Privacy Map

Asia. National jurisdiction.

Hong Kong HK

Primary authority: Office of the Privacy Commissioner for Personal Data (PCPD)
Part I

Domestic law

Comprehensive data protection1

  • PDPOPersonal Data (Privacy) Ordinance (Cap. 486)In force
    In force from     Hong Kong's principles-based privacy law built around six Data Protection Principles covering collection, accuracy and retention, use, security, openness and access. It has detailed direct-marketing consent rules and criminal offences, and the PCPD enforces through enforcement notices.
    Synopsis

    Hong Kong's principles-based privacy law built around six Data Protection Principles covering collection, accuracy and retention, use, security, openness and access. It has detailed direct-marketing consent rules and criminal offences, and the PCPD enforces through enforcement notices.

    Key themes
    • six DPPs
    • direct marketing consent
    • data access requests
    • enforcement notices
    • doxxing offences
    Unique features

    No statutory breach notification or administrative fines; cross-border restriction (s33) enacted but never brought into force.

    SaaS relevance

    Applies to data users controlling personal data in or from Hong Kong; processors are regulated only indirectly via contract.

    Extraterritorial
    Limited
    Breach notification
    None mandatory (voluntary PCPD guidance)
    DPO
    No
    Cross-border transfers
    s33 not in force; PCPD recommended model clauses; voluntary GBA standard contract
    Maximum penalty
    HK$1m and 5 years' imprisonment (direct marketing / doxxing causing harm)
    Key dates
    • Adopted
    • In force
    • Amended 2012 (direct marketing) and 2021 (doxxing); s33 transfer restriction never commenced; reform proposals (mandatory breach notice, processor regulation, higher fines) under study since 2020 with no bill as of Oct 2026
    Text
    Authority
    Office of the Privacy Commissioner for Personal Data (PCPD)
    Sources consulted
    Verification

    High confidence.

    Jan 2025: government told LegCo it was still studying amendments, possibly phased. Commencement day 1996-12-20 from general knowledge.

    Full record for PDPO

Sectoral privacy1

  • PDPO Doxxing AmendmentPersonal Data (Privacy) (Amendment) Ordinance 2021In force
    In force from     Creates two-tier criminal offences for disclosing personal data without consent with intent or recklessness as to harm (doxxing). It gives the PCPD powers to investigate, prosecute and serve cessation notices on platforms, including those outside Hong Kong.
    Synopsis

    Creates two-tier criminal offences for disclosing personal data without consent with intent or recklessness as to harm (doxxing). It gives the PCPD powers to investigate, prosecute and serve cessation notices on platforms, including those outside Hong Kong.

    Key themes
    • doxxing
    • cessation notices
    • criminal investigation
    • platform takedown
    Unique features

    Cessation notices can be served on overseas online platforms serving Hong Kong users.

    SaaS relevance

    Platforms hosting user content accessible in Hong Kong may receive PCPD takedown (cessation) notices.

    Extraterritorial
    Yes
    Maximum penalty
    HK$1m and 5 years where harm caused; non-compliance with cessation notice HK$50k–100k and 2 years
    Key dates
    • Adopted
    • In force
    Text
    Authority
    Office of the Privacy Commissioner for Personal Data (PCPD)
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Exact gazettal/commencement days from general knowledge; source confirms October 2021 commencement. [Link: official English enacted Ordinance (Ord. No. 32 of 2021, LegCo copy); consolidated text in Cap. 486 on elegislation.gov.hk]

    Full record for PDPO Doxxing Amendment
    Partly verifiedMedium confidence. Exact gazettal/commencement days from general knowledge; source confirms October 2021 commencement. [Link: official English enacted Ordinance (Ord. No. 32 of 2021, LegCo copy); consolidated text in Cap. 486 on elegislation.gov.hk]

Cybersecurity1

  • PCICSOProtection of Critical Infrastructures (Computer Systems) OrdinanceIn force
    In force from     Imposes organisational, preventive and incident-reporting duties on designated operators of critical infrastructure and their critical computer systems. It is separate from the PDPO.
    Synopsis

    Imposes organisational, preventive and incident-reporting duties on designated operators of critical infrastructure and their critical computer systems. It is separate from the PDPO.

    Key themes
    • critical infrastructure
    • incident reporting
    • security audits
    • risk assessments
    Unique features

    Hong Kong's first statutory cybersecurity regime; obligations attach only to designated operators.

    SaaS relevance

    SaaS vendors to designated CI operators will see contractual flow-down of security and reporting duties.

    Key dates
    • Adopted
    • In force
    Text
    Authority
    Commissioner's Office under the Security Bureau
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Enactment year 2025 from general knowledge; full effect 2026-01-01 per DLA Piper. [Link: official bilingual Cap. 653 on HK e-Legislation (site blocks bots; confirmed via data.gov.hk index); authority = Office of the Commissioner of CI (Computer-system Security)]

    Full record for PCICSO
    Partly verifiedMedium confidence. Enactment year 2025 from general knowledge; full effect 2026-01-01 per DLA Piper. [Link: official bilingual Cap. 653 on HK e-Legislation (site blocks bots; confirmed via data.gov.hk index); authority = Office of the Commissioner of CI (Computer-system Security)]

Data localisation / cross-border1

  • GBA Standard ContractStandard Contract for Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)In force
    In force from     A voluntary simplified contract mechanism for personal information flows between nine Mainland GBA cities and Hong Kong. It lets parties use a filed template instead of the full PIPL export routes for qualifying flows.
    Synopsis

    A voluntary simplified contract mechanism for personal information flows between nine Mainland GBA cities and Hong Kong. It lets parties use a filed template instead of the full PIPL export routes for qualifying flows.

    Key themes
    • GBA
    • standard contract
    • filing
    • cross-boundary transfers
    Unique features

    Region-specific transfer mechanism bridging PIPL and the PDPO.

    SaaS relevance

    SaaS groups with Shenzhen/Guangzhou and Hong Kong entities can use it for intra-GBA PI flows.

    Cross-border transfers
    Voluntary template with filing
    Key dates
    • Adopted
    • In force
    • Extended to all sectors from November 2024
    Text
    Authority
    PCPD / Innovation, Technology and Industry Bureau with CAC
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Launch date (Dec 2023) from general knowledge; extension to all sectors from Nov 2024 confirmed by DLA Piper. [Link: official English text on PCPD (bot-check on direct fetch; confirmed in search results)]

    Full record for GBA Standard Contract
    Partly verifiedMedium confidence. Launch date (Dec 2023) from general knowledge; extension to all sectors from Nov 2024 confirmed by DLA Piper. [Link: official English text on PCPD (bot-check on direct fetch; confirmed in search results)]
Part II

Regional & international frameworks

Membership-based — check ratification status in the instrument record. 2 instruments from 1 bodies.

Asia-Pacific Economic Cooperation (APEC)

  • APEC CBPR / PRPAPEC Cross-Border Privacy Rules (CBPR) System and Privacy Recognition for Processors (PRP) SystemIn force
    In force from     Voluntary, enforceable certification schemes. CBPR certifies that a controller's privacy policies meet the APEC Privacy Framework, and PRP certifies a processor's ability to help controllers comply. Recognised Accountability Agents assess companies, and local privacy enforcement authorities back up enforcement.
    Synopsis

    Voluntary, enforceable certification schemes. CBPR certifies that a controller's privacy policies meet the APEC Privacy Framework, and PRP certifies a processor's ability to help controllers comply. Recognised Accountability Agents assess companies, and local privacy enforcement authorities back up enforcement.

    Key themes
    • certification
    • accountability agents
    • cross-border enforcement
    • processors
    Unique features

    It is one of the few certification-based transfer tools recognised by several national laws (e.g. Japan, Singapore).

    SaaS relevance

    PRP is designed for SaaS and other processors, and CBPR or PRP certification can support transfers and customer due diligence in participating economies.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Certification-based transfer mechanism
    Maximum penalty
    Decertification; enforcement under local law
    Key dates
    • Adopted
    • In force
    • CBPR endorsed by APEC Leaders in 2011, first certifications 2013; PRP launched 2015. Since 2022–25 the systems have been mirrored by the separately administered Global CBPR and Global PRP (see separate row).
    Text
    Authority
    Participating economies' privacy enforcement authorities; APEC-recognised Accountability Agents
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The years are from established references. I did not check whether APEC is winding down its own system in favour of the Global systems.

    Full record for APEC CBPR / PRP
    Partly verifiedMedium confidence. The years are from established references. I did not check whether APEC is winding down its own system in favour of the Global systems.
  • APEC Privacy FrameworkAPEC Privacy FrameworkIn force
    In force from     A non-binding set of nine information privacy principles for the 21 APEC economies, adapted from the OECD Guidelines: preventing harm, notice, collection limitation, uses, choice, integrity, security safeguards, access and correction, and accountability. It aims to protect privacy while keeping information flowing across the region.
    Synopsis

    A non-binding set of nine information privacy principles for the 21 APEC economies, adapted from the OECD Guidelines: preventing harm, notice, collection limitation, uses, choice, integrity, security safeguards, access and correction, and accountability. It aims to protect privacy while keeping information flowing across the region.

    Key themes
    • preventing harm
    • notice
    • choice
    • accountability
    • cross-border privacy enforcement
    • interoperability
    Unique features

    Its harm-based, accountability-led model contrasts with the rights-based European approach. It is the basis of the CBPR and PRP certification systems.

    SaaS relevance

    It underpins CBPR and PRP certifications, which SaaS providers can use to show compliance and support transfers in participating economies.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Accountability-based; CBPR system
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Endorsed by APEC Ministers in 2004 and published in 2005; updated in 2015 (endorsed 2016)
    Text
    Authority
    APEC Digital Economy Steering Group (DESG) Data Privacy Subgroup
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. I did not re-check the publication URL this session.

    Full record for APEC Privacy Framework
    Partly verifiedMedium confidence. I did not re-check the publication URL this session.