Data & Privacy · Hong Kong
Data protection & privacy law in Hong Kong (2026)
Hong Kong shaded by its data & privacy status
Data protection in Hong Kong: comprehensive law.
FrameworkPersonal Data (Privacy) Ordinance (Cap. 486) (PDPO), enforced by the Office of the Privacy Commissioner for Personal Data (PCPD)
Hong Kong has a comprehensive, principles-based data protection regime under the Personal Data (Privacy) Ordinance (Cap. 486), enacted in 1995 and in force since December 1996 — one of Asia's oldest such laws. It is administered by the independent Privacy Commissioner for Personal Data (PCPD), who as of 2026 is Ada Chung Lai-ling. The law was significantly amended in 2021 to criminalise doxxing, and further reforms (mandatory breach notification, direct administrative fines, an expanded definition of 'personal data') are actively under discussion but not yet enacted.
Key points
The PDPO imposes six Data Protection Principles covering (1) purpose and manner of collection, (2) accuracy and retention, (3) use consistent with the original purpose, (4) security safeguards, (5) transparency of policies, and (6) data-subject access and correction. Data users must respond to access/correction requests within 40 days.
The Office of the Privacy Commissioner for Personal Data (PCPD), established in 1996, is an independent statutory regulator with powers to investigate complaints, issue enforcement notices, and (since 2021) carry out criminal investigations and prosecutions for doxxing offences.
The Personal Data (Privacy) (Amendment) Ordinance 2021, effective 8 October 2021, criminalised the non-consensual disclosure of personal data with intent or recklessness as to causing 'specified harm'. The indictable second-tier offence carries penalties up to HK$1,000,000 and 5 years' imprisonment, and the Commissioner may issue cessation notices to platforms.
Section 33 of the PDPO, which would restrict outbound transfers of personal data unless specified conditions are met, has never been brought into operation. The PCPD has instead issued guidance (2014, updated 2022) and recommended Model Contractual Clauses for data user-to-data user and data user-to-processor transfers.
In 2026 the PCPD has revived reform proposals including mandatory data-breach notification (to PCPD and affected individuals within around five business days), a direct administrative-fine power for the Commissioner, and widening the definition of 'personal data'. No enactment timetable has been confirmed.
Data subjects have statutory rights of access, correction, and to be informed of collection purposes and classes of transferees. Use of personal data for a new purpose (including direct marketing) generally requires the data subject's prescribed consent; contravention of the direct-marketing rules is a criminal offence.
Timeline - major decisions & events
The Privacy Commissioner published a checklist to help organisations craft internal policies governing staff use of GenAI tools in compliance with the PDPO, extending its AI governance push to the workplace.
PCPD ↗Investigation into a ransomware attack exposing personal data of ~550,000 individuals led to an enforcement notice against Oxfam Hong Kong; the office also reported a near-30% rise in breach notifications (203 in 2024).
PCPD ↗Proposed amendments under discussion would add a mandatory data-breach notification mechanism, data-retention policy requirements, and power for the PCPD to levy administrative fines, the most significant overhaul since 2021, expected to phase in toward 2026.
Chambers and Partners ↗Hong Kong's first comprehensive AI-specific guidance set out a risk-based framework (three core values, seven ethical principles) for procuring, implementing and using AI, including generative AI, under the PDPO.
PCPD ↗Criminalised non-consensual disclosure of personal data via a two-tier offence (up to 5 years' jail and HK$1m fine), and empowered the Commissioner to conduct criminal investigations, prosecute, and issue cessation notices to local and overseas platforms.
PCPD ↗Following a 2018 breach exposing data of ~9.4 million passengers, the Commissioner found Cathay breached data-security and data-retention principles and ordered system overhauls, multi-factor authentication, and erasure of unnecessary ID data.
PCPD ↗Major amendments took effect adding strict consent/opt-out rules and criminal penalties for misuse of personal data in direct marketing, plus enhanced enforcement powers and a legal assistance scheme, prompted largely by the Octopus scandal.
HK e-Legislation ↗The Commissioner found Octopus had sold the personal data of nearly 2 million cardholders for ~HK$44m and collected excessive data, breaching data-protection principles; the scandal triggered the CEO's resignation and the 2012 law reform.
PCPD ↗The Ordinance's main provisions and six Data Protection Principles took effect, with the Office of the Privacy Commissioner for Personal Data (established August 1996) as the independent regulator under the first Commissioner, Stephen Lau.
PCPD ↗Hong Kong - other topics
Data & Privacy in other countries
Last verified 9/20/2026 · Orientation, not legal advice - verify against the primary sources linked above. Methodology & how to cite · State of Technology Regulation 2026 · Explore the full world map →