---
title: "Hong Kong — Lawful Processing & Special Data | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/hong-kong/lawful-processing-and-special-data/
source_html: /jurisdictions/hong-kong/lawful-processing-and-special-data/index.html
description: "Hong Kong — Lawful Processing & Special Data: lawful_processing_and_special_data Lawful Processing & Special Data 4 sub-modules 4 claims Amber ▾ # Functional equivalents exist via DPPs and guidance, but the absence of enumerat"
generated_at: 2026-10-25T04:46:50Z
content_sha256: 14a88003a9180fe770829264b25bd254a129d81d95f5f10176e2f71872fc5266
generator: "fe-fleet/md-twin@1.0"
---
# Hong Kong — Lawful Processing & Special Data | Data Protection Monitor

### D2Lawful Processing & Special Data4 sub-modules4 claimsAmber▾#

Functional equivalents exist via DPPs and guidance, but the absence of enumerated lawful bases and a codified special-category regime is a material structural gap versus GDPR.

Primary framework Personal Data (Privacy) Ordinance (Cap. 486) — Data Protection Principles

Supervisory authority [PCPD](https://www.pcpd.org.hk/)

Traffic-light rationale — Amber Functional equivalents exist via DPPs and guidance, but the absence of enumerated lawful bases and a codified special-category regime is a material structural gap versus GDPR.

#### Sub-modules (4)

#### Lawful BasesAmber

DPPs (esp. DPP1 collection limitation) function as the lawful-processing framework rather than an Art.6-style enumerated list.

Claims (1):

- Data Protection Principle 1(1) provides that only necessary, adequate and not excessive personal data is to be collected for a lawful purpose, operating as PDPO's functional lawful-basis analogue.

#### Consent ThresholdsGreen

Direct-marketing provisions (Part VIA) require informed consent or an express 'no objection' before use, with a standing right to opt out.

Claims (1):

- Before using or providing personal data for direct marketing, a data user must inform the individual and obtain consent or an indication of no objection, and the individual may opt out at any time irrespective of prior consent.

#### Special CategoriesAmber

No enumerated special/sensitive-category regime exists in statute; PCPD guidance flags HKID numbers, biometric data and consumer credit data for heightened caution.

Claims (1):

- The PCPD has published guidelines flagging Hong Kong identity card numbers, biometric data and consumer credit data as categories requiring special caution in collection and use, in the absence of a codified statutory special-category regime.

#### Pseudonymisation And AnonymisationAmber

PDPO does not statutorily define pseudonymised or anonymised data; PCPD's 2011 Guidance on Personal Data Erasure and Anonymisation addresses the anonymisation threshold.

Claims (1):

- The PDPO does not address sensitive personal data, anonymisation, or pseudonymisation in the statute itself, though the PCPD has clarified aspects of anonymisation through non-binding guidance.

Category narrative 53 words

PDPO does not use an enumerated GDPR Art.6-style lawful-basis list; instead, its six Data Protection Principles govern collection and use. There is no statutory special/sensitive-category regime; PCPD instead issues category-specific guidance (HKID numbers, biometric data, consumer credit data). Pseudonymisation and anonymisation are not defined in the statute, though PCPD guidance addresses anonymisation thresholds.

Evidence 4

Sources and claims (4)
- Probable[IAPP](https://iapp.org/news/a/new-privacy-requirements-for-direct-marketing-are-you-compliant-) — Data Protection Principle 1(1) provides that only necessary, adequate and not excessive personal data is to be collected for a lawful purpose, operating as PDPO's functional lawful-basis analogue.observed 2026-08-03
- Probable[IAPP](https://iapp.org/news/a/hong-kong-amendments-to-hong-kong-personal-data-privacy-ordinance) — Before using or providing personal data for direct marketing, a data user must inform the individual and obtain consent or an indication of no objection, and the individual may opt out at any time irrespective of prior consent.observed 2026-08-03
- Probable[DataGuidance](https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf) — The PCPD has published guidelines flagging Hong Kong identity card numbers, biometric data and consumer credit data as categories requiring special caution in collection and use, in the absence of a codified statutory special-category regime.observed 2026-08-03
- Probable[DataGuidance](https://www.dataguidance.com/sites/default/files/gdpr_v._pdpo_.pdf) — The PDPO does not address sensitive personal data, anonymisation, or pseudonymisation in the statute itself, though the PCPD has clarified aspects of anonymisation through non-binding guidance.observed 2026-08-03