TC006431)
To answer whether a Hong Kong company search exposes personal privacy accurately under Hong Kong law, one must distinguish between two distinct perspectives—(1) the Searcher conducting due diligence, and (2) the Company Director or Shareholder whose entity is being searched:
- Perspective 1 (As the Searcher / Investigator — Will the target company know I searched them?): 100% No. Under Section 45 of the Companies Ordinance (Cap. 622), public register inspections are strictly one-way, confidential retrievals. Whether you conduct a free basic corporate status check or purchase official filing images such as the Annual Return (
Form NAR1), Incorporation Form (Form NNC1), or Business Registration Extract (BRC), neither the Companies Registry (CR) nor the Inland Revenue Department (IRD) sends any alert or notification to the target company, its directors, or its company secretary. Furthermore, the target company has zero legal right or technical interface to query who has inspected its public records[1]. - Perspective 2 (As a Director or Shareholder — Will my home address, ID number, and phone number be exposed to the public?): Core sensitive data is statutorily shielded, but "Individual Shareholder Addresses" remain a critical blind spot requiring proactive protection. Following the full implementation of Phase 3 of the New Inspection Regime on December 27, 2023, directors' Usual Residential Addresses (URA) and the full identity card / passport numbers of directors and company secretaries are classified as statutory "Protected Information"—public filings display only a correspondence address and a partially masked ID number (e.g.,
A1*3*5*(*)), while personal mobile numbers, email addresses, and private company financial statements are never open to public inspection[2]. However, the critical statutory blind spot is that automatic address masking under Cap. 622 applies ONLY to Directors, NOT to Individual Shareholders (Members)—if an individual founder enters their private home address in the Shareholder/Member section ofForm NNC1orForm NAR1, that address remains 100% visible to the public!
1. The Searcher's Perspective: Will the Target Company Know Who Inspected Its Records?
In cross-border trade verification, pre-litigation asset tracing, M&A due diligence, and counterparty credit screening, the primary concern of investigators and legal teams is: "If I retrieve a target Hong Kong company's Form NAR1 or director index, will its board or company secretary receive an automated alert or visitor log?"
1.1 One-Way Public Register Architecture & Zero-Notification Guarantee
Under Section 45 of the Companies Ordinance (Cap. 622), the Registrar of Companies maintains the public register for public inspection upon payment of prescribed statutory fees. Both legally and technically:
- Zero Search Alerts (Even Under CR "e-Monitor"): The Companies Registry's e-Services Portal (ICRIS) and the IRD's Business Registration enquiry system operate on a strictly one-way read architecture. Even if a target corporation subscribes to the Registry's e-Monitor service (designed to prevent corporate identity theft), e-Monitor only triggers an email/SMS alert when a new statutory document is delivered for registration (Filing)—it remains 100% silent whenever any third party inspects or downloads existing public filings (Search / Inspection)[1].
- No Right to Reverse-Query Searcher Logs: Neither the target company's directors, shareholders, company secretary, nor its legal counsel can apply to the Companies Registry or the IRD to obtain a list of persons who have searched the company's public records.
1.2 Who Sees the "Statement of Purpose of Search"?
Before accessing the Companies Registry's online search portal, users must check a mandatory Statement of Purpose of Search confirming that the search falls within the 7 statutory purposes under Section 45 of Cap. 622 (e.g., ascertaining whether to deal with the company or its officers, or verifying the particulars of the company or its directors)[1][4]:
- Strictly Internal Regulatory Retention: Your declaration and payment records are retained exclusively within the Companies Registry's internal compliance database and are never disclosed to the target company. These logs are accessed only by law enforcement or the Office of the Privacy Commissioner for Personal Data (PCPD) if a formal criminal investigation is launched into unlawful doxxing (Cap. 486 s.64) or unauthorized direct marketing.
1.3 Searcher Anonymity Matrix Across 6 Common Due Diligence Actions
| Due Diligence / Search Action | Governing Authority | Is Target Company Notified? | Privacy Isolation & Statutory Mechanism |
|---|---|---|---|
| 1. Basic Corporate Profile, CR No., Incorporation Date & Live Status | Companies Registry (CR) | 100% Anonymous (Zero Alert) | Public index query; requires no consent from the target entity and leaves zero trace on the company's portal. |
| 2. Retrieving Form NAR1 / NNC1 / ND2A / NSC1 Filing Images | Companies Registry (CR) | 100% Anonymous (Zero Alert) | Retrieval of official imaged records (with 14-digit ICRIS barcode or Certified True Copy); target company receives no notification. |
| 3. Extracting Business Registration Register (BRC Extract) | IRD Business Registration Office | 100% Anonymous (Zero Alert) | Issued under Section 19A of the Business Registration Ordinance (Cap. 310); IRD never notifies the business operator. |
| 4. Screening High Court Civil Litigation & Winding-Up Petitions | HK Judiciary / Official Receiver (ORO) | 100% Anonymous (Zero Alert) | Inspection of public court cause lists, writ registers, and compulsory winding-up petitions is completely silent to litigants. |
| 5. Commissioning Proxy Retrieval via 86hc.com Licensed Channel | HC Business (TCSP: TC006431) | 100% Anonymous + Dual Shield | Filings are retrieved through our licensed TCSP institutional gateway, isolating your corporate identity and payment details from direct registry billing logs. |
| 6. Inspecting the Significant Controllers Register (SCR) | Company's Registered Office | Law Enforcement Only | Under Cap. 622 s.653X, the SCR is kept at the company's registered office and is closed to the general public; only 9 statutory HK law enforcement agencies may inspect it. |
2. The Director & Shareholder's Perspective: What Personal Data Can the Public Actually See?
Conversely, for international founders, cross-border e-commerce operators, and family office principals incorporating in Hong Kong, the pressing question is: "If I act as a director and shareholder of a Hong Kong company, will competitors or strangers be able to look up my home address, passport/ID number, mobile phone number, or company financial accounts?"
Under the Companies Ordinance (Cap. 622) and the Inland Revenue Ordinance (Cap. 112), corporate records are strictly segregated into Publicly Inspectable Records, Protected (Masked) Information, and Strictly Confidential Non-Public Records:
| Personal / Corporate Data Category | Public Search Visibility | Relevant Forms & Statute | What the Public Sees & Statutory Privacy Boundary |
|---|---|---|---|
| 1. Names of Directors & Company Secretary | Publicly Disclosed | Form NNC1 / NAR1 / ND2A(Cap. 622 s.643) | Full legal Chinese and English names of current and former directors, reserve directors, and company secretaries, plus appointment/cessation dates. |
| 2. Director's Usual Residential Address (URA) | Shielded (Protected Info) | Cap. 622 ss. 47, 54 (New Inspection Regime) | Private residential addresses of directors are strictly hidden from public search! Public filings display only the director's Correspondence Address (typically the company's registered office or TCSP secretary address). |
| 3. Director & Secretary HKID / Mainland ID / Passport Number | Partially Masked (Protected Info) | Cap. 622 ss. 47, 54 (New Inspection Regime) | Full identity numbers are strictly withheld! Public filings display only a Partial ID Number (retaining odd-numbered positions and masking roughly half the characters with asterisks, e.g., A1*3*5*(*)). |
| 4. Individual Shareholder (Member) Name, Shareholding & Address | Publicly Disclosed (Critical Blind Spot!) | Form NNC1 / NAR1 / NSC1(Cap. 622 s.627) | Shareholder names, share classes, and share counts are public. Warning: Statutory address masking covers ONLY Directors, NOT Shareholders! If a shareholder enters a home address in the Member section, it remains 100% public! |
| 5. Significant Controllers Register (SCR) (>25% Ultimate Beneficial Owners) | Closed to Public (Law Enforcement Only) | Cap. 622 ss. 653A–653X | Maintained internally at the registered office; never filed with the public Companies Registry database and inaccessible to commercial counterparties. |
| 6. Personal Mobile Number, WeChat & Email Address | Never Public | CR Statutory Form Specifications | Public pages of Form NNC1 and Form NAR1 do not collect directors' or shareholders' private phone numbers or emails; presenter contact slips are excluded from public imaging. |
| 7. Audited Financial Statements, Revenue, Bank Accounts & Tax Returns | Strictly Confidential (Private Co.) | Cap. 622 s.662 Cap. 112 s.4 (Official Secrecy) | Hong Kong Private Companies Limited by Shares are exempt from filing financial statements with Form NAR1. Bank account numbers, balances, and Profits Tax Returns (Form BIR51) are protected by strict tax secrecy. |
3. Inside the Companies Registry "New Inspection Regime" & Partial ID Masking Algorithm
Prior to 2021, Hong Kong's public register allowed anyone to inspect the unredacted residential addresses and full HKID or passport numbers of corporate officers. To align with international privacy benchmarks and combat malicious doxxing, the Legislative Council enacted the inspection regime provisions under Sections 47 to 59 of the Companies Ordinance (Cap. 622) across three phases[2]:
Phase 1 (Effective August 23, 2021): Internal Company Registers
Permitted Hong Kong companies to replace directors' Usual Residential Addresses (URA) with Correspondence Addresses and replace full ID numbers with partial ID numbers on their internal Register of Directors and Register of Company Secretaries kept for inspection at the registered office.
Phase 2 (Effective October 24, 2022): Automatic Shielding of All New CR Filings
All statutory forms delivered to the Companies Registry on or after this date (including Form NNC1, Form NAR1, and Form ND2A) utilize a split architecture: a public main form and a confidential Protected Information Appendix (PI-NNC1 / PI-NAR1 / PI-ND2A). The PI appendix containing the director's residential address and full ID number is automatically segregated into a restricted database upon filing, never appearing in public search downloads[2].
Phase 3 (Effective December 27, 2023): Retroactive Redaction of Historical Filings via Form MPI
Enabled data subjects (current or former directors, reserve directors, and company secretaries) to apply to the Registrar under Section 49 of Cap. 622 to withhold their residential addresses and full identification numbers contained in historical documents registered before October 24, 2022[3].
3.1 Official Partial ID Number Masking Formula Across Identity Documents
| Identity Document Type | Full Original Number (Example) | Public Filing Masked Display | Statutory Masking Algorithm |
|---|---|---|---|
| Hong Kong Identity Card (HKID) | A123456(7) or AB123456(7) | A1*3*5*(*) or AB1*3*5*(*) | Retains alphabetic prefix(es) and odd-positioned digits (1st, 3rd, 5th); masks even digits (2nd, 4th, 6th) and the check digit with asterisks *. |
| Mainland China Resident ID Card (18 Digits) (Reported under Passport / Overseas ID) | 44030119850815241X | 4*0*0*1*8*0*1*2*1* | Retains odd-numbered character positions (1st, 3rd, 5th, 7th...) from left to right; masks all even-numbered positions with *. |
| International Passports | EJ8264915 | E*8*6*9*5 | Retains odd-numbered positions (1st, 3rd, 5th, 7th, 9th) and masks all even-numbered characters with *. |
4. Three Overlooked Privacy Blind Spots & Statutory Remediation SOP (Form MPI & Shareholder Structuring)
Across more than 10,000 corporate secretarial mandates handled by HC Business (TCSP License: TC006431), we frequently encounter company founders whose residential addresses or full ID numbers remain exposed to public searches due to three widespread compliance blind spots:
4.1 Blind Spot 1: Entering a Private Home Address in the "Shareholder / Member" Section
- The Statutory Trap: Sections 47 and 54 of the Companies Ordinance (Cap. 622) grant automatic residential address protection exclusively to Directors and Reserve Directors—they do NOT apply to Shareholders (Members)!
- How Leakage Occurs: When an individual founder acts as both sole director and sole shareholder, unlicensed formation agents often put the founder's residential address on the confidential
PI-NNC1sheet for the director role, but carelessly paste the exact same private residential address into the public "Founder Members / Shareholders — Address" box on the mainForm NNC1orForm NAR1! Because the register of members is 100% open to the public, anyone purchasing the filing image can read the founder's home address in the shareholder table. - Institutional Protection Solutions:
- Direct Individual Shareholding: Cap. 622 does not require a shareholder's address to be a residential address. Always register the company's Hong Kong Registered Office Address or a licensed TCSP commercial correspondence address as the Shareholder's address on
Form NNC1,Form NAR1, andForm NSC1; - Corporate Holding SPV Layer: Hold the operating Hong Kong company's shares through a BVI, Cayman, or parent Hong Kong holding entity so that only the corporate parent's name and registered office appear on the public register of members.
- Direct Individual Shareholding: Cap. 622 does not require a shareholder's address to be a residential address. Always register the company's Hong Kong Registered Office Address or a licensed TCSP commercial correspondence address as the Shareholder's address on
4.2 Blind Spot 2: Unredacted Historical Filings Prior to October 24, 2022 (Form MPI Remedy)
If your Hong Kong company was incorporated before October 24, 2022, Phase 3 of the New Inspection Regime does not automatically redact historical microfilms or scanned PDFs unless the data subject submits an explicit opt-in application[3]. Without action, any third party can still download your pre-October 2022 Form NNC1 or Form NAR1 and view your unmasked passport/ID number and home address.
Step 1: Audit Pre-October 2022 Historical Filings & Barcodes
Search your company on the 86hc.com Hong Kong Company Search Portal to inventory all statutory filings lodged prior to October 24, 2022 (such as historical Form NAR1, AR1, NNC1, NC1, and ND2A) along with their official document barcodes.
Step 2: Complete Form MPI (Application for Withholding Usual Residential Address / Full ID)
Under Section 49 of Cap. 622, prepare Companies Registry Form MPI listing the exact company number, document titles, filing years, and document numbers to be redacted, while designating a valid Hong Kong replacement correspondence address[3].
Step 3: Lodge Form MPI with Certified ID Copy (HK$ 0 Statutory Fee)
Lodge Form MPI via the e-Services Portal or by post with an identity document copy certified by a licensed TCSP (such as HC Business, TC006431), a Hong Kong practising solicitor, or a practising CPA. The Companies Registry charges HK$ 0 for Form MPI applications and permanently replaces the historical public images with redacted versions upon approval.
4.3 Blind Spot 3: Ineffective Correspondence Address Triggering Section 58 Mandatory URA Re-Disclosure
Under Section 58 of the Companies Ordinance (Cap. 622), if a company abandons its company secretary and official mail sent to a director's registered Correspondence Address is returned undelivered, the Registrar of Companies has statutory authority—after issuing a notice to the director—to put the director's protected Usual Residential Address (private home address) back onto the public register for unrestricted public inspection for 5 years[2]! Maintaining an active, licensed TCSP company secretary and registered office is therefore essential to preserving residential address privacy.
5. Lawful Penetration: Who Can Legally Inspect "Protected Information" & the SCR?
Hong Kong's privacy shield does not shelter commercial fraud or debt evasion. Where legitimate legal or regulatory grounds exist, the Companies Ordinance provides two statutory penetration channels:
5.1 Seven Categories of "Specified Persons" Under Cap. 622N
Under the Companies (Specified Persons) Regulation (Cap. 622N), the Registrar may disclose a director's unmasked Usual Residential Address and full ID number upon formal application by 7 categories of Specified Persons[2]:
| Specified Person Category (Cap. 622N) | Eligible Entities & Licensed Professionals | Permitted Statutory Purpose & Use Case |
|---|---|---|
| 1. Data Subject | The director, reserve director, or company secretary themselves | Obtaining an official certified extract of one's own protected residential address and full ID number. |
| 2. Authorized Person | Any person holding written authorization signed by the data subject | Used in M&A closing, financing KYC, or immigration audits with the director's written consent. |
| 3. Member (Shareholder) of the Company | Any registered shareholder listed on the company's Register of Members | Exercising statutory member rights under Cap. 622 (e.g., derivative actions or requisitioning general meetings). |
| 4. Liquidators & Trustees in Bankruptcy | Provisional liquidators, liquidators (Cap. 32), and bankruptcy trustees (Cap. 6) | Tracing absconding directors, recovering company assets, and investigating fraudulent preferences. |
| 5. Public Officers & Public Bodies | HK Police Force, ICAC, IRD, Customs, SFC, HKMA, and Official Receiver | Law enforcement, tax audits, financial crime investigations, and regulatory supervision. |
| 6. Court-Ordered Persons | Creditors or litigants holding an order from the High Court or District Court | Serving a Writ of Summons or statutory demand where a defendant director evades service at the correspondence address. |
| 7. AMLO Financial Institutions & DNFBPs | HK Practising Solicitors, Practising CPAs (AFRC), Licensed Banks, SFC Licensed Corporations, and Licensed TCSPs (e.g., HC Business TC006431) | Performing mandatory Customer Due Diligence (CDD / KYC) under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615). |
5.2 The 9 Law Enforcement Agencies Authorized to Inspect the SCR (Cap. 622 s.653X)
Under Part 12 Division 2A of Cap. 622 (Sections 653A–653ZM), every non-listed Hong Kong company must maintain a Significant Controllers Register (SCR) at its registered office recording ultimate beneficial owners holding more than 25% of shares or voting rights. Under Section 653X, the SCR is strictly closed to the public and inspectable only by the registered controller and 9 Hong Kong statutory authorities: the Companies Registry, Hong Kong Police Force, Customs and Excise Department, Immigration Department, Inland Revenue Department, ICAC, SFC, HKMA, and Insurance Authority (IA)[5].
6. Legal Red Lines for Searchers: Anti-Doxxing Offenses & Direct Marketing Restrictions (Cap. 486)
While retrieving public filings is completely lawful and anonymous, "lawful retrieval from a public register" does NOT grant immunity for unrestricted publication or commercial spam. Under the Personal Data (Privacy) Ordinance (Cap. 486, PDPO) and Section 45 of Cap. 622, crossing any of the following three statutory red lines triggers severe criminal liability[4]:
| Unlawful Misuse of Search Data | Statutory Offense Provision | Maximum Criminal Penalty | Prohibited Conduct & Compliance Warning |
|---|---|---|---|
| 1. Unlawful Doxxing & Online Harassment | PDPO (Cap. 486) Sections 64(3A) & 64(3C) | Tier 1 (Summary): Fine of HK$ 100,000 + 2 years' imprisonment; Tier 2 (Indictment): Fine of HK$ 1,000,000 + 5 years' imprisonment. | Posting screenshots of a director's or shareholder's name, partial ID, signature, or address from Form NAR1 onto social media or chat groups to intimidate, harass, or cause psychological/property harm over a commercial dispute. |
| 2. Unauthorized Direct Marketing (Cold Spam) | PDPO (Cap. 486) Sections 35C–35G | Fine of up to HK$ 500,000 + 3 years' imprisonment (up to HK$ 1,000,000 + 5 years if data is sold for gain). | Scraping or harvesting director names and addresses from newly incorporated company filings to send unsolicited marketing mail or cold sales calls without prior opt-in consent. |
| 3. False Statement of Search Purpose | Companies Ordinance (Cap. 622) s.895 & Cap. 622N | Fine of up to HK$ 300,000 + 2 years' imprisonment on indictment. | Making a false declaration on the Statement of Purpose of Search or forging authorization to obtain Protected Information. |
7. Field Case Studies: Search Anonymity & Privacy Remediation by HC Business (TCSP: TC006431)
The following three anonymized cases from Lead Consultant Min Liu and the HC Business compliance desk illustrate practical privacy protection for both investigators and corporate officers:
Case A (Confidential M&A Counterparty Due Diligence · Zero-Trace Charge & Shareholding Audit)
Background: A private equity fund planned to acquire a 60% stake in a Hong Kong Science Park semiconductor company. Before signing the Term Sheet, the investment committee needed to verify 8 years of historical share allotments (Form NSC1), unreleased bank charges (Form M1), and High Court litigation—without alerting the target company's founders.
Outcome: Through the 86hc.com Institutional Due Diligence Desk, HC Business (TCSP: TC006431) retrieved all 26 historical statutory filings (with verified 14-digit ICRIS barcodes) and court litigation records. Because public register and court searches are strictly one-way, the target company received zero alerts. The buyer quietly discovered an unreleased 2024 patent charge (Form M1) in favor of a finance company and successfully added full charge release as a condition precedent to closing.
Case B (Pre-2022 Company Director Address & Full ID Exposure · Free Redaction via Form MPI)
Background: Mr. Wang incorporated a Hong Kong trading company in 2017. In early 2026, concerned about competitors looking up his personal details, he audited his company's public profile and discovered that 7 historical filings lodged between 2017 and October 2022 (including his original 2017 Form NNC1 and five Form NAR1 returns) still displayed his unmasked 18-digit Mainland ID number and private residential address.
Outcome: HC Business prepared and certified Form MPI under Section 49 of Cap. 622, designating our Wan Chai office as his replacement correspondence address. The Companies Registry approved the application at HK$ 0 government fee, permanently replacing all 7 historical public filing images with redacted versions.
Case C (Individual Founder Home Address Exposed in Shareholder Box · Holding SPV Restructuring)
Background: A family office principal incorporated a Hong Kong investment company in 2025 as sole director and sole shareholder. While previewing his Form NNC1 on 86hc.com, he realized that although his director address on Page 5 showed his Central office, Page 3 ("Founder Members / Shareholders") publicly displayed his private Repulse Bay residence.
Outcome: Our compliance team explained that Cap. 622 s.47 shields only director addresses, not shareholder addresses. We assisted the client in transferring the shares to a wholly-owned BVI holding company (completing IRD stamp duty adjudication) and updating the Register of Members and subsequent Form NAR1 to reflect the BVI corporate shareholder and commercial registered office.
8. Frequently Asked Questions (FAQ) & Official Statutory Sources
Form NNC1, Form NAR1, etc.) never display directors' or shareholders' private mobile phone numbers or email addresses. Second, since Phase 2 of the New Inspection Regime took effect on October 24, 2022, full identity card and passport numbers of directors and company secretaries are classified as statutory "Protected Information"—public filings show only the prefix and odd-numbered digits (e.g., A1*3*5*(*)).
Form NNC1 or Form NAR1, it remains visible (always use a commercial correspondence address for shareholder entries); or (2) Pre-October 2022 Historical Filings: Documents registered before October 24, 2022 remain unredacted unless you submit a free Form MPI application to the Companies Registry.
TC006431) conducting statutory CDD, or obtain a Hong Kong court order—to apply formally to the Registrar of Companies for an unredacted extract of the director's Protected Information.
References & Official Hong Kong SAR Statutory Sources
- Hong Kong e-Legislation: Companies Ordinance (Cap. 622) Part 2 Division 4: Section 45 (Registrar must make register available for public inspection & 7 statutory purposes) and Section 895 (Offence for false statement).
- Companies Registry, HKSAR: New Inspection Regime Official Portal, Cap. 622 Sections 47–59 (Protected Information & Section 58 disclosure upon ineffective correspondence address), and Companies (Specified Persons) Regulation (Cap. 622N).
- Companies Registry, HKSAR: Phase 3 of the New Inspection Regime: Application for Withholding Usual Residential Address and Full Identification Number in Historical Documents (Form MPI) (Effective December 27, 2023; Fee: HK$ 0).
- Office of the Privacy Commissioner for Personal Data (PCPD): Personal Data (Privacy) Ordinance (Cap. 486) Part 6A (Sections 35C–35G: Use of Personal Data in Direct Marketing) and Part 9 Section 64 (Offence for disclosing personal data obtained without consent / Anti-Doxxing).
- Companies Registry, HKSAR: Companies Ordinance (Cap. 622) Part 12 Division 2A (Sections 653A–653ZM): Significant Controllers Register (SCR) Regime.
- Inland Revenue Department (IRD): Business Registration Ordinance (Cap. 310) Sections 19 & 19A and Inland Revenue Ordinance (Cap. 112) Section 4 (Official Secrecy).