#
Multiple GDPR-equivalent accountability pillars (DPIA, DPO, ROPA, mandatory breach notification) are absent from binding law; only security and retention principles and processor-supervision duties are binding.
Sub-modules (7)
Accountability And DpiaRed
PDPO does not explicitly set out accountability requirements or require DPIAs; the PCPD advocates a voluntary Privacy Management Programme (PMP) as a best-practice accountability framework.
Claims (1):
- The PDPO does not explicitly set out accountability requirements for data users and processors; the PCPD instead advocates the Privacy Management Programme, a non-binding strategic framework for building privacy infrastructure, including DPO appointment as best practice.
Dpo RequirementsRed
PDPO does not require DPO appointment; the PMP best-practice guide recommends one.
Claims (1):
- Unlike the GDPR, the PDPO does not require Data Protection Officer appointments; the PCPD's Privacy Management Programme guide (as updated 2019) recommends appointment as best practice only.
Ropa RequirementsRed
PDPO does not require maintenance of general processing records; only a log book for access/correction requests is mandated.
Claims (1):
- Unlike the GDPR, the PDPO does not require that general data-processing records be maintained; it only requires a log book be maintained in relation to data subject access and correction requests.
Joint Controller ArrangementsAmber
The 2012 Amendment Ordinance imposed express duties on data users to supervise their data processors contractually and otherwise.
Claims (1):
- The 2012 Amendment Ordinance imposes express obligations on a data user to supervise, through contractual and other means, its data processors to ensure PDPO compliance.
Security MeasuresAmber
DPP4 imposes a general, non-prescriptive security-of-processing duty; PCPD's 2023 recommendations urge specific technical/organisational measures as best practice.
Claims (2):
- The PDPO does not stipulate mandatory specific security measures; Data Protection Principle 4 sets only a general, non-prescriptive security-of-processing duty on data users.
- In September 2023, the PCPD issued non-binding recommendations urging organizations to conduct regular data-security risk assessments and adopt measures such as firewalls, encryption, and the least-privilege principle in compliance with DPP4.
Breach NotificationRed
PDPO imposes no mandatory breach-notification obligation; PCPD guidance recommends prompt voluntary notification, and a 2020 consultation proposed mandatory notification but remains unenacted.
Claims (2):
- The PDPO does not provide for mandatory data breach notifications; the PCPD has instead published non-binding guidance on data breach handling.
- In a 2020 consultation paper, the Privacy Commissioner and the Constitutional and Mainland Affairs Bureau proposed introducing mandatory data breach notification requirements and data retention periods, with no confirmed timeframe for formal introduction.
Retention And DisposalGreen
DPP2(2)/Section 26 requires personal data not be kept longer than necessary for the purpose (including any directly related purpose).
Claims (1):
- Under DPP2(2) and Section 26 of the PDPO, all practicable steps must be taken to ensure personal data is not kept longer than necessary for the fulfilment of the purpose for which it is or is to be used.
Controller/Processor Duties
Hong Kong's controller obligations around breach handling remain, for now, without a statutory mandatory-notification requirement. As of February 2026, the Office of the Privacy Commissioner for Personal Data is understood to have revived consultation with lawmakers on a framework that would require data users to notify the PCPD and affected individuals within five business days of a breach posing a real risk of significant harm. This reporting rests on secondary legal-commentary sources rather than a primary PCPD or Legislative Council document, so the specific five-business-day figure and whether the proposal has moved beyond lawmaker briefings to a formally introduced bill are not yet confirmed.
Against this unresolved reform backdrop, the practical breach-reporting picture is nonetheless shifting on the ground: voluntary data-breach notifications to the PCPD rose from 157 in 2023 to 203 in 2024 and to 246 in 2025, with hacking-related incidents up 33 percent year on year in 2025. This rising voluntary-notification trend means Hong Kong data users are already reporting breaches to the PCPD at increasing volume even without a statutory compulsion to do so, which may narrow the practical gap that formal mandatory notification would otherwise close, while the underlying question of statutory timing and administrative-fine exposure remains open.
Outlook
The reform's progression from lawmaker consultation to a formally introduced bill is the key development to track, alongside whether the five-business-day notification window and any associated administrative-fine structure survive into eventual legislative text.
1 further periodic run re-emitted the standing brief unchanged and is not shown.
Sources and claims (9)
- ProbableDataGuidance — The PDPO does not explicitly set out accountability requirements for data users and processors; the PCPD instead advocates the Privacy Management Programme, a non-binding strategic framework for building privacy infrastructure, including DPO appointment as best practice.observed
- ProbableDataGuidance — Unlike the GDPR, the PDPO does not require Data Protection Officer appointments; the PCPD's Privacy Management Programme guide (as updated 2019) recommends appointment as best practice only.observed
- ProbableDataGuidance — Unlike the GDPR, the PDPO does not require that general data-processing records be maintained; it only requires a log book be maintained in relation to data subject access and correction requests.observed
- ProbableIAPP — The 2012 Amendment Ordinance imposes express obligations on a data user to supervise, through contractual and other means, its data processors to ensure PDPO compliance.observed
- ProbableDataGuidance — The PDPO does not stipulate mandatory specific security measures; Data Protection Principle 4 sets only a general, non-prescriptive security-of-processing duty on data users.observed
- ProbableDataGuidance — In September 2023, the PCPD issued non-binding recommendations urging organizations to conduct regular data-security risk assessments and adopt measures such as firewalls, encryption, and the least-privilege principle in compliance with DPP4.observed
- ProbableDataGuidance — The PDPO does not provide for mandatory data breach notifications; the PCPD has instead published non-binding guidance on data breach handling.observed
- ProbableIAPP — In a 2020 consultation paper, the Privacy Commissioner and the Constitutional and Mainland Affairs Bureau proposed introducing mandatory data breach notification requirements and data retention periods, with no confirmed timeframe for formal introduction.observed
- ProbableDataGuidance — Under DPP2(2) and Section 26 of the PDPO, all practicable steps must be taken to ensure personal data is not kept longer than necessary for the fulfilment of the purpose for which it is or is to be used.observed