Regulations › Rest of world › Hong Kong SAR

PDPO

Personal Data (Privacy) Ordinance (Cap. 486)

In force privacy

WhenIn effect since 20 December 1996

Who enforces itOffice of the Privacy Commissioner for Personal Data (PCPD)

Who it applies toAny person who controls the collection, holding, processing or use of personal data in or from Hong Kong.

Tell the regulatorNo mandatory notification DPO requiredNo DPO requirement RegistrationData user return scheme exists but has not been activated for any class of data user Transfers abroadNo transfer restriction in force Request deadlineComply with a data access request within 40 days Maximum fineCriminal fines up to HKD 1,000,000 (about USD 128k) for doxxing causing harm or selling data f…

If you already comply with

86%

of Hong Kong's 21 requirements are already met by European Union (GDPR). Here is what PDPO adds, biggest gaps first.

MarketingPeople's rightsGap

GDPR2 Absolute right to object to direct marketing; prior consent required for electronic marketing under the ePrivacy Directive, with a customer soft opt-in.

PDPO adds3 Consent (incl. 'no objection') required before using or providing personal data for any direct marketing; oral consent confirmed in writing within 14 days. ss.35C, 35E · source ↗

RetentionGovernanceGap

GDPR1 Storage limitation: keep identifiable data no longer than necessary; erase when no longer needed.

PDPO adds2 Do not keep data longer than necessary and take practicable steps to erase it. s.26; Sch. 1 DPP2(2) · source ↗

Criminal liabilityEnforcementGap

GDPR1 Member States set other penalties, including criminal penalties, for infringements not subject to administrative fines.

PDPO adds2 Imprisonment up to 5 years for doxxing causing harm or providing data for direct marketing for gain; contravening enforcement notices also an offense. ss.35J, 50A, 64 · source ↗

Already covered by GDPR: Reach abroad, Lawful basis, Consent, Sensitive data, Children, Rights, Request deadline, DPO required, DPO qualifications, Registration, DPIA, Records, Tell the regulator, Tell people, Transfers abroad, Localization, Maximum fine, Private action.

A gap means PDPO is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.

Regulations library

Every US state privacy law, on one map

24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.

Explore the map Follow Regulatory Watch

In force
Coming into force
Sector laws

AK ME VT NH WA ID MT ND MN IL WI MI NY RI MA OR NV WY SD IA IN OH PA NJ CT CA UT CO NE MO KY WV VA MD DE AZ NM KS AR TN NC SC DC OK LA MS AL GA HI TX FL