Meet Hong Kong PDPO obligations with evidence you can show

The PDPO is the Personal Data (Privacy) Ordinance (Cap. 486), Hong Kong's main data protection law. It was enacted in 1995 and came into force on 20 December 1996. It requires data users to comply with six Data Protection Principles covering collection, accuracy and retention, use, security, openness and data access. The Privacy Commissioner for Personal Data (PCPD) oversees it and can investigate complaints and issue enforcement notices.

Every data user must comply with the PDPO. A data user is any person or organisation, public or private, that alone or with others controls the collection, holding, processing or use of personal data. There is no size threshold or sector exemption, so small businesses, charities and government bodies are all covered. Overseas organisations can also be caught when they control personal data in or from Hong Kong.

The six Data Protection Principles in Schedule 1 of the PDPO are: DPP1 purpose and manner of collection; DPP2 accuracy and duration of retention; DPP3 use of personal data; DPP4 security of personal data; DPP5 information to be generally available; and DPP6 access to personal data. Section 4 requires data users not to contravene them. Together they set the core rules for handling personal data in Hong Kong.

Breaching a Data Protection Principle is not itself a crime, but the PCPD can issue an enforcement notice. Contravening an enforcement notice is an offence, with a fine at level 5 and two years' imprisonment on first conviction, plus daily penalties. Direct marketing and unauthorised disclosure offences carry fines of up to HK$1,000,000 and up to five years' imprisonment. Individuals can also claim compensation under section 66.

No, the PDPO does not currently impose a mandatory data breach notification duty. The PCPD encourages data users to notify it and affected individuals voluntarily, and provides a breach notification form. Organisations should still have an incident response process, because a breach usually indicates a possible contravention of DPP4 on security, which the PCPD can investigate and act on through an enforcement notice.

The PDPO and GDPR share similar ideas, such as purpose limitation, accuracy, security and individuals' rights of access and correction. The PDPO is narrower: it has no general administrative fines, no mandatory breach notification and no statutory data protection officer role, and its cross-border transfer restriction in section 33 is not yet in operation. Controls built for GDPR usually cover most PDPO requirements.

You comply with the PDPO by building a privacy programme around the six Data Protection Principles. In practice that means mapping the personal data you hold, giving collection notices, limiting use to the original purpose, setting retention and erasure rules, securing data and processors, publishing a privacy policy and handling access and correction requests within 40 days. Direct marketing needs specific notice and consent under Part 6A.

Yes. OneClickComply supports the Hong Kong PDPO today. The platform maps the six Data Protection Principles to practical controls, collects evidence automatically from connected tools, generates privacy policies with AutoComplete and monitors security controls continuously. Our in-house audit team can answer PDPO questions through Ask an Auditor. OneClickComply helps you build and evidence your programme, but compliance remains your organisation's responsibility.