Personal Data Privacy Ordinance
Before we begin
This notice ("Notice") applies to the processing of your personal data by any member of the HSBC Group as data user, wherever situated, in connection with your employment or engagement with the HSBC Group. This Notice covers all aspects of your interaction with us in your capacity as an employee or non-employee* and we may update this Notice at any time.
("HSBC Group" and any "member of the HSBC Group" means HSBC Holdings plc and/or its affiliates, subsidiaries, associated entities and any of their branches and offices (collectively "we", "us", "our"). Wherever we've said "you" or "your", this means you or any authorised person who engages with us on your behalf.)
Please note that certain specific processing activities may be subject to a separate privacy statement.
Collection of Data
We may collect your information from you directly, from someone acting on your behalf or from another source, including information we collect or generate about you, from previous employers, other members of the HSBC Group, or other sources you've asked us to obtain information from. We may also get information about you from publicly available sources.
If you provide us with any personal data of another person (e.g. a family member), you are responsible for ensuring that such person is aware of the information contained in this Notice and has given you their consent for sharing their information with us.
Except for certain information that is mandatory, providing any personal data to the HSBC Group is voluntary. However, if you do not provide certain information we may not be able to accomplish some of the purposes outlined in this Notice.
We only collect your information as permitted by relevant law and regulation.
Use of Data
We will use your information for purposes related to the following:-
(a) Administration of employment applications
(i) assessing and managing your future employment application(s);
(ii) employment checks and background screening/vetting; and
(iii) record keeping and/or to consider you for future opportunities.
(b) HR administration purposes
(i) conducting employment checks, background screening/vetting whenever appropriate during your employment or engagement with the HSBC Group;
(ii) applying for work permits, licences and/or registrations on your behalf;
(iii) making business travel arrangements, managing business expenses and reimbursements;
(iv) carrying out performance reviews and appraisals;
(v) payroll functions and paying and reviewing remuneration, including any deferred rewards;
(vi) providing, administering and reviewing benefits and entitlements, for example, staff loans, pension and retirement savings, share plan, health insurance, life insurance, and provision of occupational health services;
(vii) maintaining leave records, absence records and sick leave/pay information;
(viii) workforce planning and talent management including training, secondments, assignments or transfers, scheduling, staffing, resource allocation, reporting, career development activities and managing skills and learning path, and creating and maintaining internal employee directories;
(ix) informing you of employment related events and benefits;
(x) providing employee references and recommendations with your consent;
(xi) protecting your personal health and safety, including contacting you or your nominated contacts in an emergency; and
(xii) disciplinary matters, grievances and terminations.
(c) Operating and managing our business
(i) processing your information in the ordinary course of our business, including for security (which includes the security of our IT environments and data) and in connection with any engagement or provision of products and services by the HSBC Group;
(ii) operating, managing and safeguarding our IT infrastructure, communications systems, office equipment and other property;
(iii) business continuity and disaster recovery;
(iv) improving products and services;
(v) allocating human resources, strategic planning, completing bank initiatives;
(vi) audit, reporting and record keeping purposes;
(vii) budgeting, financial risk management; and
(viii) managing mergers, acquisitions, sales, or re-organizations.
(d) Complying with legal and other obligations, risk management and protecting our legal rights
(i) complying with compulsory or best practice requirements to which we may be subject, such as legal, tax, regulatory, sanctions or market requirements in Hong Kong and overseas;
(ii) complying with requests made by different bodies or authorities such as legal, regulatory, law enforcement, government and tax authorities in Hong Kong and overseas ("Authorities"). Sometimes we may have to comply with such requests and other times we may choose to voluntarily comply;
(iii) complying with our or any the HSBC Group company's policies, procedures and other commitments in the detection, investigation and prevention of financial and other crimes (e.g. fraud, cyber, terrorist financing and money laundering).
This may involve sharing your data in Hong Kong and overseas. This is important in our wider fight against these crimes; and
(iv) defense or protection of our legal rights and interests (e.g. court actions and other complaints or disputes).
(e) Surveys and data analytics
We may use your information to conduct internal surveys, analytical and statistical analysis for the purposes set out in this Notice and facilitating human resources management.
(f) Monitoring
In the interests of security, fraud prevention and ensuring compliance with legal, regulatory and internal policy requirements, the HSBC Group monitors technology systems in use within the HSBC Group, including communications and other digital platforms. You should not have the expectation of privacy when using these systems. Further, the HSBC Group reserves the right to inspect bank accounts and other facilities held by you with any member of the HSBC Group, including reviewing any transactions made.
Disclosure of Data
(g) Data we hold will be kept confidential but we may share it with the following parties for the purposes set out in this Notice:-
(i) members of the HSBC Group;
(ii) agents, contractors, sub-contractors, insurers/insurance brokers, auditors, professional advisers, such as external lawyers, or associates of the HSBC Group (including their employees, officers, agents, contractors, sub-contractors, service providers and professional advisers);
(iii) third party service providers (including their employees and officers) who provide services to any member of the HSBC Group in connection with the operation or management of our business (including but not limited to performance of pre-employment checks or background screening/vetting, provision or administration of benefits and services entitled by employees, and share scheme administration);
(iv) Authorities;
(v) persons under a duty of confidentiality to us which have undertaken to keep such data confidential, including customers and counterparts of the HSBC Group;
(vi) persons seeking employment references with the prescribed consent of the employee concerned;
(vii) persons to whom we are under an obligation or required or expected to make disclosure for the purposes set out in, or in connection with, paragraph (d)(i), (d)(ii), (d)(iii) or (d)(iv) above;
(viii) actual or proposed purchaser or assignee of all or part of our business; and
(ix) your emergency contacts.
Such data may be transferred within or outside Hong Kong, including to Cloud service providers.
Data Access Requests / Data Correction Requests
(h) You have the right to:
(i) check whether we hold data about you and to access such data;
(ii) require us to correct any data relating to you which is inaccurate; and
(iii) ascertain our policies and practices in relation to data and to be informed of the kind of data held by us.
(i) We may charge a reasonable fee for the processing of any data access request.
(j) You should send requests for access to data or correction of data or for information regarding policies and practices and kinds of data held to:
Human Resources Asia Pacific (Personal Data Access Request)
18/F, Tower 3, HSBC Centre
1 Sham Mong Road, Kowloon
Hong Kong SAR
(k) Nothing in this Notice shall limit your rights as a data subject under the Ordinance.
Human Resources Asia-Pacific
July 2025
*Note: A "non-employee" is an individual who is not employed by a member of the HSBC Group but is either self-employed or employed by a third party, e.g. contractors, consultants, service provider workers and advisers, and for the avoidance of doubt, includes non-executive directors.