Hong Kong lending security guide · Free access-control checklist
Lending data security and access control
A lending system holds the most sensitive record a borrower has: identity document, income, debts, repayment behaviour and the reasons a lender made a decision. Security here is less about a certificate on a vendor page and more about who can see what, and whether the system can show it afterwards.
Core definitions
Put similar concepts in the right place
Each component solves a different problem. Complete lending operations depend on clear data and workflow hand-offs.
| Item | What it does in practice |
|---|---|
| 01Role-scoped access | What a user can see follows role, company and permission. A collections officer and a credit manager do not need the same view of the same borrower. |
| 02Audit trail | Who looked, when, and at what. A trail that records only writes cannot answer the question that actually gets asked after an incident. |
| 03Masking and least privilege | Full HKID and phone numbers shown only where the task requires them, and cross-company lookup treated as a privileged action rather than a default. |
| 04Transport and API controls | Authenticated, rate-limited integrations with scoped credentials, so a connected system cannot read more of the book than its job needs. |
Workflow
What to require of a lending system holding borrower data
- 01
Define roles before users
Decide what each role may see and do, then assign people to roles. Permissions granted per person drift within a quarter.
- 02
Scope by company
In a group, decide deliberately which companies may see a shared borrower and record the basis for it.
- 03
Log reads, not only writes
Record access to sensitive fields so an unusual pattern is visible and an incident can be reconstructed.
- 04
Mask by default
Show partial identifiers unless the task requires the full value, and treat the full view as an audited action.
- 05
Encrypt and segregate
Protect data in transit and at rest, and keep production data out of test environments.
- 06
Control integrations
Give each connected system its own credential and the narrowest scope that works, and be able to revoke one without touching the rest.
- 07
Remove access promptly
Tie leaver and role-change handling to the same process that grants access, and verify it rather than assume it.
Printable worksheet
Free: 15-point lending access-control checklist
Check each item. Fewer than eleven checks suggests access is granted faster than it is reviewed. This is an operational self-assessment, not a security audit or legal advice.
Practical evaluation
Three security claims worth testing
A certificate is not a control
A vendor holding a certification says something about the vendor’s process. It says nothing about whether your collections officer can read a borrower’s full HKID today. Ask to see the permission model.
Write-only audit trails answer the wrong question
After an incident the question is who looked, not who changed. A trail that records edits alone cannot answer it, and the gap is usually discovered at the worst moment.
Leaver handling is where access control fails
Most excess access is not granted deliberately; it accumulates as people change roles. Whether it is removed promptly is a better test than how it is granted.
Frequently asked questions
Quick answers
Who is responsible for borrower data security?
Under the Personal Data (Privacy) Ordinance the lender is the data user and remains accountable for the security of the personal data it holds, including data held on its behalf. Software provides controls; it does not transfer that accountability.
Is Covenant Desk certified?
Covenant Desk does not claim security certification and does not certify a lender as compliant. It provides role-scoped access, audit logging, masking and controlled integrations, and the lender assesses those against its own obligations and professional advice.
What does role-scoped access mean in a group of companies?
A user’s view is bounded by role and by company. Seeing the same borrower across connected lending companies is a separate, permissioned and audit-logged action rather than something every user has by default.
Does the audit trail record who viewed a record?
Yes. Access to sensitive fields is logged, not only modification, because reconstructing an incident depends on knowing who looked.
Primary sources
Official sources and editorial note
This guide reflects official material available on the review date. Requirements can change; each institution should check the latest licence conditions and obtain legal or compliance advice. This page is not legal advice. Read our editorial and corrections policy.
- Office of the Privacy Commissioner for Personal Data: guidance on data security measures for ICT
- Office of the Privacy Commissioner for Personal Data: the six data protection principles
- Personal Data (Privacy) Ordinance (Cap. 486)
- Office of the Privacy Commissioner for Personal Data: compliance guide on identity card numbers and identifiers
Next step
See the permission model before you trust it with a borrower book.
Try Covenant Desk to inspect role-scoped access, masked identifiers, audit logging and scoped integrations against a real borrower record.
Covenant Desk is lending operations software. It does not provide loans, issue credit reports or replace the lender’s final credit decision.