Data Protection Monitor
Global Privacy & Data Protection Intelligence

Hong Kong (HK) · Module Detail

Hong Kong: Cross-Border & Adequacy

← Full Hong Kong overview Build report with Hong Kong Request deeper dive

#

The central transfer-restriction mechanism is dormant; only voluntary guidance exists, and adequacy/TIA sub-modules could not be evidenced.

Primary frameworkPersonal Data (Privacy) Ordinance (Cap. 486), Section 33 (not yet in force)
Supervisory authorityPCPD
Traffic-light rationale — RedThe central transfer-restriction mechanism is dormant; only voluntary guidance exists, and adequacy/TIA sub-modules could not be evidenced.

Sub-modules (6)

Transfer MechanismsRed

Section 33 (transfer restriction) remains dormant; PCPD guidance outlines prospective mechanisms (consent, white list, due diligence) that would apply if commenced.

Claims (3):

  • Currently, there are no restrictions in effect concerning the cross-border transfer of personal data from Hong Kong, as Section 33 of the PDPO has never been brought into force.
  • The PCPD has issued a non-binding Guidance on Personal Data Protection in Cross-Border Data Transfer, recommending voluntary compliance with Section 33 as best practice and signalling a possible future commencement of the transfer restriction.
  • No timetable has been announced for the implementation of Section 33; it remains the only section of the PDPO yet to come into effect.

Adequacy ReceivedRed

No evidence located of any foreign regime granting Hong Kong an adequacy-equivalent determination.

Absence provenance: unavailable. Searched: Hong Kong EU adequacy decision, Hong Kong PDPO adequacy determination received.

Adequacy GrantedRed

Since Section 33's white-list mechanism has never been activated, Hong Kong has not granted adequacy-equivalent status to any other jurisdiction.

Claims (1):

  • Currently, there are no restrictions in effect concerning the cross-border transfer of personal data from Hong Kong, as Section 33 of the PDPO has never been brought into force.

Sccs And BcrsRed

Section 33, even if brought into force, does not provide for mechanisms such as BCRs, SCCs, or codes of conduct.

Claims (1):

  • Section 33 of the PDPO does not provide for mechanisms such as binding corporate rules, standard contractual clauses, or codes of conduct, even if it were to come into force.

Transfer Impact AssessmentRed

No formal transfer-impact-assessment requirement was identified; PCPD guidance recommends general due diligence only.

Absence provenance: unavailable. Searched: Hong Kong PDPO transfer impact assessment requirement.

Data LocalisationAmber

No general PDPO data-localisation mandate exists; sector regulators (e.g., HKMA) impose data-residency/outsourcing controls on regulated entities.

Claims (1):

  • The Outsourcing module (SA-2) of the Hong Kong Monetary Authority's Supervisory Policy Manual requires all authorised institutions to implement proper controls for protection of customer data when entering into an outsourcing arrangement.
Category narrative61 words

Section 33 of the PDPO — the sole cross-border transfer restriction provision — has never been commenced since the Ordinance's 1995/1996 enactment, so no binding transfer restriction currently applies. PCPD has issued non-binding guidance recommending voluntary compliance with Section 33's conditions (consent, a prospective 'white list', due diligence) as best practice. No adequacy decisions received/granted or formal TIA requirement were identified.

Sources and claims (5)
  1. ProbableDataGuidance — Currently, there are no restrictions in effect concerning the cross-border transfer of personal data from Hong Kong, as Section 33 of the PDPO has never been brought into force.observed
  2. ProbableIAPP — The PCPD has issued a non-binding Guidance on Personal Data Protection in Cross-Border Data Transfer, recommending voluntary compliance with Section 33 as best practice and signalling a possible future commencement of the transfer restriction.observed
  3. ProbableDataGuidance — No timetable has been announced for the implementation of Section 33; it remains the only section of the PDPO yet to come into effect.observed
  4. ProbableDataGuidance — Section 33 of the PDPO does not provide for mechanisms such as binding corporate rules, standard contractual clauses, or codes of conduct, even if it were to come into force.observed
  5. ProbableDataGuidance — The Outsourcing module (SA-2) of the Hong Kong Monetary Authority's Supervisory Policy Manual requires all authorised institutions to implement proper controls for protection of customer data when entering into an outsourcing arrangement.observed