← Global Privacy Laws Research Library
486
Personal Data (Privacy) Ordinance
Personal Data (Privacy) Ordinance: PDPO: Hong Kong
Prepared by Shubhank Suman · Last reviewed
Current
- Legal character
- Ordinance
- Region
- Asia-Pacific
What it covers
The PDPO is Hong Kong's principal personal-data privacy law and applies across the public/private data-user environment.
The PCPD characterises it as a principle-based regime centred on six Data Protection Principles in Schedule 1 (PCPD)
The six principles cover:
1. purpose and manner of collection;
2. accuracy and retention;
3. use;
4. security;
5. openness;
6. access/correction.
Why it matters
Its architecture is distinctly principle-based rather than being a long list of prescriptive processing bases.
The six DPPs are designed to govern the personal-data lifecycle from collection through destruction (PCPD)
The Ordinance also operates with:
- codes of practice
- PCPD guidance
- enforcement notices
- complaints/investigations
- direct-marketing rules
- anti-doxxing provisions
- cross-border-transfer provisions.
Refer to it when
- Employee data
- customer data
- biometrics
- direct marketing
- security
- access/correction
- data processor arrangements
- cross-border transfers
- database governance.
AI, privacy and cybersecurity relevance
- AI: High
- Privacy: Very High
- Cyber: High
AI
Moderate/High.
There is no dedicated AI statute inside the PDPO.
AI systems nevertheless come within its technology-neutral personal-data framework when they collect, use, infer, analyse or disclose personal information.
AI use cases particularly relevant to the PDPO include:
- facial recognition
- employee monitoring
- behavioural profiling
- automated marketing
- AI analytics
- customer scoring.
Cybersecurity
High.
DPP4 is the central security principle.
The PCPD also issues practical security and technology guidance.
Applicability
The Ordinance applies to personal data and covered data users in Hong Kong.
It operates alongside sectoral rules and PCPD codes/guidance.
Current validity
CURRENT.
The Ordinance has undergone substantial amendments, including the 2012 privacy amendments and later anti-doxxing reforms.
Read first
Schedule 1 DPP1–DPP6 → security/DPP4 → access/correction → direct marketing → Section 33 status → enforcement.
Provisions / sections covered
Schedule 1: Six DPPs
This is the most important part of the Ordinance.
DPP1: Collection
Data should be collected lawfully, fairly and for purposes connected with the functions of the data user.
DPP2: Accuracy/retention
Data should be accurate and should not be retained longer than necessary.
DPP3: Use
Personal data generally should not be used for a purpose unrelated to the purpose for which collected unless applicable requirements are satisfied.
DPP4: Security
Requires practical steps to protect personal data against unauthorised or accidental access, processing, erasure, loss or (PCPD)
DPP5: Openness
Requires transparency regarding policies and practices.
DPP6: Access
Provides the access/correction framework.
Section 18 and related provisions
Provide the operational data-access rights.
Section 33: Cross-border transfer
Section 33 contains the statutory framework for transfers of personal data outside Hong Kong. The PCPD has described the provision as imposing restrictions on overseas transfers subject to specified conditions (PCPD)
Important status note: official PCPD material has stated that Section 33 was not yet in operation. The Research Library should therefore not automatically label Section 33 as an operative general cross-border-transfer restriction without displaying its commencement status (PCPD)
Subject-matter tags
- Consent
- Erasure and deletion
- Profiling
- Security
- Cross-border transfers
- Data protection officer
- Controller and processor
- Direct marketing
- Biometrics
- Employment data
- Retention
- Enforcement and penalties
- Surveillance
- Facial recognition
- Transparency
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.