Hong Kong PDPO
Amended Hong Kong · In force Dec 20, 1996 · no upcoming deadlines
Deadlines
| Date | What happens | When |
|---|---|---|
| Oct 8, 20214 years ago | Anti-doxxing amendments take effect | 5 years ago |
| Dec 20, 199629 years ago | PDPO takes effecttentative | 29.8 years ago |
Summaries for reference, not legal advice. Check the official text.
What it does
Hong Kong's privacy law for public and private data users, built on six Data Protection Principles covering collection, accuracy and retention, use, security, openness and access. Amendments in 2012 added direct marketing rules. The 2021 amendment made doxxing a crime and gave the Privacy Commissioner powers to investigate, prosecute and order removal of doxxing content.
- Who it applies to
- Any person in Hong Kong who controls the collection, holding, processing or use of personal data, in both public and private sectors.
- Penalties
- Breaking a DPP is not itself an offence, but breaching an enforcement notice carries up to HK$50,000 and 2 years in prison (HK$100,000 on repeat). Direct marketing offences carry up to HK$500,000 and 3 years, or HK$1 million and 5 years for sale of data. Doxxing carries up to HK$100,000 and 2 years, or HK$1 million and 5 years on indictment.
- Enforced by
- Privacy Commissioner for Personal Data (PCPD)
- Official name
- Personal Data (Privacy) Ordinance (Cap. 486)
- Citation
- Cap. 486
- Topics
- privacy, online-safety
Research notes
Passed in 1995. There is no mandatory breach notification or administrative fining power yet. Reform proposals have not been enacted.
Related
Questions about Hong Kong PDPO
- What are the Hong Kong PDPO compliance deadlines?
- Dec 20, 1996: PDPO takes effect (tentative). Oct 8, 2021: Anti-doxxing amendments take effect.
- When does Hong Kong PDPO take effect?
- Hong Kong PDPO took effect on Dec 20, 1996.
- Who does Hong Kong PDPO apply to?
- Any person in Hong Kong who controls the collection, holding, processing or use of personal data, in both public and private sectors.
- What are the penalties under Hong Kong PDPO?
- Breaking a DPP is not itself an offence, but breaching an enforcement notice carries up to HK$50,000 and 2 years in prison (HK$100,000 on repeat). Direct marketing offences carry up to HK$500,000 and 3 years, or HK$1 million and 5 years for sale of data. Doxxing carries up to HK$100,000 and 2 years, or HK$1 million and 5 years on indictment.