A Hong Kong Tenant Screening Checklist: What Landlords Can and Can't Lawfully Check

After years around the letting business, I keep seeing two extremes. One landlord checks nothing, signs the lease, and only then discovers the tenant could never afford the rent. The other interrogates an applicant down to their family tree — asking for last year's payslips, a marriage certificate, the lot. Neither is healthy.

The question was never "to screen or not to screen." It's about checking the right things, in the right way, and using what you find appropriately afterwards. This article calmly unpacks three things: what a landlord may reasonably collect and verify, what counts as over-collection that breaches the Personal Data (Privacy) Ordinance, and how to weigh a risk signal in its proper place rather than letting one record decide everything. The point isn't to teach you to dig up dirt on people — it's to help you make a steadier tenancy decision while staying inside the law.

1. What a Landlord May Reasonably Collect and Verify

Basic screening before letting is reasonable commercial practice. The operative word is reasonable — what you collect should bear directly on this particular tenancy decision. The common, defensible scope broadly looks like this:

• Identity check — verify the applicant's identity document, confirm the person signing is actually the person you have in mind, and avoid a name-collision mix-up.
• Income / employment proof — assess whether the party can pay rent on time over the term; this is the information most directly tied to the rent.
• Prior-tenancy reference — with the party's consent, ask a previous landlord about past rent payment and how the tenancy ended.
• Guarantor where appropriate — where a tenant's profile is thin (new to a job, a student, newly arrived), considering a guarantor is a common and reasonable approach.
• Company search for corporate tenants — if you're letting to a company, checking company registry data (directors, shareholders, registration status) is reasonable commercial due diligence.

Key point: every item you collect should answer one question — "how does this help me decide whether to let?" If it can't, it's very likely over-collection.

For an end-to-end view of handling problem tenants lawfully, from prevention to recovery, see Preventing Problem Tenants and Lawfully Recovering Rent & Repossessing: A Hong Kong Landlord's Guide.

2. Lawful to Check vs. What You Shouldn't

"Publicly searchable" doesn't mean "you should collect it," and "they're willing to hand it over" doesn't mean "you may take all of it." Here's a simple side-by-side to help you draw the line:

⚠️ A useful self-check: if the tenant asked you "why do you need this to decide whether to let?" and you couldn't give a reasonable answer, don't collect it. Collecting more ≠ screening better — it only adds to your responsibility for safeguarding and not leaking personal data.

Public records (such as bankruptcy) can serve as one risk angle, but the same limits apply — for how to use them lawfully, see Bankruptcy and Public Record Searches in Hong Kong: Lawful Uses and the Masking Principle.

3. Consent and Purpose Limitation: What the PDPO Says

Hong Kong is governed by the Personal Data (Privacy) Ordinance (PDPO, Cap. 486), and one of its core principles is purpose limitation: collecting personal data must serve a clear, reasonable purpose, and use cannot exceed that purpose. Applied to tenant screening, a few principles are worth keeping in mind:

1. State the purpose — tell the party what the data is for (assessing the tenancy) before you collect, rather than vaguely scooping up a pile of it.
2. Obtain consent — checks with third parties (a previous landlord, a company) should proceed on the basis of the party's informed consent.
3. Minimal and sufficient — collect only what you reasonably need; enough to assess is enough, and don't grab unnecessary extras "while you're at it."
4. Lock the purpose — data collected "for the tenancy" is used only for this tenancy, not repurposed to "warn other landlords" or circulated publicly (see Section 5).

Key point: the actual search fees, application methods and scope are adjusted from time to time, and are per the latest official registry publication; for judgements involving legal consequences, consult a lawyer or relevant professional. This article covers principles only and does not provide step-by-step instructions.

4. How to Weigh a Risk Signal (Don't Let One Record Be the Verdict)

The easiest place screening goes wrong isn't failing to obtain data — it's misreading a signal. A healthy mindset is this: any single record is "one piece of the puzzle," not a final verdict.

• A single record isn't conclusive — a risk alert prompts you to "ask more and look closer," not to deliver a closing statement.
• Be careful with name collisions — name collisions are extremely common in Hong Kong, and a record isn't necessarily the person in front of you. Verify identity first to avoid misattributing it and harming an innocent party.
• No record ≠ zero risk — finding nothing only means the platform currently has no relevant reviewed record, not that the party is definitely problem-free.
• Form an overall judgement — weigh the risk alert together with the income references the party volunteers, the guarantee arrangement and the lease terms before deciding.

WeCredit offers tenancy record lookup, masked risk alerts and a bankruptcy record lookup, precisely to consolidate these scattered risk angles into one compliant, easy-to-use reference — for how to read a "risk alert" correctly, see How to Check Tenancy Records in Hong Kong: Risk Alerts and How to Use Them Properly.

Tip: with a corporate tenant, verify the company's own background; with someone claiming to be the landlord, confirm they actually own the unit. For that side of due diligence, see Company Registry Search: Verifying a Corporate Tenant's Background and Land Registry Search: Verifying the Other Party Really Owns the Unit.

5. ⚠️ After Screening: Storage, Use and Destruction

Collecting personal data is a responsibility, not a one-and-done. The final — and most overlooked — step in tenant screening is handling the data in your hands responsibly.

• Store it securely — payslips, ID copies, references and other sensitive data should be kept safely, with access restricted, and never casually dropped into a group chat or a public cloud folder.
• Use it then stop — data collected "for the tenancy" is used only for this decision; it can't be repurposed to "warn other landlords" or circulated publicly with names attached.
• Destroy after the tenancy — once the data no longer has a reasonable reason to be kept, it should be destroyed in good time under the purpose-limitation principle, rather than hoarded indefinitely.

There's a crucial line here: "lawful to view" does not mean "lawful to republish." Even where a record is public, re-posting it in full with the name attached is a different matter from lawfully inspecting it — the former carries PDPO and even defamation risk, and the Privacy Commissioner can step in. WeCredit masks names, addresses and submitter details on public records by default, showing only vetted risk alerts, which is exactly this masking principle in practice.

⚠️ Being right does not make you immune. A tenant likewise has the right to access, correct and request the deletion of their own personal data, with the relevant arrangements set out in our Privacy Policy. Keep what you find for your own decision-making, and don't re-circulate it.

FAQ

Q1: Is checking a tenant's background before letting lawful?

Collecting and verifying within a reasonable scope, for a clear purpose (assessing the tenancy), is reasonable commercial practice. The key is that what you collect bears directly on the tenancy decision, and that you observe the PDPO's purpose-limitation and minimal-and-sufficient principles rather than over-collecting.

Q2: Can I ask a tenant for payslips and bank statements?

Income or employment proof is directly tied to the ability to pay and is reasonable to collect; full line-by-line bank transactions, however, likely go beyond what's needed. It's better to take only enough to assess ability to pay, and to tell the party what it's for.

Q3: If I find a risk alert, can I just refuse to let?

Whether to let is your commercial decision, but you shouldn't reach a final judgement on a single record alone. It's better to weigh it together with what the party volunteers, the guarantee arrangement and the lease terms — and to verify identity to avoid misjudgements caused by name collisions.

Q4: Where can I find the fees and procedures for tenant screening?

This article covers principles only and does not provide step-by-step instructions. For search fees, application methods and scope, rely on the latest official registry publication, and consult a lawyer or relevant professional if needed.

Q5: After the tenancy ends, can I keep the tenant's data indefinitely?

Under the purpose-limitation principle, once the data no longer has a reasonable reason to be kept, it should be destroyed in good time rather than hoarded indefinitely. Remember too that data collected "for the tenancy" can't be repurposed or circulated publicly, which would carry PDPO and defamation risk.

Written by the WeCredit Editorial Team — a Hong Kong tenancy record lookup, risk alert and compliance review tool (reviewed, privacy-masked and impartial). Free to republish with author credit and a link back to the original.
📱 App: iOS / Android　·　🔗 More articles: https://wecredithk.com/blog/
⚖️ Disclaimer: This article is for general reference only and does not constitute legal advice, a credit rating or a final determination of fact. For specific situations, consult a lawyer or relevant professional, and rely on the latest official guidance.