the section above all run from discharge, the code's own five-year account-data period runs from the discharge as notified, and Cap. 6A r.92(2) hangs its publication route on the discharge as well. The one period that ignores discharge is the longest one.