{ "jurisdiction_id": "HK", "jurisdiction": "Hong Kong", "url": "https://dataprotection.gi/jurisdictions/hong-kong/", "generator": "render_jid v13-gdpri-1.0.0", "date_modified": "2026-08-05", "schema_version": "gdpri-v2", "counts": { "categories": 10, "claims": 48, "sub_modules": 57, "source_register": 16 }, "categories": [ { "code": "regulator_and_framework", "name": "Regulator & Framework", "traffic_light": "amber", "sub_modules": [ "act_and_instruments", "material_scope", "regulator_and_authority", "regulator_registration_and_filing", "territorial_scope" ], "url": "https://dataprotection.gi/jurisdictions/hong-kong/#regulator-and-framework-regulator-framework", "traffic_light_rationale": "Core regulator/statute framework is well-established (green-equivalent), but material and territorial scope diverge substantially from GDPR baseline, and a registration/filing sub-module could not be evidenced, warranting amber overall.", "claims": [ { "statement": "The Office of the Privacy Commissioner for Personal Data (PCPD) is the main body responsible for overseeing enforcement of the PDPO and is headed by the Privacy Commissioner for Personal Data.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf", "source_tier": null, "observed_at": null }, { "statement": "The Personal Data (Privacy) Ordinance (Cap. 486) came into force on 20 December 1996 and was significantly amended by the 2012 Amendment Ordinance (direct marketing) and the 2021 Amendment Ordinance (anti-doxxing).", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/notes/hong-kong-privacy-overview", "source_tier": null, "observed_at": null }, { "statement": "Data Protection Principle 1(1) requires that only necessary, adequate and not excessive personal data be collected for a lawful purpose, forming part of PDPO's core material-scope obligations on data users.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/new-privacy-requirements-for-direct-marketing-are-you-compliant-", "source_tier": null, "observed_at": null }, { "statement": "The PDPO is unclear on its territorial scope on its face, but the PCPD has clarified that the PDPO does not have extraterritorial scope, in contrast to the GDPR's extraterritorial application.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/gdpr_v._pdpo_.pdf", "source_tier": null, "observed_at": null } ] }, { "code": "lawful_processing_and_special_data", "name": "Lawful Processing & Special Data", "traffic_light": "amber", "sub_modules": [ "consent_thresholds", "lawful_bases", "pseudonymisation_and_anonymisation", "special_categories" ], "url": "https://dataprotection.gi/jurisdictions/hong-kong/#lawful-processing-and-special-data-lawful-processing-special-data", "traffic_light_rationale": "Functional equivalents exist via DPPs and guidance, but the absence of enumerated lawful bases and a codified special-category regime is a material structural gap versus GDPR.", "claims": [ { "statement": "Data Protection Principle 1(1) provides that only necessary, adequate and not excessive personal data is to be collected for a lawful purpose, operating as PDPO's functional lawful-basis analogue.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/new-privacy-requirements-for-direct-marketing-are-you-compliant-", "source_tier": null, "observed_at": null }, { "statement": "Before using or providing personal data for direct marketing, a data user must inform the individual and obtain consent or an indication of no objection, and the individual may opt out at any time irrespective of prior consent.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/hong-kong-amendments-to-hong-kong-personal-data-privacy-ordinance", "source_tier": null, "observed_at": null }, { "statement": "The PCPD has published guidelines flagging Hong Kong identity card numbers, biometric data and consumer credit data as categories requiring special caution in collection and use, in the absence of a codified statutory special-category regime.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf", "source_tier": null, "observed_at": null }, { "statement": "The PDPO does not address sensitive personal data, anonymisation, or pseudonymisation in the statute itself, though the PCPD has clarified aspects of anonymisation through non-binding guidance.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/gdpr_v._pdpo_.pdf", "source_tier": null, "observed_at": null } ] }, { "code": "data_subject_rights", "name": "Data Subject Rights", "traffic_light": "amber", "sub_modules": [ "access_right", "data_portability", "deadlines_and_response_windows", "rectification_and_erasure", "restriction_and_objection" ], "url": "https://dataprotection.gi/jurisdictions/hong-kong/#data-subject-rights-data-subject-rights", "traffic_light_rationale": "Access/rectification rights are well-defined and binding (green-equivalent), but erasure and portability rights are absent, and restriction/objection is narrow — pulling the module to amber overall.", "claims": [ { "statement": "If a data user rejects or denies a data access request, it must inform the requestor within 40 calendar days from receipt of the request and explain why it cannot comply.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf", "source_tier": null, "observed_at": null }, { "statement": "A data correction request must be complied with, and a copy of the corrected personal data provided, within 40 calendar days from receipt under Section 23(1) of the PDPO.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf", "source_tier": null, "observed_at": null }, { "statement": "Unlike the GDPR, the PDPO does not provide data subjects with a general right to request erasure or deletion of their personal data; only general requirements exist relating to erasure once data is no longer required for its original purpose.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/gdpr_v._pdpo_.pdf", "source_tier": null, "observed_at": null }, { "statement": "An individual is entitled to opt out of direct marketing at any time irrespective of having previously given consent, functioning as PDPO's principal objection-type right.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/hong-kong-amendments-to-hong-kong-personal-data-privacy-ordinance", "source_tier": null, "observed_at": null } ] }, { "code": "controller_processor_duties", "name": "Controller/Processor Duties", "traffic_light": "red", "sub_modules": [ "accountability_and_dpia", "breach_notification", "dpo_requirements", "joint_controller_arrangements", "retention_and_disposal", "ropa_requirements", "security_measures" ], "url": "https://dataprotection.gi/jurisdictions/hong-kong/#controller-processor-duties-controller-processor-duties", "traffic_light_rationale": "Multiple GDPR-equivalent accountability pillars (DPIA, DPO, ROPA, mandatory breach notification) are absent from binding law; only security and retention principles and processor-supervision duties are binding.", "claims": [ { "statement": "The PDPO does not explicitly set out accountability requirements for data users and processors; the PCPD instead advocates the Privacy Management Programme, a non-binding strategic framework for building privacy infrastructure, including DPO appointment as best practice.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf", "source_tier": null, "observed_at": null }, { "statement": "Unlike the GDPR, the PDPO does not require Data Protection Officer appointments; the PCPD's Privacy Management Programme guide (as updated 2019) recommends appointment as best practice only.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/gdpr_v._pdpo_.pdf", "source_tier": null, "observed_at": null }, { "statement": "Unlike the GDPR, the PDPO does not require that general data-processing records be maintained; it only requires a log book be maintained in relation to data subject access and correction requests.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/gdpr_v._pdpo_.pdf", "source_tier": null, "observed_at": null }, { "statement": "The 2012 Amendment Ordinance imposes express obligations on a data user to supervise, through contractual and other means, its data processors to ensure PDPO compliance.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/hong-kong-amendments-to-hong-kong-personal-data-privacy-ordinance", "source_tier": null, "observed_at": null }, { "statement": "The PDPO does not stipulate mandatory specific security measures; Data Protection Principle 4 sets only a general, non-prescriptive security-of-processing duty on data users.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf", "source_tier": null, "observed_at": null }, { "statement": "In September 2023, the PCPD issued non-binding recommendations urging organizations to conduct regular data-security risk assessments and adopt measures such as firewalls, encryption, and the least-privilege principle in compliance with DPP4.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/news/hong-kong-pcpd-publishes-recommendations-strengthening", "source_tier": null, "observed_at": null }, { "statement": "The PDPO does not provide for mandatory data breach notifications; the PCPD has instead published non-binding guidance on data breach handling.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/gdpr_v._pdpo_.pdf", "source_tier": null, "observed_at": null }, { "statement": "In a 2020 consultation paper, the Privacy Commissioner and the Constitutional and Mainland Affairs Bureau proposed introducing mandatory data breach notification requirements and data retention periods, with no confirmed timeframe for formal introduction.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/hong-kong-considers-pdpo-amendments/", "source_tier": null, "observed_at": null }, { "statement": "Under DPP2(2) and Section 26 of the PDPO, all practicable steps must be taken to ensure personal data is not kept longer than necessary for the fulfilment of the purpose for which it is or is to be used.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf", "source_tier": null, "observed_at": null } ] }, { "code": "cross_border_and_adequacy", "name": "Cross-Border & Adequacy", "traffic_light": "red", "sub_modules": [ "adequacy_granted", "adequacy_received", "data_localisation", "sccs_and_bcrs", "transfer_impact_assessment", "transfer_mechanisms" ], "url": "https://dataprotection.gi/jurisdictions/hong-kong/#cross-border-and-adequacy-cross-border-adequacy", "traffic_light_rationale": "The central transfer-restriction mechanism is dormant; only voluntary guidance exists, and adequacy/TIA sub-modules could not be evidenced.", "claims": [ { "statement": "Currently, there are no restrictions in effect concerning the cross-border transfer of personal data from Hong Kong, as Section 33 of the PDPO has never been brought into force.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf", "source_tier": null, "observed_at": null }, { "statement": "The PCPD has issued a non-binding Guidance on Personal Data Protection in Cross-Border Data Transfer, recommending voluntary compliance with Section 33 as best practice and signalling a possible future commencement of the transfer restriction.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/hong-kong-puts-restrictions-on-cross-border-transfers-are-you-compliant", "source_tier": null, "observed_at": null }, { "statement": "No timetable has been announced for the implementation of Section 33; it remains the only section of the PDPO yet to come into effect.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf", "source_tier": null, "observed_at": null }, { "statement": "Section 33 of the PDPO does not provide for mechanisms such as binding corporate rules, standard contractual clauses, or codes of conduct, even if it were to come into force.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/gdpr_v._pdpo_.pdf", "source_tier": null, "observed_at": null }, { "statement": "The Outsourcing module (SA-2) of the Hong Kong Monetary Authority's Supervisory Policy Manual requires all authorised institutions to implement proper controls for protection of customer data when entering into an outsourcing arrangement.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf", "source_tier": null, "observed_at": null } ] }, { "code": "sectoral_watch", "name": "Sectoral Watch", "traffic_light": "amber", "sub_modules": [ "credit_and_scoring", "education", "employment_data", "financial_sector_overlay", "health_sector_overlay", "insurance", "telecoms_and_eprivacy" ], "url": "https://dataprotection.gi/jurisdictions/hong-kong/#sectoral-watch-sectoral-watch", "traffic_light_rationale": "Financial-sector overlay is well-evidenced; health, telecoms/ePrivacy, employment, and education sub-modules are thin or unevidenced.", "claims": [ { "statement": "There are no sectoral data privacy laws as such in Hong Kong, but certain industry-specific requirements are imposed by relevant regulators in respect of customer data held by regulated entities.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf", "source_tier": null, "observed_at": null }, { "statement": "The Hong Kong Monetary Authority has issued several circulars and guidelines relating to protection and confidentiality of customer data applicable to all licensed banks under the Banking Ordinance (Cap. 155).", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf", "source_tier": null, "observed_at": null }, { "statement": "Under DPP2(2)/Section 26, employee personal data must not be kept longer than necessary after the end of employment, unless a subsisting reason requires the employer to hold the data longer.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf", "source_tier": null, "observed_at": null }, { "statement": "The PCPD has published guidelines on the collection and use of consumer credit data, requiring caution and setting practical guidance on proper collection and use.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf", "source_tier": null, "observed_at": null }, { "statement": "The Insurance Authority has issued a Guideline on Cybersecurity requiring authorised insurers to implement robust cybersecurity frameworks to protect the personal data of existing or potential policyholders.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf", "source_tier": null, "observed_at": null } ] }, { "code": "adtech_and_commercial_privacy", "name": "AdTech & Commercial Privacy", "traffic_light": "amber", "sub_modules": [ "clean_rooms_and_dcr", "cookies_and_trackers", "cross_context_advertising", "dark_patterns", "direct_marketing", "opt_out_signals" ], "url": "https://dataprotection.gi/jurisdictions/hong-kong/#adtech-and-commercial-privacy-adtech-commercial-privacy", "traffic_light_rationale": "Direct marketing is green-level binding law; the remaining five sub-modules are unevidenced gaps in a jurisdiction with no dedicated ePrivacy/cookie statute.", "claims": [ { "statement": "PCPD guidance states it would be unfair for service application forms to force customers to choose between providing personal data for direct marketing or forgoing the service ('bundled consent'), requiring separate voluntary indications instead.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/new-privacy-requirements-for-direct-marketing-are-you-compliant-", "source_tier": null, "observed_at": null }, { "statement": "Part VIA of the PDPO requires a data user to inform individuals, in an easily understandable and readable manner, of an intention to use or provide their data for direct marketing, specifying the data and marketing types, and to obtain consent or no-objection via a free response channel.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/hong-kong-amendments-to-hong-kong-personal-data-privacy-ordinance", "source_tier": null, "observed_at": null }, { "statement": "Section 35E of the PDPO provides for a fine of up to HK$500,000 and up to three years' imprisonment where personal data is used for direct marketing purposes without the individual's informed consent.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/hong-kongs-first-imprisonment-under-the-personal-data-privacy-ordinance", "source_tier": null, "observed_at": null } ] }, { "code": "algorithmic_biometric_and_surveillance_governance", "name": "Algorithmic, Biometric & Surveillance Governance", "traffic_light": "amber", "sub_modules": [ "ai_risk_assessments", "automated_decision_making_transparency", "biometric_regime", "genetic_data", "profiling_restrictions", "state_surveillance_carveouts" ], "url": "https://dataprotection.gi/jurisdictions/hong-kong/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill", "traffic_light_rationale": "AI governance is active but entirely soft-law; national-security carve-outs materially limit PCPD's supervisory reach; profiling/ADM-transparency/genetic-data sub-modules are unevidenced.", "claims": [ { "statement": "On 11 June 2024, the PCPD published the Artificial Intelligence: Model Personal Data Protection Framework, providing recommendations and best practices for AI governance covering procurement, implementation, and use of AI systems including generative AI, building on its 2021 Guidance on the Ethical Development and Use of AI.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/news/hong-kong-pcpd-publishes-ai-model-personal-data", "source_tier": null, "observed_at": null }, { "statement": "The PCPD's 2024-25 Annual Report describes the AI Model Framework as one of the first explicit regional frameworks for regulating AI, reflecting the Commissioner's stated aim to balance innovation and security in AI.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/from-compliance-to-confidence-key-takeaways-from-the-pcpd-s-2024-25-annual-report", "source_tier": null, "observed_at": null }, { "statement": "PCPD compliance checks on 60 organizations found 80% used AI in daily operations (a 5% increase from 2024), with the PCPD recommending AI governance structures, comprehensive risk assessments, and regular audits as best practice.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/notes-from-the-asia-pacific-region-china-ramps-up-ai-governance", "source_tier": null, "observed_at": null }, { "statement": "The PCPD has published guidelines regarding the collection and use of biometric data, alongside Hong Kong identity cards and consumer credit data, highlighting the need for caution absent a codified statutory biometric regime.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf", "source_tier": null, "observed_at": null }, { "statement": "In relation to the exercise of authorities' powers under the National Security Law, the PCPD's ability to supervise and regulate compliance with the PDPO appears fairly limited, as the NSL expressly takes precedence over inconsistent provisions of other Hong Kong laws.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf", "source_tier": null, "observed_at": null } ] }, { "code": "children_and_vulnerable_groups", "name": "Children & Vulnerable Groups", "traffic_light": "red", "sub_modules": [ "age_verification", "dependent_adults", "education_settings", "minor_profiling_bans", "parental_consent" ], "url": "https://dataprotection.gi/jurisdictions/hong-kong/#children-and-vulnerable-groups-children-vulnerable-groups", "traffic_light_rationale": "This is a legitimate regulatory gap: no comprehensive children/vulnerable-groups regime exists in the PDPO beyond passing references to minors.", "claims": [ { "statement": "The PDPO makes references to 'minors' but is less clear than the GDPR regarding consent from guardians and privacy notices aimed at minors, and does not define a specific age of consent threshold.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/gdpr_v._pdpo_.pdf", "source_tier": null, "observed_at": null } ] }, { "code": "enforcement_and_redress", "name": "Enforcement & Redress", "traffic_light": "amber", "sub_modules": [ "collective_redress_and_class_actions", "enforcement_activity_index", "private_right_of_action", "recent_developments_180d", "regulator_funding_and_capacity", "regulator_powers_and_penalties" ], "url": "https://dataprotection.gi/jurisdictions/hong-kong/#enforcement-and-redress-enforcement-redress", "traffic_light_rationale": "Enforcement powers and penalties are robust and binding (green-level for that sub-module), but collective redress and regulator-capacity sub-modules are unevidenced gaps, pulling the module to amber.", "claims": [ { "statement": "The PCPD has various investigative powers, including the right to undertake investigations and inquiries and issue enforcement notices in the event of PDPO contraventions.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf", "source_tier": null, "observed_at": null }, { "statement": "The 2021 Amendment Ordinance removed the prior requirement that an enforcement notice could only be issued where the offending act was likely to continue or repeat, and increased penalties for data users breaching multiple or repeated enforcement notices.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/hong-kong-amendments-to-hong-kong-personal-data-privacy-ordinance", "source_tier": null, "observed_at": null }, { "statement": "The 2021 anti-doxxing regime creates a two-tier offence: a Tier 1 summary offence carrying up to two years' imprisonment and a HK$100,000 fine, and a Tier 2 indictable offence, where actual harm is caused, carrying up to five years' imprisonment and a HK$1,000,000 fine.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/opinion/hong-kong-pdpo-amendment-bill-proposal-law", "source_tier": null, "observed_at": null }, { "statement": "The PCPD has the power to conduct criminal investigations and institute prosecutions for doxxing cases, and to issue cessation notices to Hong Kong or non-Hong Kong persons or service providers to demand removal of doxxing content.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf", "source_tier": null, "observed_at": null }, { "statement": "The PCPD announced the first prison sentence under Section 50B(1)(c)(i) of the PDPO for knowingly making a false or misleading statement to the Commissioner during an investigation.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/hong-kongs-first-imprisonment-under-the-personal-data-privacy-ordinance", "source_tier": null, "observed_at": null }, { "statement": "The PCPD arrested an individual for posting personal information of three people on social media in a commercial dispute, marking the second arrest under the anti-doxxing legislation approved in September 2021.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/pdpo-amendment-would-enforce-removal-of-doxxing-content/", "source_tier": null, "observed_at": null }, { "statement": "The 2012 Amendment Ordinance introduced, among other measures, a legal assistance scheme for aggrieved individuals seeking to bring proceedings arising from PDPO contraventions.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/hong-kong-amendments-to-hong-kong-personal-data-privacy-ordinance", "source_tier": null, "observed_at": null }, { "statement": "The PCPD's 2024-25 Annual Report, 'Leveraging Artificial Intelligence for a New Digital Privacy Era,' concentrates on AI's impacts on data security and digital trust as a continuing regulatory priority.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/from-compliance-to-confidence-key-takeaways-from-the-pcpd-s-2024-25-annual-report", "source_tier": null, "observed_at": null } ] } ] }