Data Privacy Compliance for Hong Kong Companies: A Practical Guide

Introduction: What This Guide Covers

Hong Kong's data privacy regime is governed by the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO"), enforced by the Office of the Privacy Commissioner for Personal Data (PCPD) . Every company that collects, holds, processes, or uses personal data in Hong Kong must comply. This guide provides the practical steps, costs, timelines, and suitability criteria for achieving compliance.

Under section 4 of the PDPO, "a data user shall not do an act, or engage in a practice, that contravenes a data protection principle." The six Data Protection Principles (DPPs) form the core of the ordinance.

1. ELIGIBILITY: Who Must Comply?

Every company that collects, holds, processes, or uses personal data in or from Hong Kong must comply with the PDPO. There is no exemption based on company size, turnover, or industry.

Who qualifies as a "data user"?

Under section 2(1) of the PDPO, a "data user" means "a person who, either alone or jointly or in common with other persons, controls the collection, holding, processing or use of personal data."

This includes:

• All Hong Kong companies (private, public, sole proprietorships, partnerships)
• Non-Hong Kong companies that collect personal data of Hong Kong data subjects
• Employers holding employee personal data
• E-commerce operators collecting customer data
• Property management companies holding tenant data

Who is exempt?

Limited exemptions apply under Part VIII of the PDPO:

• Domestic purposes (section 52): Personal data held for personal, family, or household affairs
• Employment references (section 58A): Certain employment references
• Crime prevention and detection (section 58): Law enforcement purposes

Key point: There is no "small business exemption." A sole trader with 10 customer records is subject to the same DPPs as a multinational corporation.

2. TIMELINES: How Long Does Compliance Take?

Compliance is not a one-off event but an ongoing process. Below are realistic timelines for initial compliance implementation.

Initial compliance setup timeline

Ongoing compliance timelines

• Annual review: Conduct a full compliance review every 12 months
• Breach notification: Under the amended PDPO (2025), data users must notify the PCPD of a data breach as soon as practicable after becoming aware of it
• Data subject access requests (DSARs): Must be responded to within 40 calendar days (section 19(1))

The PCPD's "Guidance on Data Breach Handling" states: "A data user should notify the PCPD of a data breach as soon as practicable after becoming aware of the breach."

3. COST METRICS: Exact Fees and Budget Estimates

Compliance costs vary based on company size, data volume, and whether you use external consultants. Below are specific, verifiable costs.

Government and statutory fees

External compliance costs (estimated market rates)

Important: These are market estimates. Consult the latest fee schedules from professional service providers. The PCPD does not set or regulate private consultancy fees.

Ongoing Compliance Execution

Ongoing statutory obligations are handled seamlessly through Captime's dedicated Hong Kong company secretary service, providing a licensed local representative and automated annual return management.

4. SUITABILITY: Who Is This For vs. Not For?

Best suited for

Less suited for (consider alternative approaches)

5. The Six Data Protection Principles: A Practical Breakdown

Every compliance programme must address the six DPPs under Schedule 1 of the PDPO.

DPP1 – Purpose and Manner of Collection

BLUF: You must collect personal data for a lawful purpose directly related to your function, and the collection must be necessary and fair.

• Action: Draft a PICS that states the purpose of collection, the classes of data subjects, and whether data will be transferred
• Example: "We collect your email address to send order confirmations. We do not share it with third parties for marketing."

DPP2 – Accuracy and Duration of Retention

BLUF: You must take reasonably practicable steps to ensure data is accurate and not kept longer than necessary.

• Action: Create a data retention schedule. For example, customer records: 7 years after last transaction (for tax purposes); employee records: 7 years after termination
• Note: The PCPD recommends deleting data once the purpose is fulfilled

DPP3 – Use of Personal Data

BLUF: Personal data must not be used for a new purpose without the data subject's prescribed consent.

• Action: Obtain explicit consent before using data for marketing, profiling, or any purpose not stated in the original PICS
• Exception: "New purpose" means any purpose other than the original collection purpose

DPP4 – Security of Personal Data

BLUF: You must take all reasonably practicable steps to protect personal data from unauthorised or accidental access, processing, erasure, loss, or use.

• Action: Implement:
  • Encryption for data at rest and in transit
  • Access controls (role-based)
  • Regular security audits
  • Staff training on data handling

DPP5 – Information to Be Generally Available

BLUF: You must make available the kinds of personal data you hold, the main purposes for which it is used, and your data access and correction policies.

• Action: Publish a privacy policy on your website and make it available at your physical premises

DPP6 – Access to Personal Data

BLUF: Data subjects have the right to access and correct their personal data held by you.

• Action: Establish a DSAR procedure. Respond within 40 calendar days. You may charge a reasonable fee (check the latest PCPD guidance on fee caps)

6. Practical Compliance Steps: A Checklist

1. Conduct a data audit: Map all personal data you collect, hold, process, and transfer. Identify data flows, storage locations, and third-party processors.
2. Draft a privacy policy: Publish on your website and make available at your premises. Include: types of data collected, purposes, retention periods, data subject rights, and contact details.
3. Create PICS for each collection point: Use at point of data collection (e.g., online forms, in-store sign-ups, employment contracts).
4. Implement data security measures: Encrypt data, restrict access, conduct regular security reviews.
5. Train staff: All employees handling personal data must understand their obligations under the PDPO.
6. Establish a DSAR procedure: Designate a person to handle access requests. Set up a tracking system.
7. Create a data breach response plan: Include steps for containment, investigation, notification to PCPD, and communication with affected data subjects.
8. Review annually: Update policies, re-train staff, and conduct a compliance audit.

7. Common Compliance Pitfalls and How to Avoid Them

8. Enforcement and Penalties

The PCPD has the power to:

• Investigate complaints (section 38)
• Issue enforcement notices (section 50) — non-compliance is an offence
• Prosecute offences — maximum fine of HKD 50,000 and imprisonment for 2 years (section 64)
• Impose direct marketing sanctions — up to HKD 500,000 fine and 3 years imprisonment (section 35G)

Under section 50(1) of the PDPO, "where the Commissioner is of the opinion that a data user is contravening or has contravened a requirement under this Ordinance, the Commissioner may serve on the data user an enforcement notice."

Practical note: Most enforcement actions result from complaints. Proactive compliance significantly reduces risk.

9. Frequently Asked Questions

Q: Do I need to register as a data user with the PCPD? A: No. Hong Kong does not have a mandatory data user registration system. However, you must comply with all DPPs.

Q: What is the deadline for responding to a data subject access request? A: 40 calendar days from receipt of the request (section 19(1) of the PDPO).

Q: Do I need a Data Protection Officer (DPO)? A: The PDPO does not mandate a DPO. However, appointing one is best practice, especially for companies handling large volumes of personal data.

Q: What happens if I fail to notify the PCPD of a data breach? A: From 1 October 2025, failure to notify a data breach may result in an enforcement notice and potential prosecution. The PCPD can impose fines and imprisonment for non-compliance.

Q: Does the PDPO apply to personal data of non-Hong Kong residents? A: Yes, if the data is collected, held, processed, or used in or from Hong Kong. The PDPO has territorial application.

10. Resources and Further Reading

• PCPD Official Website: www.pcpd.org.hk
• PDPO (Cap. 486): Available on the Hong Kong e-Legislation website
• PCPD Guidance Notes: "Data Breach Handling," "Data Access Requests," "Direct Marketing"
• HSIC Codes: If your business involves data processing services, the relevant HSIC code is HSIC 631200 - Data processing, hosting and related activities

Conclusion

Data privacy compliance under the PDPO is a legal requirement for every Hong Kong company that handles personal data. The six DPPs provide a clear framework: collect data lawfully, keep it accurate and secure, use it only for stated purposes, and respect data subjects' rights. Start with a data audit, draft your policies, train your staff, and review annually. The cost of non-compliance — fines, reputational damage, and legal action — far outweighs the investment in getting it right.

-> Use the HSIC Code Finder at /hsic-finder to look up your specific code if your business involves data processing activities.