---
title: "Hong Kong — Data Subject Rights | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/hong-kong/data-subject-rights/
source_html: /jurisdictions/hong-kong/data-subject-rights/index.html
description: "Hong Kong — Data Subject Rights: data_subject_rights Data Subject Rights 5 sub-modules 4 claims Amber ▾ # Access/rectification rights are well-defined and binding (green-equivalent), but erasure and portability rights"
generated_at: 2026-10-25T04:46:50Z
content_sha256: 064b979c54645ad3cd9a717c53a025067306251d61d0c424f6cfaeb2b822d0a9
generator: "fe-fleet/md-twin@1.0"
---
# Hong Kong — Data Subject Rights | Data Protection Monitor

### D3Data Subject Rights5 sub-modules4 claimsAmber▾#

Access/rectification rights are well-defined and binding (green-equivalent), but erasure and portability rights are absent, and restriction/objection is narrow — pulling the module to amber overall.

Primary framework Personal Data (Privacy) Ordinance (Cap. 486)

Supervisory authority [PCPD](https://www.pcpd.org.hk/)

Traffic-light rationale — Amber Access/rectification rights are well-defined and binding (green-equivalent), but erasure and portability rights are absent, and restriction/objection is narrow — pulling the module to amber overall.

#### Sub-modules (5)

#### Access RightGreen

Data subjects may request access; if refused, the data user must inform the requestor within 40 calendar days and explain the refusal.

Claims (1):

- If a data user rejects or denies a data access request, it must inform the requestor within 40 calendar days from receipt of the request and explain why it cannot comply.

#### Rectification And ErasureAmber

Correction requests must be honored within 40 days; however, PDPO does not provide a general right to erasure/deletion, only a duty not to retain data beyond necessity.

Claims (2):

- A data correction request must be complied with, and a copy of the corrected personal data provided, within 40 calendar days from receipt under Section 23(1) of the PDPO.
- Unlike the GDPR, the PDPO does not provide data subjects with a general right to request erasure or deletion of their personal data; only general requirements exist relating to erasure once data is no longer required for its original purpose.

#### Restriction And ObjectionAmber

No general restriction-of-processing right exists; the closest analogue is the standing direct-marketing opt-out right.

Claims (1):

- An individual is entitled to opt out of direct marketing at any time irrespective of having previously given consent, functioning as PDPO's principal objection-type right.

#### Data PortabilityRed

No evidence of a statutory data-portability right was located in this research pass.

Absence provenance: unavailable . Searched: Hong Kong PDPO data portability right, PCPD portability guidance.

#### Deadlines And Response WindowsGreen

A uniform 40-calendar-day statutory response window applies to both access and correction requests.

Claims (2):

- If a data user rejects or denies a data access request, it must inform the requestor within 40 calendar days from receipt of the request and explain why it cannot comply.
- A data correction request must be complied with, and a copy of the corrected personal data provided, within 40 calendar days from receipt under Section 23(1) of the PDPO.

Category narrative 35 words

PDPO grants access and correction rights with a 40-calendar-day statutory response window, but does not provide a general right to erasure/be forgotten, nor a data-portability right. Objection-type rights are largely confined to the direct-marketing opt-out.

Evidence 4

Sources and claims (4)
- Probable[DataGuidance](https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf) — If a data user rejects or denies a data access request, it must inform the requestor within 40 calendar days from receipt of the request and explain why it cannot comply.observed 2026-08-03
- Probable[DataGuidance](https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf) — A data correction request must be complied with, and a copy of the corrected personal data provided, within 40 calendar days from receipt under Section 23(1) of the PDPO.observed 2026-08-03
- Probable[DataGuidance](https://www.dataguidance.com/sites/default/files/gdpr_v._pdpo_.pdf) — Unlike the GDPR, the PDPO does not provide data subjects with a general right to request erasure or deletion of their personal data; only general requirements exist relating to erasure once data is no longer required for its original purpose.observed 2026-08-03
- Probable[IAPP](https://iapp.org/news/a/hong-kong-amendments-to-hong-kong-personal-data-privacy-ordinance) — An individual is entitled to opt out of direct marketing at any time irrespective of having previously given consent, functioning as PDPO's principal objection-type right.observed 2026-08-03