--- title: "Hong Kong Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/hong-kong/ source_html: /jurisdictions/hong-kong/index.html description: "Hong Kong data protection and privacy regulation: 10 categories, 109 claims, updated 2026-11-04." generated_at: 2026-11-07T14:58:19Z content_sha256: 6b990477df3aaf858ec8086ff6d95b53e5111277fe36d06af51f1e9e9577f298 generator: "fe-fleet/md-twin@1.0" --- # Hong Kong Data Protection & Privacy Regulation | Data Protection Monitor Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # Hong Kong Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/hong-kong/), [World Payments](https://payments.gi/jurisdictions/hong-kong/), artificial-intelligence Last updated 2026-11-04 · 10 categories · 109 claims · 39 sources in the cumulative register Download report (PDF) Expand all Hong Kong's data-protection perimeter widened this cycle as a dedicated critical-infrastructure cybersecurity regime came into force alongside the long-standing Personal Data (Privacy) Ordinance. Data collected 2026-10-20 · Data published 2026-11-04 AI-assembled from cited sources Not fully checked this cycle: Controller/Processor Duties, Algorithmic, Biometric & Surveillance Governance (2 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=HONG-KONG)[Build Report](/reports/?j=HONG-KONG)[Compare](/compare/?j=HONG-KONG) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Privacy Commissioner for Personal Data (PCPD) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 3 Red categories 57 Sub-modules 109 Claims 2 Tier-1 sources Traffic-light mix 7 amber 3 red (sums to 10 rendered categories; click to filter) 3 categories flagged red ## Jurisdiction brief Jurisdiction lead brief 769 Full executive summary 475 ###### Latest update · 20 October 2026 #### Lead Signal Hong Kong's data protection regulator deepened its engagement with technology-driven risk, most notably through a finding that the Worldcoin iris-scanning biometric project contravened the Personal Data (Privacy) Ordinance. The investigation, which the Privacy Commissioner for Personal Data commenced in January 2024, concluded with a finding of contravention, as recorded in a Legislative Council paper; the specific Data Protection Principle breached and the full enforcement outcome were not independently confirmed beyond that summary. Separately, the PCPD published a supplement to its Model Personal Data Protection Framework specifically addressing agentic artificial intelligence, dated 25 August 2026, extending its existing non-binding 2024 guidance into this newer category of automated decision-making technology. #### Other Developments Enforcement Notice over ransomware breach. The PCPD published an Investigation Report on 23 April 2026 concerning a ransomware-caused data breach at Yau Yat Chuen Garden City Club, finding failures under Data Protection Principle 4's security-measures standard, including an absence of authentication controls governing third-party remote server access, and the Commissioner served an Enforcement Notice as a result. #### Cross-Monitor Connections The Worldcoin biometric finding touches on territory also of interest to the crypto monitor, insofar as Worldcoin's technology stack intersects with blockchain-based identity verification, though this brief addresses the finding solely from the data-protection contravention angle and does not analyse any crypto-specific dimension of the project. No overlap with the financial-integrity or world-payments monitors arises from either development. #### Outlook Hong Kong's statutory data-protection ceiling remains unchanged, with no mandatory breach-notification requirement and no administrative fining power resting with the Commissioner, every monetary penalty instead requiring a court conviction. Within that ceiling, however, the Commissioner's enforcement and guidance activity, spanning the Yau Yat Chuen Enforcement Notice, the Worldcoin contravention finding, and the Agentic-AI guidance supplement, shows an increasingly active supervisory posture toward technology-driven risk. Whether the Worldcoin finding results in a published Enforcement Notice of its own, and whether the Agentic-AI guidance is followed by further sector-specific supplements, are the principal items to watch. 3 earlier updates not shown here. ###### Standing brief · as of 25 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Hong Kong's data-protection perimeter widened this cycle as a dedicated critical-infrastructure cybersecurity regime came into force alongside the long-standing Personal Data (Privacy) Ordinance. The Office of the Privacy Commissioner for Personal Data (PCPD) is Hong Kong's data protection regulator under the PDPO. The Protection of Critical Infrastructures (Computer Systems) Ordinance was passed by the Legislative Council on 19 March 2025 and came into full force on 1 January 2026, adding a critical-infrastructure cybersecurity layer separate from the PDPO. The Ordinance imposes computer-system security obligations on designated critical infrastructure operators, in force since 1 January 2026. The new regime sits alongside, rather than inside, the PDPO, expanding the compliance perimeter facing operators of critical systems in the territory. #### Other Developments PCPD is understood to have revived, in February 2026, a consultation with lawmakers on a mandatory breach-notification framework requiring notice to PCPD and affected individuals within five business days for breaches carrying a real risk of significant harm; no timetable has been confirmed as of mid-2026. The same revived agenda is understood to include giving PCPD direct administrative sanctioning power for the first time, a fundamental shift from the current model of enforcement by referral for criminal prosecution. Separately, PCPD's February 2026 report recorded 4,228 complaints, up 23% year on year, and 246 voluntary data breach notifications, up 21% year on year, including 81 hacking-related incidents, up 33%. On the algorithmic-governance front, the Legislative Council debated in July 2025 developing an AI-era personal-data-protection framework; no legislation had resulted as of mid-2026. #### Cross-Monitor Connections The Ordinance's security obligations for designated critical-infrastructure operators may bear on the crypto monitor's coverage, insofar as virtual-asset trading platform infrastructure could fall within scope of critical-infrastructure designation in Hong Kong. A general data-protection carve-out relevance for gambling-adjacent platforms operating in Hong Kong has also been flagged for the advennt monitor, though no specific claim substantiates that connection this cycle. #### Outlook Hong Kong's trajectory this cycle is one of tightening through adjacent-instrument expansion and revived reform intent rather than through amendment of the PDPO itself. The Computer Systems Ordinance is now in force; the mandatory breach-notification and administrative-fining proposals remain at the consultation stage, with no confirmed timetable for formal introduction. Rising complaint and breach-notification volumes point to growing regulator visibility into Hong Kong's data-incident landscape even absent a mandatory notification duty. The AI-era data-protection framework debated by the Legislative Council in July 2025 remains at the discussion stage, with no binding instrument yet in view. Read full brief · 769 words ###### Latest update · 20 October 2026 #### Regulatory Status Hong Kong's data-protection developments centre on two Privacy Commissioner for Personal Data actions. First, the Commissioner's investigation into the Worldcoin iris-scanning biometric project, commenced January 2024, concluded with a finding of contravention of the Personal Data (Privacy) Ordinance, as recorded in a Legislative Council paper. Second, the PCPD published a Model Personal Data Protection Framework supplement addressing agentic artificial intelligence on 25 August 2026, extending its 2024 non-binding guidance into this category of AI system. Separately, the Commissioner's 23 April 2026 Investigation Report and Enforcement Notice against Yau Yat Chuen Garden City Club, arising from a ransomware breach and Data Protection Principle 4 security-measure failures, remains the most recent documented enforcement action on the public record. Hong Kong's broader statutory architecture is unchanged: the Privacy Commissioner retains no power to impose administrative fines, with every monetary penalty requiring a court conviction, and the jurisdiction continues to have no statutory mandatory breach-notification requirement, relying instead on voluntary notification. #### Outlook The near-term questions for Hong Kong's data-protection trajectory are whether the Worldcoin investigation results in a published Enforcement Notice with specific remedial requirements, and whether the Agentic-AI guidance supplement is followed by further guidance or by any move toward binding AI-specific rules. The core statutory ceiling, including the absence of mandatory breach notification and administrative fining power, shows no sign of near-term change. 2 earlier updates not shown here. ###### Standing brief · as of 25 August 2026 #### Regulatory Status The Office of the Privacy Commissioner for Personal Data (PCPD) is Hong Kong's data protection regulator under the PDPO. The Protection of Critical Infrastructures (Computer Systems) Ordinance came into full force on 1 January 2026, adding a critical-infrastructure cybersecurity layer separate from the PDPO, and it imposes computer-system security obligations on designated critical infrastructure operators. PCPD is understood to have revived, in February 2026, a consultation with lawmakers on a mandatory breach-notification framework requiring notice within five business days for breaches carrying a real risk of significant harm, alongside a proposal to give PCPD direct administrative sanctioning power for the first time. PCPD's February 2026 report recorded 4,228 complaints, up 23% year on year, and 246 voluntary data breach notifications, up 21% year on year, including 81 hacking-related incidents, up 33%. The Legislative Council debated in July 2025 developing an AI-era personal-data-protection framework; no legislation had resulted as of mid-2026. #### Outlook Hong Kong's regulatory direction this cycle is tightening, driven by the Computer Systems Ordinance's full commencement and a revived PDPO reform agenda covering mandatory breach notification and administrative fining power, though the core reform is not yet enacted. No confirmed timetable exists for formal introduction of these proposals, and the AI-era data-protection debate remains at a discussion stage with no binding instrument in view. Read full brief · 475 words Key regulatory facts for Hong Kong Regulatory Dimension Hong Kong Standing Position Jurisdiction Hong Kong (HK) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 109 sourced findings) Regulator & Framework Core regulator/statute framework is well-established (green-equivalent), but material and territorial scope diverge substantially from GDPR baseline, and a registration/filing sub-module could not be evidenced,... Lawful Processing & Special Data Functional equivalents exist via DPPs and guidance, but the absence of enumerated lawful bases and a codified special-category regime is a material structural gap versus GDPR. Data Subject Rights Access/rectification rights are well-defined and binding (green-equivalent), but erasure and portability rights are absent, and restriction/objection is narrow — pulling the module to amber overall. Controller/Processor Duties Multiple GDPR-equivalent accountability pillars (DPIA, DPO, ROPA, mandatory breach notification) are absent from binding law; only security and retention principles and processor-supervision duties are binding. Primary Instruments Cited DataGuidance, DataGuidance, IAPP, DataGuidance, DLA Piper Last Confirmed / Updated 2026-11-04 (39 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Hong Kong: D1 Regulator & Framework5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core regulator/statute framework is well-established (green-equivalent), but material and territorial scope diverge substantially from GDPR baseline, and a registration/filing sub-module could not be evidenced, warranting amber overall. Primary framework Personal Data (Privacy) Ordinance (Cap. 486) Supervisory authority [Privacy Commissioner for Personal Data (PCPD)](https://www.pcpd.org.hk/) Traffic-light rationale — Amber Core regulator/statute framework is well-established (green-equivalent), but material and territorial scope diverge substantially from GDPR baseline, and a registration/filing sub-module could not be evidenced, warranting amber overall. #### Sub-modules (5) #### Regulator And AuthorityGreen PCPD is the statutory regulator headed by the Privacy Commissioner, with investigative and enforcement powers under the PDPO. Claims (3): - The Office of the Privacy Commissioner for Personal Data (PCPD) is the main body responsible for overseeing enforcement of the PDPO and is headed by the Privacy Commissioner for Personal Data. - The PCPD, not mainland China's CAC, is the supervisory authority for Hong Kong's PDPO; the two regimes operate separately under 'one country, two systems'. - Privacy Commissioner for Personal Data (PCPD) — Enforces the PDPO under section 5 of the Ordinance. #### Act And InstrumentsGreen PDPO Cap. 486 (in force since 1996) is the principal instrument, materially amended in 2012 (direct marketing) and 2021 (anti-doxxing). Claims (4): - The Personal Data (Privacy) Ordinance (Cap. 486) came into force on 20 December 1996 and was significantly amended by the 2012 Amendment Ordinance (direct marketing) and the 2021 Amendment Ordinance (anti-doxxing). - Protection of Critical Infrastructures (Computer Systems) Ordinance — The CIO came into full force on 1 January 2026, adding a cybersecurity-for-critical-infrastructure regime adjacent to, and separate from, the PDPO. - Personal Data (Privacy) Ordinance reform package — Proposed January 2020 reform (mandatory breach notification, processor regulation, retention/disposal rules, administrative fining power) remains substantially un-enacted; only the 2021 anti-doxxing amendment delivered. - Personal Data (Privacy) Ordinance Cap. 486 — Government long-proposed PDPO amendments covering mandatory data-breach notification, mandatory data retention policies, PCPD power to impose administrative fines, direct regulation of processors; no bill introduced as of 2026-11-02 #### Material ScopeAmber PDPO scope centers on Data Protection Principles (DPPs) governing collection, holding, processing and use of personal data by 'data users'. Claims (3): - Data Protection Principle 1(1) requires that only necessary, adequate and not excessive personal data be collected for a lawful purpose, forming part of PDPO's core material-scope obligations on data users. - Personal Data (Privacy) Ordinance (Cap. 486), s.2(1) — A foreign business is caught as a 'data user' where it controls the personal data collected, even if processing occurs outside Hong Kong, so long as the controlling data user is based/operating in Hong Kong. - Personal Data (Privacy) Ordinance (Cap. 486) Sch.1 — General exemption from the Data Protection Principles for personal data held for domestic or recreational purposes #### Territorial ScopeAmber PCPD has clarified PDPO has no extraterritorial scope; it applies where the data user's principal place of business is in Hong Kong. Claims (2): - The PDPO is unclear on its territorial scope on its face, but the PCPD has clarified that the PDPO does not have extraterritorial scope, in contrast to the GDPR's extraterritorial application. - Personal Data (Privacy) Ordinance (Cap. 486) — no_extraterritorial_effect #### Regulator Registration And FilingRed No evidence located of a general controller registration/filing obligation to PCPD akin to EU-style DPA registers. Claims (1): - Personal Data (Privacy) Ordinance (Cap. 486) — No statutory requirement under the PDPO for data users to register, notify the PCPD, or pay a fee before collecting or processing personal data Hong Kong's data protection regime is anchored in the Personal Data (Privacy) Ordinance (Cap. 486), a comprehensive omnibus statute enforced by the Privacy Commissioner for Personal Data (PCPD). The PDPO has no extraterritorial reach and applies to data users with a principal place of business in Hong Kong. Unlike GDPR-model regimes, PDPO does not impose a general registration/filing obligation on data users; no direct evidence of such a regime was found in this research pass. Periodic update · new data 2026-09-28 #### Regulator & Framework Hong Kong's data-protection framework continues to rest on the Personal Data (Privacy) Ordinance, supervised by the Privacy Commissioner for Personal Data. The Privacy Commissioner, not mainland China's Cyberspace Administration, is confirmed as the supervisory authority for this Ordinance, with the two regimes operating entirely separately under the 'one country, two systems' constitutional arrangement — a standing baseline fact with no change this cycle. The material development this cycle is the commencement of a separate, adjacent instrument: the Protection of Critical Infrastructures (Computer Systems) Ordinance came into full force on 1 January 2026. This Ordinance establishes a cybersecurity-for-critical-infrastructure regime that is structurally distinct from, and sits alongside, the Personal Data (Privacy) Ordinance rather than amending or extending it. Organisations that qualify as operators of critical infrastructure computer systems now face obligations under this new Ordinance in addition to, not instead of, their existing Personal Data (Privacy) Ordinance obligations where personal data is involved. This is an escalating regulatory-framework trajectory for Hong Kong: the jurisdiction's regulatory perimeter for computer-systems and data-related obligations is widening even though the Personal Data (Privacy) Ordinance itself has not been amended this cycle. No change to the Personal Data (Privacy) Ordinance's own statutory text, its lawful-processing basis, or the Privacy Commissioner's core supervisory mandate under that Ordinance was evidenced this cycle. #### Outlook The item to watch is how the Protection of Critical Infrastructures (Computer Systems) Ordinance's obligations interact in practice with Personal Data (Privacy) Ordinance compliance for organisations that qualify as critical-infrastructure operators and also process personal data, since this cycle's evidence establishes the new Ordinance's commencement but not yet how overlapping compliance obligations will be reconciled or supervised in practice. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Sources and claims (13) - [DataGuidance](https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf) — The Office of the Privacy Commissioner for Personal Data (PCPD) is the main body responsible for overseeing enforcement of the PDPO and is headed by the Privacy Commissioner for Personal Data. - [DataGuidance](https://www.dataguidance.com/notes/hong-kong-privacy-overview) — The Personal Data (Privacy) Ordinance (Cap. 486) came into force on 20 December 1996 and was significantly amended by the 2012 Amendment Ordinance (direct marketing) and the 2021 Amendment Ordinance (anti-doxxing). - [IAPP](https://iapp.org/news/a/new-privacy-requirements-for-direct-marketing-are-you-compliant-) — Data Protection Principle 1(1) requires that only necessary, adequate and not excessive personal data be collected for a lawful purpose, forming part of PDPO's core material-scope obligations on data users. - [DataGuidance](https://www.dataguidance.com/sites/default/files/gdpr_v._pdpo_.pdf) — The PDPO is unclear on its territorial scope on its face, but the PCPD has clarified that the PDPO does not have extraterritorial scope, in contrast to the GDPR's extraterritorial application. - [DLA Piper](https://www.dlapiperdataprotection.com/?t=law&c=HK) — Protection of Critical Infrastructures (Computer Systems) Ordinance — The CIO came into full force on 1 January 2026, adding a cybersecurity-for-critical-infrastructure regime adjacent to, and separate from, the PDPO. - [HFW — A new era for data protection in Hong Kong](https://www.hfw.com/insights/a-new-era-for-data-protection-in-hong-kong-legislative-updates-for-a-digital-age/) — The PCPD, not mainland China's CAC, is the supervisory authority for Hong Kong's PDPO; the two regimes operate separately under 'one country, two systems'. - [SmartSuite](https://www.smartsuite.com/frameworks/hong-kong-personal-data-privacy-ordinance-pdpo-cap-486) — Privacy Commissioner for Personal Data (PCPD) — Enforces the PDPO under section 5 of the Ordinance. - [https://dataprotection.gi/jurisdictions/hong-kong/](https://dataprotection.gi/jurisdictions/hong-kong/) — Personal Data (Privacy) Ordinance reform package — Proposed January 2020 reform (mandatory breach notification, processor regulation, retention/disposal rules, administrative fining power) remains substantially un-enacted; only the 2021 anti-doxxing amendment delivered. - [https://www.legco.gov.hk/yr2025/english/panels/ca/papers/ca20250217cb2-247-4-e.pdf](https://www.legco.gov.hk/yr2025/english/panels/ca/papers/ca20250217cb2-247-4-e.pdf) — Personal Data (Privacy) Ordinance Cap. 486 — Government long-proposed PDPO amendments covering mandatory data-breach notification, mandatory data retention policies, PCPD power to impose administrative fines, direct regulation of processors; no bill introduced as of 2026-11-02 - [https://www.pcpd.org.hk/english/enforcement/case_notes/casenotes_2.php?id=2019A07&content_type=&content_nature=&msg_id2=518](https://www.pcpd.org.hk/english/enforcement/case_notes/casenotes_2.php?id=2019A07&content_type=&content_nature=&msg_id2=518) — Personal Data (Privacy) Ordinance (Cap. 486) — no_extraterritorial_effect - [https://captaincompliance.com/education/hong-kong-pdpo/](https://captaincompliance.com/education/hong-kong-pdpo/) — Personal Data (Privacy) Ordinance (Cap. 486), s.2(1) — A foreign business is caught as a 'data user' where it controls the personal data collected, even if processing occurs outside Hong Kong, so long as the controlling data user is based/operating in Hong Kong. - [https://www.multilaw.com/Multilaw/Multilaw/Data_Protection_Laws_Guide/DataProtection_Guide_Hong_Kong.aspx](https://www.multilaw.com/Multilaw/Multilaw/Data_Protection_Laws_Guide/DataProtection_Guide_Hong_Kong.aspx) — Personal Data (Privacy) Ordinance (Cap. 486) — No statutory requirement under the PDPO for data users to register, notify the PCPD, or pay a fee before collecting or processing personal data - [https://www.linklaters.com/en/insights/data-protected/data-protected---hong-kong](https://www.linklaters.com/en/insights/data-protected/data-protected---hong-kong) — Personal Data (Privacy) Ordinance (Cap. 486) Sch.1 — General exemption from the Data Protection Principles for personal data held for domestic or recreational purposes ### Hong Kong: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Functional equivalents exist via DPPs and guidance, but the absence of enumerated lawful bases and a codified special-category regime is a material structural gap versus GDPR. Primary framework Personal Data (Privacy) Ordinance (Cap. 486) — Data Protection Principles Supervisory authority [PCPD](https://www.pcpd.org.hk/) Traffic-light rationale — Amber Functional equivalents exist via DPPs and guidance, but the absence of enumerated lawful bases and a codified special-category regime is a material structural gap versus GDPR. D2 · Lawful Processing — Full Module Record 4 sub-modules · 53 words · 8 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Hong Kong: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Access/rectification rights are well-defined and binding (green-equivalent), but erasure and portability rights are absent, and restriction/objection is narrow — pulling the module to amber overall. Primary framework Personal Data (Privacy) Ordinance (Cap. 486) Supervisory authority [PCPD](https://www.pcpd.org.hk/) Traffic-light rationale — Amber Access/rectification rights are well-defined and binding (green-equivalent), but erasure and portability rights are absent, and restriction/objection is narrow — pulling the module to amber overall. #### Sub-modules (5) #### Access RightGreen Data subjects may request access; if refused, the data user must inform the requestor within 40 calendar days and explain the refusal. Claims (1): - If a data user rejects or denies a data access request, it must inform the requestor within 40 calendar days from receipt of the request and explain why it cannot comply. #### Rectification And ErasureAmber Correction requests must be honored within 40 days; however, PDPO does not provide a general right to erasure/deletion, only a duty not to retain data beyond necessity. Claims (3): - A data correction request must be complied with, and a copy of the corrected personal data provided, within 40 calendar days from receipt under Section 23(1) of the PDPO. - Unlike the GDPR, the PDPO does not provide data subjects with a general right to request erasure or deletion of their personal data; only general requirements exist relating to erasure once data is no longer required for its original purpose. - Personal Data (Privacy) Ordinance (Cap. 486), s.26(1) — A data user must take all practicable steps to erase personal data no longer required for its purpose, unless erasure is prohibited by law or against the public interest; there is no standalone right to be forgotten. #### Restriction And ObjectionAmber No general restriction-of-processing right exists; the closest analogue is the standing direct-marketing opt-out right. Claims (2): - An individual is entitled to opt out of direct marketing at any time irrespective of having previously given consent, functioning as PDPO's principal objection-type right. - Personal Data (Privacy) Ordinance (Cap. 486), s.35G(1) — A data subject may at any time require a data user, free of charge, to cease using their personal data for direct marketing, and the data user must comply. #### Data PortabilityRed No evidence of a statutory data-portability right was located in this research pass. #### Deadlines And Response WindowsGreen A uniform 40-calendar-day statutory response window applies to both access and correction requests. Claims (3): - If a data user rejects or denies a data access request, it must inform the requestor within 40 calendar days from receipt of the request and explain why it cannot comply. - A data correction request must be complied with, and a copy of the corrected personal data provided, within 40 calendar days from receipt under Section 23(1) of the PDPO. - Personal Data (Privacy) Ordinance (Cap. 486), s.19(1) — A data user must comply with a data access request within 40 calendar days of receipt, or notify the requestor and refusal reasons within that period if refusing under s.20. PDPO grants access and correction rights with a 40-calendar-day statutory response window, but does not provide a general right to erasure/be forgotten, nor a data-portability right. Objection-type rights are largely confined to the direct-marketing opt-out. Sources and claims (7) - [DataGuidance](https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf) — If a data user rejects or denies a data access request, it must inform the requestor within 40 calendar days from receipt of the request and explain why it cannot comply. - [DataGuidance](https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf) — A data correction request must be complied with, and a copy of the corrected personal data provided, within 40 calendar days from receipt under Section 23(1) of the PDPO. - [DataGuidance](https://www.dataguidance.com/sites/default/files/gdpr_v._pdpo_.pdf) — Unlike the GDPR, the PDPO does not provide data subjects with a general right to request erasure or deletion of their personal data; only general requirements exist relating to erasure once data is no longer required for its original purpose. - [IAPP](https://iapp.org/news/a/hong-kong-amendments-to-hong-kong-personal-data-privacy-ordinance) — An individual is entitled to opt out of direct marketing at any time irrespective of having previously given consent, functioning as PDPO's principal objection-type right. - [https://www.pcpd.org.hk/english/news_events/media_enquiry/enquiry_20180208.html](https://www.pcpd.org.hk/english/news_events/media_enquiry/enquiry_20180208.html) — Personal Data (Privacy) Ordinance (Cap. 486), s.26(1) — A data user must take all practicable steps to erase personal data no longer required for its purpose, unless erasure is prohibited by law or against the public interest; there is no standalone right to be forgotten. - [https://www.pinsentmasons.com/out-law/guides/how-hong-kong-companies-should-deal-with-data-subject-access-requests](https://www.pinsentmasons.com/out-law/guides/how-hong-kong-companies-should-deal-with-data-subject-access-requests) — Personal Data (Privacy) Ordinance (Cap. 486), s.19(1) — A data user must comply with a data access request within 40 calendar days of receipt, or notify the requestor and refusal reasons within that period if refusing under s.20. - [https://hire.legal/article/985](https://hire.legal/article/985) — Personal Data (Privacy) Ordinance (Cap. 486), s.35G(1) — A data subject may at any time require a data user, free of charge, to cease using their personal data for direct marketing, and the data user must comply. ### Hong Kong: D4 Controller/Processor Duties7 sub-modulesRedEnacted in forceModule confidence: Probable▾ Multiple GDPR-equivalent accountability pillars (DPIA, DPO, ROPA, mandatory breach notification) are absent from binding law; only security and retention principles and processor-supervision duties are binding. Primary framework Personal Data (Privacy) Ordinance (Cap. 486) — DPP2, DPP4; PCPD Privacy Management Programme (non-binding) Supervisory authority [PCPD](https://www.pcpd.org.hk/) Traffic-light rationale — Red Multiple GDPR-equivalent accountability pillars (DPIA, DPO, ROPA, mandatory breach notification) are absent from binding law; only security and retention principles and processor-supervision duties are binding. Periodic update · new data 2026-10-11 #### Controller/Processor Duties Hong Kong's controller obligations around breach handling remain, for now, without a statutory mandatory-notification requirement. As of February 2026, the Office of the Privacy Commissioner for Personal Data is understood to have revived consultation with lawmakers on a framework that would require data users to notify the PCPD and affected individuals within five business days of a breach posing a real risk of significant harm. This reporting rests on secondary legal-commentary sources rather than a primary PCPD or Legislative Council document, so the specific five-business-day figure and whether the proposal has moved beyond lawmaker briefings to a formally introduced bill are not yet confirmed. Against this unresolved reform backdrop, the practical breach-reporting picture is nonetheless shifting on the ground: voluntary data-breach notifications to the PCPD rose from 157 in 2023 to 203 in 2024 and to 246 in 2025, with hacking-related incidents up 33 percent year on year in 2025. This rising voluntary-notification trend means Hong Kong data users are already reporting breaches to the PCPD at increasing volume even without a statutory compulsion to do so, which may narrow the practical gap that formal mandatory notification would otherwise close, while the underlying question of statutory timing and administrative-fine exposure remains open. #### Outlook The reform's progression from lawmaker consultation to a formally introduced bill is the key development to track, alongside whether the five-business-day notification window and any associated administrative-fine structure survive into eventual legislative text. D4 · Controller & Processor — Full Module Record 7 sub-modules · 53 words · 20 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Hong Kong: D5 Cross-Border & Adequacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ The central transfer-restriction mechanism is dormant; only voluntary guidance exists, and adequacy/TIA sub-modules could not be evidenced. Primary framework Personal Data (Privacy) Ordinance (Cap. 486), Section 33 (not yet in force) Supervisory authority [PCPD](https://www.pcpd.org.hk/) Traffic-light rationale — Red The central transfer-restriction mechanism is dormant; only voluntary guidance exists, and adequacy/TIA sub-modules could not be evidenced. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 61 words · 16 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Hong Kong: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Financial-sector overlay is well-evidenced; health, telecoms/ePrivacy, employment, and education sub-modules are thin or unevidenced. Primary framework PDPO overlaid by HKMA/Insurance Authority/SFC sectoral guidelines Supervisory authority [PCPD](https://www.pcpd.org.hk/) Traffic-light rationale — Amber Financial-sector overlay is well-evidenced; health, telecoms/ePrivacy, employment, and education sub-modules are thin or unevidenced. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 40 words · 7 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Hong Kong: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Direct marketing is green-level binding law; the remaining five sub-modules are unevidenced gaps in a jurisdiction with no dedicated ePrivacy/cookie statute. Primary framework Personal Data (Privacy) Ordinance (Cap. 486), Part VIA (Direct Marketing) Supervisory authority [PCPD](https://www.pcpd.org.hk/) Traffic-light rationale — Amber Direct marketing is green-level binding law; the remaining five sub-modules are unevidenced gaps in a jurisdiction with no dedicated ePrivacy/cookie statute. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 41 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Hong Kong: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ AI governance is active but entirely soft-law; national-security carve-outs materially limit PCPD's supervisory reach; profiling/ADM-transparency/genetic-data sub-modules are unevidenced. Primary framework PCPD Artificial Intelligence: Model Personal Data Protection Framework (2024, non-binding); PDPO general principles Supervisory authority [PCPD](https://www.pcpd.org.hk/) Traffic-light rationale — Amber AI governance is active but entirely soft-law; national-security carve-outs materially limit PCPD's supervisory reach; profiling/ADM-transparency/genetic-data sub-modules are unevidenced. Periodic update · new data 2026-10-20 #### Algorithmic, Biometric & Surveillance Governance Two developments mark this module as active for Hong Kong. The Privacy Commissioner for Personal Data's investigation into the Worldcoin iris-scanning biometric project, commenced in January 2024, has concluded with a finding that the project contravened the Personal Data (Privacy) Ordinance, as recorded in a paper submitted to the Legislative Council. The specific Data Protection Principle found to have been breached, and the full detail of any enforcement outcome beyond the finding of contravention itself, were not independently confirmed from a source beyond that Legislative Council summary, so this finding is reported at the level of detail the available record supports. Separately, the PCPD published, on 25 August 2026, a supplement to its Model Personal Data Protection Framework titled to address protection of personal data privacy in the use of agentic artificial intelligence. This supplements the Commissioner's existing 2024 Model Framework and extends non-binding guidance into a category of automated, autonomously-acting AI systems that the original framework did not specifically address. As with the original framework, this guidance carries no binding legal force and does not itself create new statutory obligations under the Personal Data (Privacy) Ordinance. Taken together, these two developments indicate that Hong Kong's approach to biometric and algorithmic governance continues to operate primarily through the PCPD's existing enforcement powers under the Ordinance and through non-binding guidance, rather than through a dedicated biometric- or AI-specific statute. The Worldcoin finding demonstrates that biometric data processing is being actively reviewed and found wanting under the existing Data Protection Principles framework, even without AI- or biometric-specific legislation in place. #### Outlook Whether the Worldcoin investigation results in a published Enforcement Notice, and what specific remedial steps or restrictions it imposes, is the most consequential open question in this module going forward. Equally, whether the PCPD's Agentic-AI guidance supplement is followed by further sector-specific or binding rule-making, or remains non-binding guidance indefinitely, will determine whether Hong Kong's algorithmic-governance approach continues to rely solely on existing DPP-based enforcement extended by interpretation, or moves toward more specific statutory footing. Periodic update · new data 2026-10-18 #### Algorithmic, Biometric & Surveillance Governance Two developments mark this module as active this cycle for Hong Kong. The Privacy Commissioner for Personal Data's investigation into the Worldcoin iris-scanning biometric project, commenced in January 2024, has concluded with a finding that the project contravened the Personal Data (Privacy) Ordinance, as recorded in a paper submitted to the Legislative Council. The specific Data Protection Principle found to have been breached, and the full detail of any enforcement outcome beyond the finding of contravention itself, were not independently confirmed from a source beyond that Legislative Council summary, so this finding is reported at the level of detail the available record supports. Separately, the PCPD published, on 25 August 2026, a supplement to its Model Personal Data Protection Framework titled to address protection of personal data privacy in the use of agentic artificial intelligence. This supplements the Commissioner's existing 2024 Model Framework and extends non-binding guidance into a category of automated, autonomously-acting AI systems that the original framework did not specifically address. As with the original framework, this guidance carries no binding legal force and does not itself create new statutory obligations under the Personal Data (Privacy) Ordinance. Taken together, these two developments indicate that Hong Kong's approach to biometric and algorithmic governance continues to operate primarily through the PCPD's existing enforcement powers under the Ordinance and through non-binding guidance, rather than through a dedicated biometric- or AI-specific statute. The Worldcoin finding demonstrates that biometric data processing is being actively reviewed and found wanting under the existing Data Protection Principles framework, even without AI- or biometric-specific legislation in place. #### Outlook Whether the Worldcoin investigation results in a published Enforcement Notice, and what specific remedial steps or restrictions it imposes, is the most consequential open question in this module going forward. Equally, whether the PCPD's Agentic-AI guidance supplement is followed by further sector-specific or binding rule-making, or remains non-binding guidance indefinitely, will determine whether Hong Kong's algorithmic-governance approach continues to rely solely on existing DPP-based enforcement extended by interpretation, or moves toward more specific statutory footing. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 56 words · 12 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Hong Kong: D9 Children & Vulnerable Groups5 sub-modulesRedEnacted in forceModule confidence: Probable▾ This is a legitimate regulatory gap: no comprehensive children/vulnerable-groups regime exists in the PDPO beyond passing references to minors. Primary framework Personal Data (Privacy) Ordinance (Cap. 486) — no dedicated minors regime Supervisory authority [PCPD](https://www.pcpd.org.hk/) Traffic-light rationale — Red This is a legitimate regulatory gap: no comprehensive children/vulnerable-groups regime exists in the PDPO beyond passing references to minors. D9 · Children's Privacy — Full Module Record 5 sub-modules · 32 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Hong Kong: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Enforcement powers and penalties are robust and binding (green-level for that sub-module), but collective redress and regulator-capacity sub-modules are unevidenced gaps, pulling the module to amber. Primary framework Personal Data (Privacy) Ordinance (Cap. 486) Supervisory authority [PCPD](https://www.pcpd.org.hk/) Traffic-light rationale — Amber Enforcement powers and penalties are robust and binding (green-level for that sub-module), but collective redress and regulator-capacity sub-modules are unevidenced gaps, pulling the module to amber. Periodic update · new data 2026-10-18 #### Enforcement & Redress The Privacy Commissioner for Personal Data published an Investigation Report on 23 April 2026 concerning a ransomware-caused data breach at Yau Yat Chuen Garden City Club. The investigation found failures under Data Protection Principle 4's security-measures standard, specifically identifying an absence of authentication controls governing third-party remote server access as a contributing cause of the breach. Following this finding, the Commissioner served an Enforcement Notice on the organisation. This action illustrates the PCPD's standing approach to security-measure failures: under the Ordinance, breach of an Enforcement Notice itself constitutes a criminal offence, carrying a fine of up to HK$50,000 and imprisonment, though the underlying security-measure failure identified in an Investigation Report is not itself separately finable absent a subsequent Enforcement Notice breach. This action sits within Hong Kong's distinctive enforcement-power ceiling: the Commissioner has no power to impose administrative fines directly, and every monetary penalty under the Ordinance requires a court conviction, most commonly for a subsequent breach of an Enforcement Notice rather than for the underlying data-protection failure itself. This structure means the Commissioner's primary enforcement tool for a security-measures failure such as this one is the Enforcement Notice itself, which compels specific remedial steps rather than imposing an immediate financial penalty. This enforcement action also arrives alongside separately-reported statistics on voluntary data-breach notification: the PCPD received 246 voluntary notifications in 2025, a 21 percent increase on 203 in 2024, with roughly a third involving hacking. Hong Kong continues to have no statutory mandatory breach-notification requirement, so the Yau Yat Chuen matter and the broader 2025 notification statistics both arise from a voluntary-notification and Commissioner-initiated-investigation regime rather than a mandatory reporting duty. #### Outlook The Yau Yat Chuen Enforcement Notice, read alongside rising voluntary breach-notification volumes and roughly a third of 2025 notifications involving hacking, points to continuing growth in ransomware and hacking-related data-security incidents within Hong Kong notwithstanding the absence of a mandatory reporting duty. Whether this pattern eventually revives the stalled 2020 PDPO reform package, including its proposed mandatory breach-notification and administrative fining-power provisions, remains an open structural question beyond the Commissioner's current enforcement toolkit. Periodic update · new data 2026-10-11 #### Enforcement & Redress The Office of the Privacy Commissioner for Personal Data's own 2025 annual reporting, released via a February 2026 press statement, shows a marked rise in enforcement activity. The PCPD received 4,228 complaints in 2025, up 23 percent on the prior year, and initiated 435 compliance checks, up 9 percent. It handled 308 doxxing cases, pursuing 147 criminal investigations and issuing 32 cessation notices to 13 platforms, while reporting a compliance rate above 98 percent. These figures come directly from the regulator's own publication and represent a confirmed escalation in enforcement volume across complaints handling, proactive compliance checking, and doxxing-specific action. This enforcement intensification occurs within a penalty structure under the Personal Data (Privacy) Ordinance, Cap.486 that has not itself changed: failure to comply with a PCPD enforcement notice remains a criminal offence, punishable by a fine of up to HK$50,000 and imprisonment for up to two years, together with a daily penalty of HK$1,000 for continuing non-compliance. The combination of rising enforcement activity and a long-standing, comparatively modest statutory penalty ceiling creates a widening gap between the volume of regulatory action and the maximum financial consequence available under current law, a gap the revived breach-notification and administrative-fining reform discussed under Controller/Processor Duties would be intended to address. #### Outlook Whether 2026 enforcement volumes continue the 2025 trajectory, particularly in doxxing-related cessation notices, is the principal indicator to watch, alongside whether the unchanged statutory penalty ceiling becomes a more visible point of public or legislative pressure given the widening gap between enforcement activity and available sanctions. Periodic update · new data 2026-09-28 #### Enforcement & Redress Hong Kong's data-protection enforcement and redress picture intensified this cycle in observed volume even as the underlying statutory architecture remained unchanged. Personal data breach notifications and detections rose to 217 cases in 2024, a marked increase from a stable baseline of roughly 100 cases per year in prior years, according to a January 2025 government reply to the Legislative Council. This is a confirmed, primary-sourced government figure and represents more than a doubling of the prior stable baseline. This rise in observed breach activity has occurred despite the Personal Data (Privacy) Ordinance still lacking a mandatory personal data breach notification regime. The Privacy Commissioner for Personal Data responded to this gap through non-binding guidance rather than legislation: updated 'Guidance on Data Breach Handling and Data Breach Notifications' was issued in 2026, clarifying the Commissioner's expectations for breach handling without creating a statutory notification duty. The Personal Data (Privacy) Ordinance also continues to lack a direct administrative fining power for the Privacy Commissioner of the kind available under the European Union's General Data Protection Regulation; reform proposals addressing mandatory notification, processor regulation and administrative fines remain under study rather than enacted. A supporting judgment drawn from this cycle's evidence assesses that Hong Kong's enforcement posture is intensifying in observed practice even as the binding statutory gaps — no mandatory notification duty, no direct administrative fining power — remain unresolved, widening the gap between observed breach volume and the regulator's binding legal powers to compel disclosure or penalise non-compliance. It remains unconfirmed whether any amendment bill addressing mandatory breach notification, processor regulation, or administrative fining powers has been introduced to the Legislative Council since reports from autumn 2024 indicated the reform effort had been placed on hold; this is recorded as an open gap rather than an assertion that no such bill exists. #### Outlook The central question to watch is whether the stalled reform package — covering mandatory breach notification, processor regulation and administrative fining powers — is revived and introduced to the Legislative Council, particularly given that observed breach volume more than doubled in 2024 relative to the prior stable baseline. Until such a bill is introduced, organisations will continue to operate under the Privacy Commissioner's non-binding guidance rather than a statutory notification duty, and confirmation of the current legislative status of any reform bill would materially sharpen this cycle's assessment. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 44 words · 20 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (14 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 13-22 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 32-34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 37-39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44-49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77-84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties