🇭🇰
Hong Kong
Personal Data (Privacy) Ordinance (PDPO)
Asia🔵 Substantial
Compliance Score
50%
7 Addressed
6 Partial
1 None
Authority
Office of the Privacy Commissioner for Personal Data (PCPD)
Overview
Hong Kong's PDPO, in effect since 1996, is Asia's oldest data protection law. The PCPD is an active regulator that enforces compliance through investigations, enforcement notices, and guidance.
14-Topic Coverage Analysis
Data Protection Authority
AddressedConsent Requirements
AddressedData Subject Rights
AddressedCross-Border Transfer
AddressedBreach Notification
PartialDPO Requirements
PartialChildren's Data
PartialPenalties & Enforcement
AddressedSector-Specific Rules
PartialCookie/Tracking
AddressedAI & Automated Decisions
NoneData Localisation
PartialSignificant Data Fiduciary
PartialGovernment Data
Addressed? Frequently Asked Questions
What is the primary data protection law in Hong Kong?+
Hong Kong is governed by the Personal Data (Privacy) Ordinance (PDPO). The law is enforced by the Office of the Privacy Commissioner for Personal Data (PCPD). According to our analysis, the country has a Substantial level of data protection framework.
Does Hong Kong require a Data Protection Officer (DPO)?+
Partially. The Personal Data (Privacy) Ordinance (PDPO) may require a DPO only for specific high-risk organizations or sectors. It is not universally mandatory for all businesses.
What are the data localisation rules in Hong Kong?+
Partially. While Personal Data (Privacy) Ordinance (PDPO) may not mandate general localisation, specific sectoral laws (like finance or health) might require data to be stored locally.
What are the breach notification requirements in Hong Kong?+
The Personal Data (Privacy) Ordinance (PDPO) has limited breach notification requirements. It may only require notifying the regulator, without mandating notification to affected individuals.