Consent and borrower rights in credit reporting: what Southeast Asian rules require

Implications for lenders

Where consent is required before a bureau enquiry, as in Thailand and now Vietnam, a lender may need to store a verifiable consent record for each check and to issue a written refusal letter when it declines on bureau data, which Thai rules require and the Philippine Act backs with a right to know the causes of refusal. Lenders that report data should plan for disputes within the set time limits, such as five working days for CIC verification in the Philippines and up to 14 working days for feedback in Malaysia, since uncorrected errors can affect borrowers' access to credit at other lenders.

Implications

Facts

Thailand: the Credit Information Business Act of 2002, amended most recently in 2022, governs credit information businesses in Thailand. The Bank of Thailand's consumer-rights page summarises what it means for people with bureau records. The bureau may disclose a person's credit information only with that person's consent, in practice given by signing a consent letter with the loan application, or where a law permits disclosure, for example to a court, police investigators, the Ministry of Finance or the Bank of Thailand. A person may examine the data held and ask for errors such as a wrong name or date of birth to be corrected; where a lender and the person disagree about an account, the person may ask the bureau to record a dispute note, and may appeal to the Credit Data Protection Committee at the Bank of Thailand, which decides within 60 days of the dispute note being recorded ¹. A lender that refuses credit on the basis of credit information must give the applicant a written refusal letter, not a verbal or SMS notice, and with that letter the person may check their bureau record free of charge.

Vietnam: the State Bank of Vietnam's Circular 46/2026/TT-NHNN, amending Circular 15/2023/TT-NHNN on credit information activities, took effect on 1 November 2026. VietnamPlus reported that, from that date, providing a borrower's credit information to voluntary member organisations, foreign credit information organisations and other organisations must rest on the borrower's explicit and specific consent, as required by the relevant laws and under the information-exchange agreement with the National Credit Information Centre (CIC). The consent must be given in a clear and specific way that can be printed or copied in writing, including in electronic or another verifiable form.

Philippines: the Credit Information System Act (Republic Act No. 9510, approved on 31 October 2008) relies on notice rather than consent for submission. Section 4(f) requires each submitting entity to notify its borrowers that it must submit their basic credit data to the Credit Information Corporation (CIC), and the CIC's public page answers “No” to whether a borrower can refuse to have data submitted. Under Section 4(o) a borrower has ready access to their own credit information, as a matter of right and for a reasonable fee, and may dispute erroneous, incomplete, outdated or misleading information; the CIC investigates and verifies within five working days of receiving the complaint, deletes information it cannot verify, and informs the borrower and accessing entities of the correction or removal within the same period ². Section 4(n) gives the borrower the right to know the causes of a refusal of credit, and Section 4(h) limits negative information to three years after it is rectified ³. Consent appears in narrower places: a written waiver for data under bank secrecy, and written consent before a special accessing entity releases data to a non-accessing entity. The CIC's page says a credit report can be accessed only with the borrower's explicit authorization.

Malaysia: Bank Negara Malaysia's Credit Bureau runs the Central Credit Reference Information System (CCRIS). Its public pages say that only the individual may request their own credit report, that the report is currently free of charge from BNM or through eCCRIS, and that there is no limit on how many times it may be retrieved. A financial institution may not access the report of a borrower who is not its customer or potential customer, and unlawful access can lead to penalties under the Central Bank of Malaysia Act 2009. A borrower cannot prevent the bureau from holding their information. BNM does not change records itself: the reporting financial institution updates them, a settled loan is updated by the next reporting date, no later than the tenth day of the following month, and the financial institution may take up to 14 working days to give feedback on a dispute ⁴. While a dispute is pending BNM can tag the report, but the lending decision stays with the financial institution.

Indonesia: when OJK launched the iDebKu application in November 2022, its press release said that members of the public can request SLIK debtor information (iDeb) online and through walk-in service, free of charge.

Analysis

“What a credit bureau holds, and how each kind of data shapes a lending decision” (the first part of this series) described the record a lender reads, and “Who must report to credit bureaus in Southeast Asia, and who may look: the reporting perimeter by country” (the third part) described who may look at it. Consent and data-subject rights are the rules for when a lender may look and what the borrower can do about what it sees. The published rules compared here follow two models.

The first is consent before disclosure. Thailand's bureau discloses a person's data only with consent or where a law allows it, and Vietnam's Circular 46/2026/TT-NHNN now asks for explicit, specific and verifiable consent before CIC data go to voluntary members, foreign bureaus and other organisations (reported under Latest developments as “Vietnam's central bank mandates explicit consent for sharing credit information”). “Alternative data and thin-file borrowers: where Southeast Asian rules let lenders use it” (the fourth part) showed the same logic in Indonesia's alternative scoring rules, which require the data owner's consent along the data chain.

The second is mandatory reporting with notice. In the Philippines and Malaysia, the borrower cannot keep data out of the bureau; protection comes from purpose limits on who may access the data (existing borrowers and pending applications in the Philippines, customers and potential customers in Malaysia), from the borrower's own access, and from correction duties. Even here, release beyond the accessing institutions needs the borrower's written consent or authorization.

Rights after the fact are similar in kind but differ in terms. Thailand, the Philippines, Malaysia and Indonesia all describe a way for individuals to obtain their own record, and the first three also set out correction and dispute routes; Vietnam's new rule, as reported, concerns consent for sharing. Access is free in Malaysia and Indonesia, free in Thailand when the person holds a refusal letter, and for a reasonable fee under the Philippine Act. The dispute clocks are set at different levels: five working days for the CIC to verify, up to 14 working days for a Malaysian lender to respond, and 60 days for a Thai appeal decision. In Malaysia the correction duty sits with the reporting institution rather than the bureau, so the lender's own data team is the one that fixes an error.

In T&S's view, these rules are operational controls as much as legal ones. Under a consent model, a lender that cannot show a valid consent record has no basis for the enquiry, so consent capture becomes part of the application flow, and in embedded and BNPL journeys where the application sits inside a partner's app, the lender needs that partner's screens to collect it in the form the rules ask for. Refusal-notice rights in Thailand and the Philippines mean that a decline based on bureau data has to be explainable to the applicant. Dispute and correction duties tie the lender's reporting quality to complaint volumes, and the theme returns in the planned part on data quality and disputes.

Counterpoints and uncertainties

Several of the descriptions compared here come from consumer-facing pages (the Bank of Thailand rights page, BNM's FAQ, the CIC page) rather than from the full legal text, and the Vietnamese rule is described from press reports of Circular 46/2026/TT-NHNN; detailed requirements may differ from these summaries. Indonesia's free iDeb service is described in a 2022 press release, and channels may have changed since. General personal data protection laws in each country add requirements not covered here. A counterpoint to the T&S view: stricter consent rules can add friction to digital applications, and if lenders respond by checking bureaus less often, they may lend with less information about other debts, which would cut against the purpose of the rules. Mandatory reporting without opt-out, as in the Philippines and Malaysia, also means that data errors reach every lender that checks, so correction speed matters to borrowers as much as consent does.

This article is based solely on publicly available sources.