Hong Kong's privacy law still has no mandatory breach notification and no administrative fines, which leads some organisations to treat it as light touch, but a Data Protection Principle 4 failure still brings an investigation, a published report, an enforcement notice and, if the notice is ignored, a criminal offence. The Personal Data (Privacy) Ordinance (Cap. 486, the PDPO) is principle based: six Data Protection Principles (DPPs) in Schedule 1 govern how data users collect, keep, use, secure and give access to personal data. This guide explains who the PDPO covers, what each DPP means for security and engineering teams, where the long-running reform stands as of October 2026, how the Privacy Commissioner for Personal Data (PCPD) enforces, and what it means for service accounts, API keys and AI agents that process personal data. It is written for security, privacy and engineering leads with Hong Kong operations or Hong Kong customers. For how Hong Kong sits alongside other jurisdictions, see the Global Privacy Regulatory Map.
Key takeaways
- Six principles, one security duty. DPP4 requires all practicable steps to protect personal data against unauthorised or accidental access, processing, erasure, loss or use, and it is the principle most PCPD breach investigations turn on.
- Breach notification is still voluntary. The PCPD's June 2023 guidance asks data users to notify it and affected individuals as soon as practicable, but no statutory duty or deadline exists as of October 2026.
- Reform is proposed, not enacted. Mandatory notification, direct regulation of data processors, retention policies and administrative fines have been on the table since January 2020; the government said in January 2025 it was still studying them and might phase them in.
- Doxxing is the one reform that passed. The Personal Data (Privacy) (Amendment) Ordinance 2021 took effect on 8 October 2021 with two-tier offences of up to HK$1,000,000 and five years' imprisonment, plus cessation notices with extra-territorial reach.
- Processors are covered through contracts. Because the PDPO does not regulate data processors directly, DPP2(3) and DPP4(2) make the data user responsible for contractual controls over any vendor, cloud service or automated pipeline that handles its data.
Scope: who and what is covered
The PDPO applies to any data user, meaning a person who, alone or with others, controls the collection, holding, processing or use of personal data. It binds the private sector and the Hong Kong government alike. Personal data is information relating directly or indirectly to a living individual, from which it is practicable to ascertain the individual's identity, in a form in which access or processing is practicable. The January 2020 government paper proposed widening this from "identified" to "identifiable" persons; that change has not been made.
| Who or what | Position under the PDPO | Practical note for security teams |
|---|---|---|
| Data users (private and public sector) | Bound by all six DPPs and the Ordinance's offences | Includes overseas groups that control data in or from Hong Kong |
| Data processors | Not directly regulated; defined in DPP2(4) and DPP4(3) as a person processing data on behalf of another and not for its own purposes | Cloud, SaaS, outsourced IT and managed service providers; controls flow through contracts |
| Machine-held data | Covered wherever identity is practicably ascertainable | Logs, tickets, telemetry with account IDs, and prompts sent to AI tools can all hold personal data |
| Transfers outside Hong Kong | Section 33 restricts transfers but has never been brought into operation | Cross-border transfers are governed in practice by DPP1, DPP3 and DPP4 plus PCPD guidance |
| Doxxing disclosures | Section 64 offences since 8 October 2021 | Applies to any person, not only data users |
| Direct marketing | Part 6A consent and opt-out rules | Separate offences; owned by marketing and legal |
Cross-border flows and the Greater Bay Area
Since section 33 is not in force, there is no statutory adequacy or transfer mechanism. For flows with the Mainland, the government and the Cyberspace Administration of China signed a memorandum in June 2023 and launched the Standard Contract for Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area at the end of 2023. From 1 November 2024 the facilitation measure was opened to all sectors, covering Hong Kong and nine Mainland GBA cities, and parties adopt it on a voluntary basis. Transfers into the Mainland outside the GBA arrangement fall under Mainland rules: see the China PIPL Guide and the International Data Transfers Map.
Key obligations
The six DPPs are short and outcome based. The table pairs each with the evidence a security or engineering team is usually asked for during a PCPD inquiry.
| Principle | What it requires | Security and engineering evidence |
|---|---|---|
| DPP1 Purpose and manner of collection | Collect only for a lawful purpose directly related to a function of the data user, data adequate but not excessive, by lawful and fair means; inform the data subject of purposes, transferees and access rights | Data inventories per system, collection notices (PICS) tied to forms and APIs |
| DPP2 Accuracy and duration of retention | Take practicable steps to keep data accurate and not keep it longer than necessary; DPP2(3) requires contractual or other means to stop processors keeping data longer than necessary | Retention schedules, deletion jobs, backup expiry, processor deletion clauses |
| DPP3 Use of personal data | Use only for the original or a directly related purpose unless the data subject gives prescribed (express, voluntary) consent | Purpose tags on datasets, reviews before analytics or AI training reuse |
| DPP4 Security of personal data | All practicable steps against unauthorised or accidental access, processing, erasure, loss or use, considering the kind of data, harm, storage location, security of equipment, staff integrity and transmission; DPP4(2) requires contractual or other means for processors | Access control, MFA, encryption, patching, logging, vendor security schedules |
| DPP5 Information to be generally available | Make policies and practices on personal data, the kinds held and the main purposes publicly available | Privacy policy statement kept in line with actual systems |
| DPP6 Access to personal data | Data subjects may request access and correction; data access requests answered within 40 days | Ability to locate an individual's data across systems, including logs and AI tools |
DPP4 in practice
"All practicable steps" is not a checklist, so the PCPD judges reasonableness against the sensitivity of the data and the harm a breach could cause. The factors written into DPP4(1) map cleanly onto technical controls:
- Kind of data and harm: classify identity card numbers, financial and health data as high impact, and apply stronger controls to stores that hold them. See the Data Classification Guide.
- Physical location: know which region and provider holds each store, including backups and AI tool workspaces.
- Security of equipment: hardened hosts, patched internet-facing services, encryption at rest and in transit (NIST CSF 2.0 PR.DS-01, PR.DS-02).
- Integrity, prudence and competence of staff: least privilege and periodic access review for every account with data access (PR.AA-05, SP 800-53 AC-6), including service accounts that no single person owns.
- Secure transmission: authenticated, encrypted channels for transfers, with credentials for those channels managed, rotated and logged (SP 800-53 IA-5).
Voluntary breach handling
The PCPD's Guidance on Data Breach Handling and Data Breach Notifications (June 2023) defines a data breach as a suspected or actual breach of the security of personal data held by a data user, which may amount to a DPP4 contravention. It sets out five steps: gather essential information (when, where, how detected, cause, data and people affected), contain the breach (change passwords and system settings, isolate systems, remove access rights), assess the risk of harm (personal safety, identity theft, financial loss, humiliation or reputational damage), consider notifying the PCPD, affected individuals and other parties, and document the breach. Notification uses the PCPD Data Breach Notification Form, online, by fax, in person or by post. Treat the guidance as the de facto standard: when the PCPD investigates, it asks how quickly and how fully these steps were followed. For a cross-jurisdiction view of deadlines, see the Breach Notification Laws by Country Guide.
Timeline and current status
| Date | Event | Status as of October 2026 |
|---|---|---|
| 1996 | PDPO in force (enacted 1995) | In force, Cap. 486 |
| 2012 to 2013 | Amendment Ordinance 2012 adds Part 6A direct marketing rules and higher penalties | In force |
| 20 January 2020 | Government paper to the LegCo Panel on Constitutional Affairs proposes six amendment directions, including notification to the PCPD within an example outer limit of five business days | Proposal only |
| 8 October 2021 | Personal Data (Privacy) (Amendment) Ordinance 2021 on doxxing takes effect | In force |
| June 2023 | PCPD Guidance on Data Breach Handling and Data Breach Notifications | Current guidance |
| End of 2023 and 1 November 2024 | GBA Standard Contract launched, then opened to all sectors | Voluntary mechanism in use |
| 11 June 2024 | PCPD Artificial Intelligence: Model Personal Data Protection Framework | Guidance |
| 22 January 2025 | Government reply to LegCo (LCQ2): amendments still being studied, possibly phased; breach cases about 100 a year, 217 in 2024 | No bill |
| 31 March 2025 | PCPD Checklist on Guidelines for the Use of Generative AI by Employees | Guidance |
| March 2026 | Government LegCo replies on AI regulation describe a cross-departmental review of whether laws keep pace with AI | Review under way; no PDPO bill announced |
The practical reading: plan for mandatory notification and processor obligations because the direction of travel has been stable for six years, but do not describe them as law. Check the PCPD and LegCo for a bill before relying on this table.
Enforcement and penalties
The PCPD investigates complaints and can start its own investigations. Where it finds a contravention it may serve an enforcement notice directing remedial steps. It cannot currently impose administrative fines. The penalties sit in criminal offences:
| Offence | Maximum penalty | Source |
|---|---|---|
| Contravening an enforcement notice (first conviction) | Fine of HK$50,000 and two years' imprisonment, plus HK$1,000 per day for a continuing offence | s50A, confirmed in the government reply of 22 January 2025 |
| Contravening an enforcement notice (subsequent conviction) | Fine of HK$100,000 and two years' imprisonment, plus HK$2,000 per day | s50A |
| Doxxing, tier 1 (summary) | Fine of HK$100,000 and two years' imprisonment | s64(3A) |
| Doxxing, tier 2 (indictable, specified harm caused) | Fine of HK$1,000,000 and five years' imprisonment | s64(3C) |
| Failing to comply with a doxxing cessation notice | Modelled on s50A: HK$50,000 and two years on first conviction | s66M |
| Disclosing data obtained from a data user without consent, for gain or to cause loss | Indictable offence under s64(1) | s64(1), unchanged in 2021 |
Individuals who suffer damage, including injury to feelings, from a contravention can also claim compensation in civil proceedings under section 66. For organisations the biggest practical cost is usually the published investigation report, which names the organisation and describes the security failures in detail. In the first six months of the 2021 doxxing powers, the Legislative Council was told of 368 complaints, 66 criminal investigations and 689 cessation notices to 13 platforms.
What it means for AI agents and non-human identities
The PDPO says nothing about machine identities, but DPP4 and DPP3 reach them by consequence: a leaked API key that exposes a customer database is a DPP4 failure, and an agent that reuses customer data for a new purpose is a DPP3 question.
- Service accounts and keys are "staff" for DPP4 purposes: the integrity and competence factor in DPP4(1) is about who can reach the data. Inventory every non-human identity with read access to personal data stores, give each an owner, scope it to the minimum, and rotate its secrets. See the Non-Human Identity (NHI) Guide and the Secrets Management Guide.
- AI tools are processors: a hosted model or agent platform that receives prompts containing personal data is processing on your behalf, so DPP2(3) and DPP4(2) require contract terms on retention, security and deletion.
- Purpose drift: feeding support tickets or CRM data into model fine-tuning or retrieval indexes may be a new purpose under DPP3. Record the purpose and assess it before the pipeline goes live.
- Human oversight: the PCPD's June 2024 Model Framework scales oversight to risk with three models (human-in-the-loop, human-in-command, human-out-of-the-loop) and treats credit decisions as higher risk than personalised advertising. Map each agent to one of these models.
- Employee use of generative AI: the March 2025 checklist asks organisations to define permitted tools, limit the personal data entered, require approved devices and strong credentials, and report AI incidents through an AI incident response plan. See the Generative AI Data Loss Prevention Guide.
- Access requests reach agent logs: DPP6 requests can include prompts, transcripts and agent action logs that identify the requester, so retain them deliberately and make them searchable. See the AI Agent Audit Trails for Regulators Guide.
Compliance steps
- Map data and owners: build an inventory of systems holding Hong Kong personal data, the purpose of each, its retention period and every human and non-human identity with access. Start with stores holding identity card numbers and financial data.
- Close the DPP4 basics: MFA on all remote and administrative access, least privilege for service accounts, encryption at rest, patching of internet-facing systems and centralised logging of access to personal data stores (SP 800-53 AU-2).
- Fix processor contracts: add DPP2(3) and DPP4(2) clauses to cloud, SaaS, outsourcing and AI tool agreements: security standards, breach notice to you within a set number of hours, deletion at end of contract, sub-processor approval (SP 800-53 SA-9).
- Adopt a breach procedure aligned with the PCPD guidance: the five steps, a named decision maker for notifying the PCPD and individuals, and a target to notify within five business days of awareness in line with the 2020 reform proposal. Test it with a tabletop that includes a leaked API key scenario. See the Incident Response Plan Template.
- Write a retention policy now: it is a reform direction and already required in substance by DPP2(2). See the Data Retention and Secure Deletion Guide.
- Govern AI use: apply the Model Framework's risk assessment to each AI system and issue employee generative AI rules based on the March 2025 checklist.
- Document cross-border flows: record transfers to the Mainland and overseas, and decide where the GBA Standard Contract applies.
- Review and roll forward: re-check reform status every six months; if a bill is introduced, gap-assess against its notification deadline and fine levels before it passes.
Small versus large organisations
A small business can meet DPP4 with a short asset list, MFA, managed endpoints, a standard vendor clause and a one-page breach procedure. A large group with Mainland and overseas operations needs a single breach process that meets the strictest clock it faces (often 72 hours elsewhere) and treats Hong Kong voluntary notification as a decision taken in the same meeting, not an afterthought.
Detection, measurement and framework mapping
Log and alert on bulk reads from personal data stores, new service principals or keys granted access to them, access from unusual locations and exports to unmanaged destinations (NIST CSF 2.0 DE.CM-03). Useful measures:
- Coverage: percentage of personal data stores with an accountable owner and complete access logging.
- Machine identity hygiene: percentage of service accounts and API keys with access to personal data that have an owner and were rotated within policy.
- Processor coverage: percentage of processors with DPP2(3) and DPP4(2) contract clauses in place.
- Breach decision time: hours from detection to a recorded decision on notifying the PCPD and individuals.
- Access request performance: percentage of data access requests answered within 40 days.
| PDPO requirement | NIST CSF 2.0 | NIST SP 800-53 Rev 5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Know and manage legal obligations | GV.OC-03 | PT-2 | A.5.31, A.5.34 |
| DPP4 access control and staff integrity | PR.AA-05 | AC-6, IA-5 | A.5.15, A.5.18, A.8.5 |
| DPP4 protection of stored and transmitted data | PR.DS-01, PR.DS-02 | SC-8, SC-28 | A.8.24 |
| DPP2(3) and DPP4(2) processors | GV.SC-05 | SA-9 | A.5.19, A.5.20 |
| DPP2 retention | PR.DS-01 | SI-12 | A.8.10 |
| Voluntary breach notification | RS.CO-02 | IR-6 | A.5.24, A.5.26 |
Common failure patterns
- Reading "voluntary" as "optional": organisations that delay telling the PCPD tend to face harder questions about containment and harm assessment when the incident becomes public anyway.
- No processor clauses: a vendor holding copies of customer data long after the contract ends is a DPP2(3) failure that belongs to the data user.
- Orphaned service accounts: credentials created for a migration or integration keep broad read access for years with no owner and no rotation.
- Logs that hold personal data but are never classified: verbose application and AI tool logs become an unprotected copy of the database.
- Planning only for today's law: building a breach process with no clock means retooling under pressure when mandatory notification arrives.
Practitioner checklist
- Inventory systems holding Hong Kong personal data, with purpose, retention period and owner.
- List every human and non-human identity with access to those systems and remove what is not needed.
- Enforce MFA, encryption at rest and centralised access logging on personal data stores.
- Add DPP2(3) and DPP4(2) clauses, including breach notice and deletion, to every processor contract, AI tools included.
- Adopt a breach procedure that follows the PCPD's five steps and targets a notification decision within five business days.
- Publish and maintain a privacy policy statement that matches actual systems (DPP5).
- Assess each AI system with the PCPD Model Framework and issue employee generative AI rules.
- Record cross-border transfers and where the GBA Standard Contract is used.
- Re-check reform status with the PCPD and LegCo every six months.
Standards and references
- PCPD: Guidance on Data Breach Handling and Data Breach Notifications
- Hong Kong Government: LCQ2 Review of the Personal Data (Privacy) Ordinance
- Legislative Council: Review of the Personal Data (Privacy) Ordinance, CB(2)512/19-20(03)
- Legislative Council Brief: Personal Data (Privacy) (Amendment) Bill 2021
- PCPD: Artificial Intelligence: Model Personal Data Protection Framework
- PCPD: Checklist on Guidelines for the Use of Generative AI by Employees
- Legislative Council Secretariat: Background brief on the PDPO review, CB(2)132/2023(03)
- Hong Kong Government: Extension of the GBA Standard Contract facilitation measure to all sectors
Related NHI Mgmt Group resources: Global Privacy Regulatory Map · China PIPL Guide · Singapore PDPA Guide · Breach Notification Laws by Country Guide · Privacy Programme Guide for Security Teams. This guide summarises the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) and PCPD guidance as of October 2026 and is not legal advice.