#
Access/rectification rights are well-defined and binding (green-equivalent), but erasure and portability rights are absent, and restriction/objection is narrow — pulling the module to amber overall.
Sub-modules (5)
Access RightGreen
Data subjects may request access; if refused, the data user must inform the requestor within 40 calendar days and explain the refusal.
Claims (1):
- If a data user rejects or denies a data access request, it must inform the requestor within 40 calendar days from receipt of the request and explain why it cannot comply.
Rectification And ErasureAmber
Correction requests must be honored within 40 days; however, PDPO does not provide a general right to erasure/deletion, only a duty not to retain data beyond necessity.
Claims (2):
- A data correction request must be complied with, and a copy of the corrected personal data provided, within 40 calendar days from receipt under Section 23(1) of the PDPO.
- Unlike the GDPR, the PDPO does not provide data subjects with a general right to request erasure or deletion of their personal data; only general requirements exist relating to erasure once data is no longer required for its original purpose.
Restriction And ObjectionAmber
No general restriction-of-processing right exists; the closest analogue is the standing direct-marketing opt-out right.
Claims (1):
- An individual is entitled to opt out of direct marketing at any time irrespective of having previously given consent, functioning as PDPO's principal objection-type right.
Data PortabilityRed
No evidence of a statutory data-portability right was located in this research pass.
Absence provenance: unavailable. Searched: Hong Kong PDPO data portability right, PCPD portability guidance.
Deadlines And Response WindowsGreen
A uniform 40-calendar-day statutory response window applies to both access and correction requests.
Claims (2):
- If a data user rejects or denies a data access request, it must inform the requestor within 40 calendar days from receipt of the request and explain why it cannot comply.
- A data correction request must be complied with, and a copy of the corrected personal data provided, within 40 calendar days from receipt under Section 23(1) of the PDPO.
Sources and claims (4)
- ProbableDataGuidance — If a data user rejects or denies a data access request, it must inform the requestor within 40 calendar days from receipt of the request and explain why it cannot comply.observed
- ProbableDataGuidance — A data correction request must be complied with, and a copy of the corrected personal data provided, within 40 calendar days from receipt under Section 23(1) of the PDPO.observed
- ProbableDataGuidance — Unlike the GDPR, the PDPO does not provide data subjects with a general right to request erasure or deletion of their personal data; only general requirements exist relating to erasure once data is no longer required for its original purpose.observed
- ProbableIAPP — An individual is entitled to opt out of direct marketing at any time irrespective of having previously given consent, functioning as PDPO's principal objection-type right.observed