Hong Kong
ComprehensivePersonal Data (Privacy) Ordinance (PDPO) Cap. 486
Authority: Office of the Privacy Commissioner for Personal Data (PCPD) | Enforcement: Active | Enacted: December 1996
Overview
Hong Kong has one of Asia's longest-standing data protection regimes. The PDPO was enacted in 1995, with significant amendments in 2012 (direct marketing) and 2021 (doxxing). The PCPD actively enforces with investigation and prosecution powers.
14-Topic Coverage
Data Protection Authority
Fully AddressedPCPD is the independent statutory authority with investigation, enforcement, and prosecution powers.
Consent Requirements
Fully AddressedData Protection Principles require informed consent for collection purpose. Opt-out for direct marketing.
Data Subject Rights
Fully AddressedRights to access and correction under Data Protection Principles.
Cross-Border Transfer
Partially AddressedSection 33 enacted but not yet commenced. Practical guidance issued by PCPD.
Breach Notification
Partially AddressedNo statutory breach notification requirement. PCPD guidance recommends voluntary notification.
DPO Requirements
Partially AddressedNot mandatory. PCPD guidance recommends designation.
Children's Data
Partially AddressedGeneral provisions apply. No specific age threshold.
Penalties & Enforcement
Fully AddressedFines up to HKD 1 million and imprisonment up to 5 years for certain offences.
Sector-Specific Rules
Fully AddressedHKMA banking rules, SFC securities data, health data regulations.
Cookie/Tracking
Not AddressedNo specific cookie regulation.
AI & Automated Decisions
Partially AddressedPCPD guidance on ethical AI development. No specific legislation.
Data Localisation
Not AddressedNo general data localisation requirement.
Significant Data Fiduciary
Not AddressedNo equivalent concept.
Government Data
Fully AddressedPDPO applies to government departments and agencies.
Coverage Summary
Quick Navigation
Need Compliance Help?
Our data privacy team can help you navigate Hong Kong's regulations.
Book a Consultation