Request a credit reference agency (CRA) to delete all information held in its database
The Enquiry
Whether a borrower can request a CRA to delete all information held in its database after full repayment.
Our Response
Although there is no provision under the Ordinance to compel a data user to delete the personal data of the data subject upon his/her request, a data user is obliged to comply with the requirements of Data Protection Principle (DPP) 2(2) of Schedule 1 to the Ordinance, which requires data users to take all practicable steps to ensure that personal data is not kept longer than is necessary for the fulfilment of the purpose for which the data is used.
Concerning the retention of consumer credit data, CRAs should further observe the requirements under the “Code of Practice on Consumer Credit Data” (the Code).
Paragraph 2.15 of the Code stipulates that where a credit provider has provided to a CRA any account data or mortgage account general data relating to an account, if within 5 years after account termination, the credit provider receives instructions from the individual to whom such account relates to make a request to the CRA to delete such account data or mortgage account general data from its database, the credit provider shall, as soon as reasonably practicable upon the receiving the instructions, check from its own records whether both of the following conditions are satisfied, namely:
2.15.1 that the account has been settled by full payment (other than payment by refinancing of the debit balance on the account by the credit provider); and
2.15.2 that there has not been, within 5 years immediately before account termination, any material default on the account (whether or not such default period fell entirely within those 5 years),
and shall, upon verifying that both conditions are satisfied, make the request to the CRA as soon as reasonably practicable, or alternatively, upon verifying that one of the said conditions is not satisfied, notify the individual as soon as reasonably practicable its rejection of the instructions, and the reason for such rejection.
Besides, where a CRA has collected general particulars of a borrower (such as address and telephone number), the CRA may still, pursuant to paragraph 3.6.7 of the Code, retain such data in its database for as long as there are other consumer credit data related to the borrower contained in the database of the CRA.
(Uploaded in February 2026)