Regulations › Rest of world › Hong Kong SAR
PDPO
Personal Data (Privacy) Ordinance (Cap. 486)
WhenIn effect since 20 December 1996
Who enforces itOffice of the Privacy Commissioner for Personal Data (PCPD)
Who it applies toAny person who controls the collection, holding, processing or use of personal data in or from Hong Kong.
Tell the regulatorNo mandatory notification
DPO requiredNo DPO requirement
RegistrationData user return scheme exists but has not been activated for any class of data user
Transfers abroadNo transfer restriction in force
Request deadlineComply with a data access request within 40 days
Maximum fineCriminal fines up to HKD 1,000,000 (about USD 128k) for doxxing causing harm or selling data f…
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
1
Applies to data users controlling data in or from Hong Kong; no express reach over foreign businesses targeting Hong Kong residents.s.2(1) 'data user'; s.33 not in force · source ↗
Lawful basis
1
No lawful-basis list; collection must be lawful, fair and for a purpose directly related to the data user's functions.Sch. 1 DPP1 · source ↗
Consolidated text read was truncated after s.35B; this provision cited from the Ordinance without re-reading.
Consent
1
Prescribed consent (express and voluntary) needed to use data for a new purpose.s.2(3); Sch. 1 DPP3 · source ↗
Children
0
No age threshold or children-specific consent rule.None · source ↗
Parents may make access requests for minors (s.18).
People's rights
Marketing
3
Consent (incl. 'no objection') required before using or providing personal data for any direct marketing; oral consent confirmed in writing within 14 days.ss.35C, 35E · secondary source · source ↗
Penalty up to HKD 500,000 and 3 years.
Governance
Registration
0
Data user return scheme exists but has not been activated for any class of data user.s.14 · source ↗
Records
1
Log book required only for refused access or correction requests, kept 4 years.s.27 · source ↗
Retention
2
Do not keep data longer than necessary and take practicable steps to erase it.s.26; Sch. 1 DPP2(2) · source ↗
Breaches
Tell the regulator
0
No mandatory notification; voluntary notice to PCPD encouraged.None · secondary source · source ↗
Government proposed mandatory breach notification (Jan 2025); no bill enacted as of 18 Oct 2026 found.
Transfers
Transfers abroad
0
No transfer restriction in force; s.33 never commenced. PCPD recommends model contract clauses.s.33 (not in operation) · source ↗
Enforcement
Maximum fine
2
Criminal fines up to HKD 1,000,000 (about USD 128k) for doxxing causing harm or selling data for marketing.ss.35J, 64(3D) · secondary source · source ↗
No administrative fines.
Criminal liability
2
Imprisonment up to 5 years for doxxing causing harm or providing data for direct marketing for gain; contravening enforcement notices also an offense.ss.35J, 50A, 64 · secondary source · source ↗
s.35J and s.50A amounts from recall.
Private action
2
Individuals suffering damage, including injury to feelings, may claim compensation; PCPD may give legal assistance.ss.66, 66B · source ↗
Consolidated text read was truncated after s.35B; this provision cited from the Ordinance without re-reading.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws