--- title: "Hong Kong — Cross-Border & Adequacy | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/hong-kong/cross-border-and-adequacy/ source_html: /jurisdictions/hong-kong/cross-border-and-adequacy/index.html description: "Hong Kong — Cross-Border & Adequacy: cross_border_and_adequacy Cross-Border & Adequacy red 6 sub-modules 5 claims Red ▾ # The central transfer-restriction mechanism is dormant; only voluntary guidance exists, and adeq" generated_at: 2026-10-25T04:46:50Z content_sha256: 0495697b43fd98629847df101fc4853e148f6372a2a545b087d101a37ef66fe3 generator: "fe-fleet/md-twin@1.0" --- # Hong Kong — Cross-Border & Adequacy | Data Protection Monitor ### D5Cross-Border & Adequacyred6 sub-modules5 claimsRed▾# The central transfer-restriction mechanism is dormant; only voluntary guidance exists, and adequacy/TIA sub-modules could not be evidenced. Primary framework Personal Data (Privacy) Ordinance (Cap. 486), Section 33 (not yet in force) Supervisory authority [PCPD](https://www.pcpd.org.hk/) Traffic-light rationale — Red The central transfer-restriction mechanism is dormant; only voluntary guidance exists, and adequacy/TIA sub-modules could not be evidenced. #### Sub-modules (6) #### Transfer MechanismsRed Section 33 (transfer restriction) remains dormant; PCPD guidance outlines prospective mechanisms (consent, white list, due diligence) that would apply if commenced. Claims (3): - Currently, there are no restrictions in effect concerning the cross-border transfer of personal data from Hong Kong, as Section 33 of the PDPO has never been brought into force. - The PCPD has issued a non-binding Guidance on Personal Data Protection in Cross-Border Data Transfer, recommending voluntary compliance with Section 33 as best practice and signalling a possible future commencement of the transfer restriction. - No timetable has been announced for the implementation of Section 33; it remains the only section of the PDPO yet to come into effect. #### Adequacy ReceivedRed No evidence located of any foreign regime granting Hong Kong an adequacy-equivalent determination. Absence provenance: unavailable . Searched: Hong Kong EU adequacy decision, Hong Kong PDPO adequacy determination received. #### Adequacy GrantedRed Since Section 33's white-list mechanism has never been activated, Hong Kong has not granted adequacy-equivalent status to any other jurisdiction. Claims (1): - Currently, there are no restrictions in effect concerning the cross-border transfer of personal data from Hong Kong, as Section 33 of the PDPO has never been brought into force. #### Sccs And BcrsRed Section 33, even if brought into force, does not provide for mechanisms such as BCRs, SCCs, or codes of conduct. Claims (1): - Section 33 of the PDPO does not provide for mechanisms such as binding corporate rules, standard contractual clauses, or codes of conduct, even if it were to come into force. #### Transfer Impact AssessmentRed No formal transfer-impact-assessment requirement was identified; PCPD guidance recommends general due diligence only. Absence provenance: unavailable . Searched: Hong Kong PDPO transfer impact assessment requirement. #### Data LocalisationAmber No general PDPO data-localisation mandate exists; sector regulators (e.g., HKMA) impose data-residency/outsourcing controls on regulated entities. Claims (1): - The Outsourcing module (SA-2) of the Hong Kong Monetary Authority's Supervisory Policy Manual requires all authorised institutions to implement proper controls for protection of customer data when entering into an outsourcing arrangement. Category narrative 61 words Section 33 of the PDPO — the sole cross-border transfer restriction provision — has never been commenced since the Ordinance's 1995/1996 enactment, so no binding transfer restriction currently applies. PCPD has issued non-binding guidance recommending voluntary compliance with Section 33's conditions (consent, a prospective 'white list', due diligence) as best practice. No adequacy decisions received/granted or formal TIA requirement were identified. Evidence 5 Sources and claims (5) - Probable[DataGuidance](https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf) — Currently, there are no restrictions in effect concerning the cross-border transfer of personal data from Hong Kong, as Section 33 of the PDPO has never been brought into force.observed 2026-08-03 - Probable[IAPP](https://iapp.org/news/a/hong-kong-puts-restrictions-on-cross-border-transfers-are-you-compliant) — The PCPD has issued a non-binding Guidance on Personal Data Protection in Cross-Border Data Transfer, recommending voluntary compliance with Section 33 as best practice and signalling a possible future commencement of the transfer restriction.observed 2026-08-03 - Probable[DataGuidance](https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf) — No timetable has been announced for the implementation of Section 33; it remains the only section of the PDPO yet to come into effect.observed 2026-08-03 - Probable[DataGuidance](https://www.dataguidance.com/sites/default/files/gdpr_v._pdpo_.pdf) — Section 33 of the PDPO does not provide for mechanisms such as binding corporate rules, standard contractual clauses, or codes of conduct, even if it were to come into force.observed 2026-08-03 - Probable[DataGuidance](https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf) — The Outsourcing module (SA-2) of the Hong Kong Monetary Authority's Supervisory Policy Manual requires all authorised institutions to implement proper controls for protection of customer data when entering into an outsourcing arrangement.observed 2026-08-03