Data Protection Monitor
Global Privacy & Data Protection Intelligence

Hong Kong (HK) · Module Detail

Hong Kong: Lawful Processing & Special Data

← Full Hong Kong overview Build report with Hong Kong Request deeper dive

#

Functional equivalents exist via DPPs and guidance, but the absence of enumerated lawful bases and a codified special-category regime is a material structural gap versus GDPR.

Primary frameworkPersonal Data (Privacy) Ordinance (Cap. 486) — Data Protection Principles
Supervisory authorityPCPD
Traffic-light rationale — AmberFunctional equivalents exist via DPPs and guidance, but the absence of enumerated lawful bases and a codified special-category regime is a material structural gap versus GDPR.

Sub-modules (4)

Lawful BasesAmber

DPPs (esp. DPP1 collection limitation) function as the lawful-processing framework rather than an Art.6-style enumerated list.

Claims (1):

  • Data Protection Principle 1(1) provides that only necessary, adequate and not excessive personal data is to be collected for a lawful purpose, operating as PDPO's functional lawful-basis analogue.

Special CategoriesAmber

No enumerated special/sensitive-category regime exists in statute; PCPD guidance flags HKID numbers, biometric data and consumer credit data for heightened caution.

Claims (1):

  • The PCPD has published guidelines flagging Hong Kong identity card numbers, biometric data and consumer credit data as categories requiring special caution in collection and use, in the absence of a codified statutory special-category regime.

Pseudonymisation And AnonymisationAmber

PDPO does not statutorily define pseudonymised or anonymised data; PCPD's 2011 Guidance on Personal Data Erasure and Anonymisation addresses the anonymisation threshold.

Claims (1):

  • The PDPO does not address sensitive personal data, anonymisation, or pseudonymisation in the statute itself, though the PCPD has clarified aspects of anonymisation through non-binding guidance.
Category narrative53 words

PDPO does not use an enumerated GDPR Art.6-style lawful-basis list; instead, its six Data Protection Principles govern collection and use. There is no statutory special/sensitive-category regime; PCPD instead issues category-specific guidance (HKID numbers, biometric data, consumer credit data). Pseudonymisation and anonymisation are not defined in the statute, though PCPD guidance addresses anonymisation thresholds.

Sources and claims (4)
  1. ProbableIAPP — Data Protection Principle 1(1) provides that only necessary, adequate and not excessive personal data is to be collected for a lawful purpose, operating as PDPO's functional lawful-basis analogue.observed
  2. ProbableIAPP — Before using or providing personal data for direct marketing, a data user must inform the individual and obtain consent or an indication of no objection, and the individual may opt out at any time irrespective of prior consent.observed
  3. ProbableDataGuidance — The PCPD has published guidelines flagging Hong Kong identity card numbers, biometric data and consumer credit data as categories requiring special caution in collection and use, in the absence of a codified statutory special-category regime.observed
  4. ProbableDataGuidance — The PDPO does not address sensitive personal data, anonymisation, or pseudonymisation in the statute itself, though the PCPD has clarified aspects of anonymisation through non-binding guidance.observed