Data protection & privacy law in Hong Kong (2026)

Legal framework

Personal Data (Privacy) Ordinance (Cap. 486) (PDPO), enforced by the Office of the Privacy Commissioner for Personal Data (PCPD)

Key points: data & privacy in Hong Kong

1. 01Six Data Protection Principles

   The PDPO imposes six Data Protection Principles covering (1) purpose and manner of collection, (2) accuracy and retention, (3) use consistent with the original purpose, (4) security safeguards, (5) transparency of policies, and (6) data-subject access and correction. Data users must respond to access/correction requests within 40 days.

   pcpd.org.hk pcpd.org.hk

2. 02Supervisory authority

   The Office of the Privacy Commissioner for Personal Data (PCPD), established in 1996, is an independent statutory regulator with powers to investigate complaints, issue enforcement notices, and (since 2021) carry out criminal investigations and prosecutions for doxxing offences.

   pcpd.org.hk pcpd.org.hk

3. 03Anti-doxxing amendment (2021)

   The Personal Data (Privacy) (Amendment) Ordinance 2021, effective 8 October 2021, criminalised the non-consensual disclosure of personal data with intent or recklessness as to causing 'specified harm'. The indictable second-tier offence carries penalties up to HK$1,000,000 and 5 years' imprisonment, and the Commissioner may issue cessation notices to platforms.

   pcpd.org.hk pcpd.org.hk

4. 04Cross-border transfers (Section 33 not in force)

   Section 33 of the PDPO, which would restrict outbound transfers of personal data unless specified conditions are met, has never been brought into operation. The PCPD has instead issued guidance (2014, updated 2022) and recommended Model Contractual Clauses for data user-to-data user and data user-to-processor transfers.

   pcpd.org.hk pcpd.org.hk

5. 05Pending reforms

   In 2026 the PCPD has revived reform proposals including mandatory data-breach notification (to PCPD and affected individuals within around five business days), a direct administrative-fine power for the Commissioner, and widening the definition of 'personal data'. No enactment timetable has been confirmed.

   iapp.org hfw.com

6. 06Data subject rights and consent regime

   Data subjects have statutory rights of access, correction, and to be informed of collection purposes and classes of transferees. Use of personal data for a new purpose (including direct marketing) generally requires the data subject's prescribed consent; contravention of the direct-marketing rules is a criminal offence.

   elegislation.gov.hk pcpd.org.hk

Timeline of decisions

1. 31 Mar 2025Guidance · official
   PCPD issues Checklist on Guidelines for Use of Generative AI by Employees

   The Privacy Commissioner published a checklist to help organisations craft internal policies governing staff use of GenAI tools in compliance with the PDPO, extending its AI governance push to the workplace.

   PCPD

2. 23 Jan 2025Enforcement · official
   PCPD publishes Oxfam ransomware breach findings and 2024 work report

   Investigation into a ransomware attack exposing personal data of ~550,000 individuals led to an enforcement notice against Oxfam Hong Kong; the office also reported a near-30% rise in breach notifications (203 in 2024).

   PCPD

3. 1 Dec 2024Guidance
   Government signals PDPO reform: mandatory breach notification and administrative fines

   Proposed amendments under discussion would add a mandatory data-breach notification mechanism, data-retention policy requirements, and power for the PCPD to levy administrative fines, the most significant overhaul since 2021, expected to phase in toward 2026.

   Chambers and Partners

4. 11 Jun 2024Guidance · official
   PCPD releases 'AI: Model Personal Data Protection Framework'

   Hong Kong's first comprehensive AI-specific guidance set out a risk-based framework (three core values, seven ethical principles) for procuring, implementing and using AI, including generative AI, under the PDPO.

   PCPD

5. 1 Jun 2023Guidance · official
   PCPD issues revised data breach handling and notification guidance

   The Privacy Commissioner updated its guidance recommending notification of the PCPD and affected individuals as soon as practicable after a breach posing real risk of harm, still voluntary, pending a proposed mandatory regime.

   PCPD

6. 8 Oct 2021Law · official
   Anti-doxxing amendment (Personal Data (Privacy) (Amendment) Ordinance 2021) takes effect

   Criminalised non-consensual disclosure of personal data via a two-tier offence (up to 5 years' jail and HK$1m fine), and empowered the Commissioner to conduct criminal investigations, prosecute, and issue cessation notices to local and overseas platforms.

   PCPD

7. 6 Jun 2019Enforcement · official
   Enforcement notice against Cathay Pacific over 9.4 million-passenger breach

   Following a 2018 breach exposing data of ~9.4 million passengers, the Commissioner found Cathay breached data-security and data-retention principles and ordered system overhauls, multi-factor authentication, and erasure of unnecessary ID data.

   PCPD

8. 1 Apr 2013Law · official
   2012 Amendment Ordinance introduces direct-marketing regime

   Major amendments took effect adding strict consent/opt-out rules and criminal penalties for misuse of personal data in direct marketing, plus enhanced enforcement powers and a legal assistance scheme, prompted largely by the Octopus scandal.

   HK e-Legislation

9. 18 Oct 2010Enforcement · official
   Octopus Rewards investigation report

   The Commissioner found Octopus had sold the personal data of nearly 2 million cardholders for ~HK$44m and collected excessive data, breaching data-protection principles; the scandal triggered the CEO's resignation and the 2012 law reform.

   PCPD

10. 20 Dec 1996Law · official
    Personal Data (Privacy) Ordinance comes into force

    One of Asia's earliest comprehensive data protection laws took effect, establishing data-security obligations (Data Protection Principle 4) and the PCPD, the backbone of Hong Kong's data and cyber-incident enforcement before dedicated cyber law.

    PCPD

11. 20 Dec 1996Law · official
    PDPO enters into force; PCPD operational

    The Ordinance's main provisions and six Data Protection Principles took effect, with the Office of the Privacy Commissioner for Personal Data (established August 1996) as the independent regulator under the first Commissioner, Stephen Lau.

    PCPD

Sources

1. 1.pcpd.org.hk/english/data_privacy_law/ordinance_at_a_Glance/ordinance.html
2. 2.elegislation.gov.hk/hk/cap486
3. 3.pcpd.org.hk/english/data_privacy_law/6_data_protection_principles/principles.html
4. 4.pcpd.org.hk/english/data_privacy_law/amendments_2021/amendment_2021.html
5. 5.pcpd.org.hk/english/doxxing/index.html
6. 6.pcpd.org.hk/english/resources_centre/publications/guidance/fact1_intro_1.html
7. 7.pcpd.org.hk/english/about_pcpd/our_role/what_we_do.html
8. 8.iapp.org/news/a/hong-kong-amendments-to-hong-kong-personal-data-privacy-ordina
9. 9.pcpd.org.hk/english/about_pcpd/about.html
10. 10.pcpd.org.hk/english/resources_centre/publications/guidance/guidance.html
11. 11.hfw.com/insights/a-new-era-for-data-protection-in-hong-kong-legislative-updat