--- title: "Hong Kong — Sectoral Watch | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/hong-kong/sectoral-watch/ source_html: /jurisdictions/hong-kong/sectoral-watch/index.html description: "Hong Kong — Sectoral Watch: sectoral_watch Sectoral Watch 7 sub-modules 5 claims Amber ▾ # Financial-sector overlay is well-evidenced; health, telecoms/ePrivacy, employment, and education sub-modules are thin or" generated_at: 2026-10-25T04:46:50Z content_sha256: ee49832bf9a29cae4b3a07dbd41a6749845e730127e98abe2bb93707a7e95782 generator: "fe-fleet/md-twin@1.0" --- # Hong Kong — Sectoral Watch | Data Protection Monitor ### D6Sectoral Watch7 sub-modules5 claimsAmber▾# Financial-sector overlay is well-evidenced; health, telecoms/ePrivacy, employment, and education sub-modules are thin or unevidenced. Primary framework PDPO overlaid by HKMA/Insurance Authority/SFC sectoral guidelines Supervisory authority [PCPD](https://www.pcpd.org.hk/) Traffic-light rationale — Amber Financial-sector overlay is well-evidenced; health, telecoms/ePrivacy, employment, and education sub-modules are thin or unevidenced. #### Sub-modules (7) #### Financial Sector OverlayAmber HKMA, Insurance Authority, and SFC issue customer-data circulars/guidelines applicable to licensed institutions, overlaying general PDPO duties. Claims (2): - There are no sectoral data privacy laws as such in Hong Kong, but certain industry-specific requirements are imposed by relevant regulators in respect of customer data held by regulated entities. - The Hong Kong Monetary Authority has issued several circulars and guidelines relating to protection and confidentiality of customer data applicable to all licensed banks under the Banking Ordinance (Cap. 155). #### Health Sector OverlayRed No dedicated health-sector data-privacy statute (e.g., HIPAA-equivalent) was identified in this research pass. Absence provenance: unavailable . Searched: Hong Kong health data privacy sectoral law, Hong Kong medical data protection statute. #### Telecoms And EprivacyRed No dedicated telecoms/ePrivacy-style cookie-and-communications-specific statute was identified. Absence provenance: unavailable . Searched: Hong Kong ePrivacy telecoms data law, Hong Kong cookie law telecoms. #### Employment DataAmber Retention limitation rules require employee personal data not be kept beyond the period necessary after termination of employment absent a subsisting reason. Claims (1): - Under DPP2(2)/Section 26, employee personal data must not be kept longer than necessary after the end of employment, unless a subsisting reason requires the employer to hold the data longer. #### Credit And ScoringAmber PCPD guidance flags consumer credit data as a category requiring heightened caution in collection and use. Claims (1): - The PCPD has published guidelines on the collection and use of consumer credit data, requiring caution and setting practical guidance on proper collection and use. #### EducationRed No dedicated education-sector data-privacy rules were identified in this research pass. Absence provenance: unavailable . Searched: Hong Kong education sector data privacy rules PCPD. #### InsuranceAmber The Insurance Authority requires authorised insurers to implement cybersecurity frameworks protecting policyholder personal data. Claims (1): - The Insurance Authority has issued a Guideline on Cybersecurity requiring authorised insurers to implement robust cybersecurity frameworks to protect the personal data of existing or potential policyholders. Category narrative 40 words Hong Kong has no standalone sectoral data-privacy statutes; instead, sector regulators (HKMA, Insurance Authority, SFC) issue circulars and guidelines overlaying the PDPO for regulated entities' customer data, and PCPD issues category-specific guidance for sensitive data types including consumer credit data. no periodic updates on record for this sub-brief Evidence 5 Sources and claims (5) - Probable[DataGuidance](https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf) — There are no sectoral data privacy laws as such in Hong Kong, but certain industry-specific requirements are imposed by relevant regulators in respect of customer data held by regulated entities.observed 2026-08-03 - Probable[DataGuidance](https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf) — The Hong Kong Monetary Authority has issued several circulars and guidelines relating to protection and confidentiality of customer data applicable to all licensed banks under the Banking Ordinance (Cap. 155).observed 2026-08-03 - Probable[DataGuidance](https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf) — Under DPP2(2)/Section 26, employee personal data must not be kept longer than necessary after the end of employment, unless a subsisting reason requires the employer to hold the data longer.observed 2026-08-03 - Probable[DataGuidance](https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf) — The PCPD has published guidelines on the collection and use of consumer credit data, requiring caution and setting practical guidance on proper collection and use.observed 2026-08-03 - Probable[DataGuidance](https://www.dataguidance.com/sites/default/files/hong_kong_-_third_country_assessment_guidance_note_dataguidance.pdf) — The Insurance Authority has issued a Guideline on Cybersecurity requiring authorised insurers to implement robust cybersecurity frameworks to protect the personal data of existing or potential policyholders.observed 2026-08-03