🇭🇰Personal Data (Privacy) Ordinance
A law built around data users, not legal bases
Hong Kong's Personal Data (Privacy) Ordinance, Cap. 486, has been the territory's core privacy law since 1996. It does not work like the GDPR. There is no six-basis lawful processing framework, no general legitimate interests test, and no universal requirement to appoint a data protection officer. The Ordinance is built around a different architecture: the data user must comply with six Data Protection Principles across the life cycle of personal data.
That difference matters. A Hong Kong compliance review should not begin by asking whether the organisation has consent, contract or legitimate interest as a lawful basis. It should begin by asking whether the collection is lawful, fair, necessary and not excessive; whether the individual was told the required information at collection; whether the data is accurate and not retained longer than necessary; whether use is limited to the original or directly related purpose; whether security controls and processor controls are adequate; whether privacy policies are available; and whether access and correction requests can be handled properly.
Who the Ordinance covers — and who is responsible
The Ordinance applies to personal data relating directly or indirectly to a living individual, where the individual's identity can be directly or indirectly ascertained and the data is in a form in which access to or processing is practicable. This definition is practical rather than formalistic. Customer records, employee records, app identifiers, account histories, call recordings, CCTV records and online account data can all fall within the framework if identification is reasonably practicable.
The central regulated actor is the data user: the person who, alone, jointly or in common with others, controls the collection, holding, processing or use of personal data. A processor that handles personal data solely on behalf of another person, and not for its own purposes, is generally not the data user for that data. But that does not allow the data user to outsource responsibility. The Ordinance requires data users to adopt contractual or other means to control retention and security risks when personal data is processed by a data processor, whether the processor is inside or outside Hong Kong.
The Ordinance also binds the Government. There is no small-business threshold that removes an organisation from the Data Protection Principles merely because it is small, local or low-revenue. If an organisation controls personal data in Hong Kong, or controls the relevant processing as a Hong Kong data user, the compliance question begins with the Ordinance.
The six Data Protection Principles — the operating core
Principle 1 governs purpose and manner of collection. Personal data must be collected for a lawful purpose directly related to the data user's function or activity, the collection must be necessary or directly related to that purpose, and the data must be adequate but not excessive. Collection must also be lawful and fair. Where data is collected from the data subject, the data user must take practicable steps to inform the individual whether supplying the data is obligatory or voluntary, the consequences of non-supply where supply is obligatory, the purpose of use, the classes of persons to whom the data may be transferred, and the individual's access and correction rights.
Principle 2 deals with accuracy and retention. Data users must take practicable steps to ensure that personal data is accurate for the purpose for which it is used, and must not keep personal data longer than necessary for that purpose. Where processors are used, contractual or other means must be adopted to prevent personal data transferred to the processor from being kept longer than necessary.
Principle 3 is the use limitation rule. Personal data must not be used for a new purpose without the prescribed consent of the data subject. A new purpose means any purpose other than the purpose for which the data was to be used at the time of collection, or a directly related purpose. This is one of the most important practical rules under the Ordinance because many compliance failures arise after collection, when data collected for service delivery, employment, onboarding or account administration is reused for analytics, marketing, sharing or investigations without checking whether the new use remains directly related.
Principle 4 requires security. Data users must take practicable steps to protect personal data against unauthorised or accidental access, processing, erasure, loss or use, having regard to the nature of the data, likely harm, storage location, equipment security, personnel integrity and secure transmission. Processor arrangements again matter: the data user must adopt contractual or other means to prevent unauthorised or accidental access, processing, erasure, loss or use by processors.
Principle 5 requires openness. A person must be able to ascertain the data user's policies and practices in relation to personal data, the kinds of personal data held, and the main purposes for which the personal data is or will be used. A privacy notice is therefore not cosmetic; it is part of the statutory openness framework.
Principle 6 gives individuals access and correction rights. A data subject is entitled to know whether the data user holds personal data about them, request access, receive the data within a reasonable time and in an intelligible form, request correction, and receive reasons if access or correction is refused.
Consent is targeted — especially for new purpose and direct marketing
The Ordinance does use consent, but not in the same way as consent-first regimes. Its general mechanism is purpose limitation: once personal data has been collected for one purpose, it cannot be used for a new purpose without prescribed consent unless an exemption applies. Prescribed consent means express consent given voluntarily and does not include consent that has been withdrawn by written notice.
Direct marketing receives a separate and much more operational set of rules. Before using personal data in direct marketing, a data user must inform the data subject that it intends to use the data and that it may not do so without consent. It must specify the kinds of personal data to be used, the classes of marketing subjects, and provide a free response channel for the individual to communicate consent. The information must be easily understandable and, if written, easily readable.
The same structure applies when personal data is provided to another person for use in direct marketing. The data user must provide prescribed information about the intended provision, including the kinds of data, the classes of persons to whom data may be provided, the classes of marketing subjects, whether the data is provided for gain, and a free response channel. A data subject may require the data user to stop using or providing their personal data for direct marketing, and the data user must comply without charge.
Cross-border transfers — written into the law, but not yet in operation
Section 33 is one of the most misunderstood provisions of the Ordinance. It contains a detailed restriction on transferring personal data to a place outside Hong Kong unless specified conditions are met, such as the destination being specified by notice, the data user having reasonable grounds to believe that the destination has substantially similar privacy law, the data subject giving written consent, the transfer being necessary to avoid or mitigate adverse action, an exemption applying, or the data user having taken reasonable precautions and exercised due diligence to ensure Hong Kong-equivalent protection.
But section 33 is marked in the Ordinance as not yet in operation. That means organisations should not describe Hong Kong as having an operative GDPR-style cross-border transfer prohibition under section 33. The better compliance approach is to treat section 33 as a strong governance benchmark while ensuring that existing Data Protection Principles are still met: the transfer must be consistent with the purpose notified at collection, not be a new purpose without prescribed consent, and be subject to adequate security and processor controls.
A fintech app collects customer identity, transaction and contact data for account opening, fraud control and service delivery. Six months later, the marketing team decides to use the same customer database to promote partner investment products by email and telephone. The team assumes this is allowed because the customers are already users of the app. Under the PDPO, that assumption is dangerous. The direct marketing rules require the data user to inform the customer of the intended marketing use, identify the kinds of personal data and classes of marketing subjects, and obtain the customer's consent through a free response channel before using the data. If the partner will receive the data for its own marketing, the provision rules apply separately. The issue is not whether the customer relationship exists. The issue is whether the direct marketing requirements have been satisfied before the use or provision begins.
Access, correction, erasure and the rights workflow
The Ordinance gives data subjects a structured right to request access to their personal data and correction of inaccurate data. The response process is not merely a customer service obligation. The data user must handle the request within the statutory framework, provide intelligible copies where access is granted, and give reasons where access or correction is refused. Where personal data is no longer required for the purpose for which it is used, section 26 also requires erasure unless an exception applies.
This makes retention governance important. A Hong Kong privacy programme should be able to show the purpose for which each category of personal data is held, the retention period attached to that purpose, the processor arrangements that prevent unnecessary retention, and the mechanism through which access, correction and deletion issues are handled. A data subject rights workflow that exists only in a privacy policy, but not in operations, will not be enough.
Enforcement, offences and compensation
The Privacy Commissioner for Personal Data monitors and supervises compliance, promotes codes of practice, carries out inspections and investigations, and may issue enforcement notices. A data user that contravenes an enforcement notice commits an offence. The Ordinance also allows individuals who suffer damage, including injury to feelings, because of a contravention by a data user to seek compensation.
The 2021 amendments strengthened the Ordinance's response to doxxing and harmful disclosure. Section 64 creates offences for disclosing personal data obtained from a data user without consent with intent to obtain gain or cause monetary loss, and for disclosing personal data without the data subject's relevant consent with intent to cause specified harm, or recklessness as to specified harm. More serious liability applies where specified harm is actually caused. Part 9A gives the Commissioner investigation and enforcement powers connected with these section 64 offences, including powers to require materials and assistance and to issue cessation notices.
Exemptions — useful, but not general excuses
Part 8 contains specific exemptions, including for domestic purposes, security, crime and taxation, health, legal professional privilege, legal proceedings, news activity, statistics and research, due diligence exercises and emergency situations. These exemptions are targeted. They do not operate as a general permission to ignore the Data Protection Principles whenever compliance is inconvenient.
For example, legal professional privilege can exempt personal data from access-related obligations where the data consists of information over which privilege could be maintained. Legal proceedings can justify certain uses where required or authorised by law, court order, legal proceedings, or establishing, exercising or defending legal rights in Hong Kong. Research and statistics are protected only where data is used for that purpose and the resulting statistics or research are not made available in a form identifying data subjects. The exemption must match the actual processing activity.
Section 2 — Definitions: personal data, data subject, data user, processing, use, prescribed consent and third party.
Section 4 and Schedule 1 — Data Protection Principles: purpose and collection, accuracy and retention, use limitation, security, openness, access and correction.
Sections 18-25 — Access and correction requests: data subjects may request access and correction, and data users must handle refusal and notification requirements within the statutory framework.
Section 26 — Erasure: personal data must be erased when it is no longer required for the purpose for which it is used, unless an exception applies.
Section 33 — Cross-border transfers: detailed transfer restriction drafted into the Ordinance, but marked as not yet in operation.
Sections 35C-35M — Direct marketing: prior notification, consent, free response channel, cessation rights, and separate rules for providing data to another person for direct marketing.
Sections 36-50B — Commissioner powers: inspections, complaints, investigations, reports, enforcement notices and offences for non-compliance with enforcement notices.
Section 64 and Part 9A — Harmful disclosure and doxxing-related offences, investigation powers, cessation notices and injunctions.
Section 66 — Compensation: individuals may seek compensation for damage, including injury to feelings, resulting from a contravention by a data user.
Part 8 — Exemptions: domestic purposes, crime, health, legal professional privilege, legal proceedings, news, research, due diligence and emergency situations.
Hong Kong PDPO compliance is not a GDPR translation exercise. The practical question is whether your organisation can prove that each collection is necessary and fair, each use stays within the notified or directly related purpose, each marketing activity follows the Part 6A consent workflow, each processor is controlled by contract or equivalent means, and each access or correction request can be handled properly. The strongest Hong Kong compliance programmes are built around data flow discipline: collect less, explain clearly, reuse carefully, secure properly, retain only as long as needed, and document the decision before the complaint arrives.