Hong Kong Personal Data (Privacy) Ordinance (PDPO)
- ClassificationCategoryData Protection & PrivacyDomainPrivacyFramework FamilyGlobal Privacy Regulations
- Regulatory ContextTypeRegulationLegal InstrumentOrdinanceSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionAsia-PacificRegion DetailHong KongPublisherLegislative Council of Hong Kong (enacted); enforced by the Privacy Commissioner for Personal Data (PCPD)
- VersioningVersionCap. 486, as amended by the 2012 and 2021 Amendment OrdinancesEffective DateDecember 20, 1996Issue DateAugust 3, 1995
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityMedium
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
The Ordinance is public legislation published on the Hong Kong e-Legislation site, and the PCPD publishes an overview and the six principles for free. The text is included with the platform for reference.
Framework text is licensed by its publisher and is included only where stated above.
- Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) has been in force since December 20, 1996.
- It binds every data user, public or private, that controls the collection, holding, processing, or use of personal data.
- Its core is six Data Protection Principles: collection, accuracy and retention, use, security, openness, and access and correction.
- The Privacy Commissioner for Personal Data enforces it through investigations and enforcement notices; ignoring a notice is an offense.
- There is no statutory breach notification, and the section 33 limit on transfers outside Hong Kong is not in operation.
Overview
The Personal Data (Privacy) Ordinance (PDPO, Cap. 486) is Hong Kong's data protection law. It binds every data user, public or private, that controls the collection, holding, processing or use of personal data, and it has been in force since 20 December 1996.
The Legislative Council enacted the Ordinance on 3 August 1995, and the Privacy Commissioner for Personal Data, supported by the Office of the PCPD, enforces it (section 5). Its core is the six Data Protection Principles in Schedule 1: collection, accuracy and retention, use, security, openness, and access to and correction of data. Contravening a principle is not itself an offense, but the Commissioner can investigate and serve an enforcement notice (section 50), and ignoring that notice is an offense (section 50A).
Organizations apply the Ordinance by building the principles into collection notices, vendor contracts, retention schedules, security controls and request handling. Specific rules sit on top: Part 5 for data access and correction requests, Part 6A for direct marketing, and sections 64 and 66D to 66O for doxxing. Statutory breach notification does not exist, and the section 33 limit on transfers outside Hong Kong is not in operation.
Why does it matter?
Hong Kong's regime is principle-based and technology-neutral, so one set of controls has to cover every system that holds personal data. Enforcement runs through the Commissioner's investigations and enforcement notices, criminal offenses for specified conduct, and civil claims for damage.
Key benefits include:
- Six principles cover the data lifecycle
Schedule 1 applies to the private and public sectors alike, from collection (Principle 1) to access and correction (Principle 6).
- Enforcement notices carry criminal exposure
A data user that contravenes an enforcement notice faces a fine of HK$50,000 and two years in prison on a first conviction, with a daily penalty of HK$1,000 (section 50A).
- Direct marketing needs informed consent
Part 6A (sections 35A to 35M) requires consent before personal data is used in direct marketing or provided to others for it. Penalties reach HK$500,000 and three years, or HK$1,000,000 and five years where data is provided for gain.
- Doxxing is a crime
Section 64(3A) to (3D) creates two offenses for disclosing personal data without consent to cause harm, with up to HK$1,000,000 and five years where harm results.
- Civil claims for compensation
A person who suffers damage from a data user's contravention, including injury to feelings, can claim compensation (section 66).
How does it work?
The Ordinance has ten numbered Parts plus Parts 6A and 9A. Part 2 sets up the Commissioner (section 5) and the advisory committee (section 11). Part 3 covers approved codes of practice (section 12). Part 5 governs data access and correction requests, Part 6A direct marketing, Part 7 inspections, complaints and investigations (sections 36 to 50B), and Part 8 the exemptions (sections 51 to 63D). Part 9 deals with offenses and compensation, and Part 9A with the doxxing investigation powers.
A data user must answer a data access request within 40 days, either supplying a copy or saying in writing that it holds no data (section 19). A refusal must be notified in writing within the same 40 days with reasons (sections 20 and 21), and a valid correction request must be met within 40 days (section 23). Section 26 requires all practicable steps to erase personal data that is no longer required.
A data processor, meaning a person who processes personal data for another and not for its own purposes, is not directly regulated. The data user must use contractual or other means to stop the processor keeping data longer than necessary (Principle 2(3)) and to prevent unauthorized or accidental access, processing, erasure, loss or use (Principle 4(2)).
Key Elements
- Principle 1: purpose and manner of collection
Collect only for a lawful purpose directly related to the data user's function, by lawful and fair means, with data that is adequate but not excessive. When collecting from the individual, take all practicable steps to say whether supply is obligatory or voluntary, the purpose, the classes of transferees and the access and correction contact.
- Principle 2: accuracy and retention
Take all practicable steps to keep data accurate and not to keep it longer than necessary for the purpose, including when a data processor holds it.
- Principle 3: use of personal data
Do not use data for a new purpose without the prescribed consent of the data subject; a relevant person may consent for a minor or an incapacitated person only where use is clearly in that person's interest.
- Principle 4: security of personal data
Protect data against unauthorized or accidental access, processing, erasure, loss or use, having regard to the kind of data, storage location, security measures, staff integrity and secure transmission.
- Principle 5: information to be generally available
Make policies and practices, the kinds of data held and the main purposes of use available to anyone who asks.
- Principle 6: access to personal data
A data subject may ask whether a data user holds their data, request access within a reasonable time, at a fee that is not excessive, in a reasonable manner and an intelligible form, be given reasons for a refusal and object to it, and request correction.
What does it cover?
The Ordinance applies to any person that controls the collection, holding, processing or use of personal data relating to a living individual, in the public and private sectors. Data processors are not directly regulated. Section 33, which would restrict transfers of personal data outside Hong Kong, is marked not yet in operation in the official text, so the Ordinance has no statutory transfer ban in force today.
What are its objectives?
The Ordinance gives Hong Kong data users five practical aims.
Make personal data collection fully informed and fair, and keep the amount collected to what is needed.
Keep data accurate, secure and no longer than necessary, including when a processor holds it.
Limit use of data to the original or a directly related purpose unless the data subject gives prescribed consent.
Give individuals a right to access and correct their data within 40 days.
Give the Commissioner powers to investigate, serve enforcement notices and, for doxxing, prosecute and demand removal of content (sections 50, 64C and 66M).
Framework in Context
The Ordinance grew out of the Law Reform Commission's August 1994 report on the protection of personal data, which drew on the OECD Privacy Guidelines of 1980. The PCPD describes it as one of Asia's longest-standing comprehensive data protection laws. Amendment Ordinances changed it in 2012 (direct marketing and legal assistance from 1 April 2013) and 2021 (doxxing, in force 8 October 2021).
Common Framework Mappings
Organizations map the Hong Kong Personal Data (Privacy) Ordinance (PDPO) to other global privacy frameworks to simplify compliance, unify their data protection efforts, and facilitate cross-border data transfers and regulatory recognition.
Mapped frameworks include:
APEC PF
GDPR
ISO 27001:2022
ISO 27701
APPI
NIST Privacy Framework v1.0
PIPEDA
Singapore PDPA
How SmartSuite Supports PDPO
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Privacy Management to hold the six Data Protection Principles, the Part 6A direct marketing rules and the 40-day request deadlines as owned, evidenced obligations, with the processing records, requests and vendor commitments that prove each one.
Personal Data Inventory and Collection Notices
Record what personal data each system holds, the purpose of collection and the notice given on or before collection under Principle 1(3).
Retention and Erasure Schedule
Set retention periods against Principle 2 and section 26, and track erasure tasks and processor retention terms with owners and dates.
Use Limitation and Direct Marketing Consent
Log the purposes each dataset is used for, the consents behind new purposes (Principle 3) and Part 6A marketing consents and opt-outs (sections 35E and 35G).
Access and Correction Request Tracker
Run data access and correction requests against the 40-day deadlines in sections 19 and 23, with refusal reasons and an audit trail.
Processor and Security Safeguards
Track processors and the contractual or other means required by Principles 2(3) and 4(2), plus the security measures and evidence behind Principle 4.
Incident and PCPD Case File
Keep data incident records, the decision whether to notify the PCPD (a recommended practice) and any enforcement notice response in one case record.
Related frameworks
The APEC Privacy Framework (2015) sets nine information privacy principles that APEC economies use to protect personal information while keeping data flowing across the region.
The GDPR (Regulation (EU) 2016/679) sets principles, lawful bases, individual rights and accountability duties for personal data, with fines up to EUR 20 million or 4 percent of turnover.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
ISO/IEC 27018:2025 gives guidelines for protecting PII in public clouds acting as PII processors, built on ISO/IEC 27002:2022 with an extended control set.
ISO/IEC 27701:2025 specifies requirements for a stand-alone privacy information management system (PIMS) for PII controllers and processors, replacing the 2019 edition.
The APPI (Act No. 57 of 2003) is Japan's data protection law, enforced by the PPC, with breach reporting, transfer rules and a 2026 amendment adding surcharges.
Frequently Asked Questions For Hong Kong Personal Data (Privacy) Ordinance (PDPO)
Schedule 1 sets out six principles: purpose and manner of collection, accuracy and duration of retention, use, security, information to be generally available, and access to personal data. They apply to every data user in the public and private sectors. Contravening a principle is not an offense in itself, but the Commissioner can serve an enforcement notice (section 50).
No. The PCPD states that notifying it of a data breach is not a statutory requirement on data users, and recommends doing so as good practice. The PCPD publishes a notification form and a Guidance on Data Breach Handling and Data Breach Notifications.
Section 19 requires a data user to comply within 40 days after receiving the request, by supplying a copy of the data or stating in writing that it holds none. A refusal must be notified in writing within the same 40 days with reasons (section 21), and a correction request is subject to a 40-day limit too (section 23).
Section 33 would prohibit transfers except in specified circumstances, but the e-Legislation text marks it "Not yet in operation", so it is not in force. Data users still have to meet the six principles for transferred data, including Principle 4(2) when a processor outside Hong Kong handles it.
Since 8 October 2021, section 64(3A) makes it an offense to disclose personal data without consent with intent, or recklessness, to cause specified harm. Section 64(3C) covers disclosure that actually causes harm and carries up to HK$1,000,000 and five years. The Commissioner can investigate, prosecute summary offenses and serve cessation notices (section 66M).
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.