Hong Kong: PDPO and Related Guidance
The Personal Data (Privacy) Ordinance (Cap. 486) is built on six Data Protection Principles.
The six DPPs
- DPP1: lawful and fair collection, adequate but not excessive, with prescribed notification of purpose, voluntariness, consequences, transferees, and access/correction rights.
- DPP2: accuracy and retention.
- DPP3: use limited to the original purpose or prescribed consent.
- DPP4: security.
- DPP5: openness about policies and practices.
- DPP6: access and correction; a data subject access request must be complied with within 40 days, and any fee must not be excessive.
Regulator and enforcement
The PCPD issues guidance and enforcement notices. Breaching a DPP is not itself a criminal offence; failing to comply with an enforcement notice is. Section 64, added in 2021, criminalizes doxxing with intent to cause harm.
Cross-border
Section 33 is not in operation. Transfers are governed by PCPD guidance: due diligence, contractual safeguards, and DPP3 where data is used overseas.
Worked example
An HK insurer wants to use policyholder data for a new cross-selling purpose with an overseas affiliate. DPP3 requires prescribed consent (express, voluntary, informed) for the new use, and the transfer should follow PCPD guidance: assess the affiliate's protections and contract for security.
Traps
- Assuming section 33 is in force.
- Treating every DPP breach as criminal.
- Confusing a data user (controller) with a data processor; processors are not directly liable under the DPPs.