Hong Kong. Comprehensive data protection. Ordinance
PDPOPersonal Data (Privacy) Ordinance (Cap. 486)
In force
§1Summary
- Synopsis
Hong Kong's principles-based privacy law built around six Data Protection Principles covering collection, accuracy and retention, use, security, openness and access. It has detailed direct-marketing consent rules and criminal offences, and the PCPD enforces through enforcement notices.
- Key themes
- Unique features
No statutory breach notification or administrative fines; cross-border restriction (s33) enacted but never brought into force.
- SaaS relevance
Applies to data users controlling personal data in or from Hong Kong; processors are regulated only indirectly via contract.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- None mandatory (voluntary PCPD guidance)
- DPO
- No
- Cross-border transfers
- s33 not in force; PCPD recommended model clauses; voluntary GBA standard contract
- Maximum penalty
- HK$1m and 5 years' imprisonment (direct marketing / doxxing causing harm)
§3Dates
- Key dates
- Adopted
- In force
- Amended 2012 (direct marketing) and 2021 (doxxing); s33 transfer restriction never commenced; reform proposals (mandatory breach notice, processor regulation, higher fines) under study since 2020 with no bill as of Oct 2026
§4Text and authority
- Text
- Authoritative text elegislation.gov.hk
- Authority
- Office of the Privacy Commissioner for Personal Data (PCPD)
§5Where it applies
- Domestic law of
- Hong Kong
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Jan 2025: government told LegCo it was still studying amendments, possibly phased. Commencement day 1996-12-20 from general knowledge.