Hong Kong Regulatory Compliance Services

The PDPO incorporates six Data Protection Principles covering:

• Purpose and manner of collection.
• Accuracy and duration of retention.
• Use of personal data.
• Data security.
• Transparency and access to personal data policies.
• Access to and correction of personal data.

Organizations using personal data for direct marketing may need to provide prescribed information and obtain the data subject's consent where required before using the information for that purpose. Additional rules apply when personal data is provided to another person for direct marketing in return for a gain.

Businesses should review:

• How marketing data is collected and used.
• Whether the required notifications have been provided.
• Whether consent has been obtained where required.
• How consent and marketing preferences are recorded.
• How opt-out requests are processed.
• How customer information is shared with marketing partners.

Under the existing PDPO framework, there is no general mandatory personal data breach notification requirement equivalent to the mandatory notification regimes in some other jurisdictions. The Privacy Commissioner for Personal Data recommends notification in appropriate circumstances, and other legal, contractual, or sector-specific requirements may apply.

Proposals to strengthen Hong Kong's privacy framework have included mandatory breach notification, direct regulation of data processors, and enhanced enforcement powers. Organizations should distinguish proposed reforms from requirements currently in force.

A structured breach-management process can help organizations:

• Identify and assess suspected incidents.
• Contain the incident and investigate its impact.
• Determine whether notification is advisable or legally required.
• Coordinate communications with affected individuals and relevant stakeholders.
• Document remediation measures.
• Review controls to reduce the likelihood of recurrence.

The Ordinance establishes statutory obligations for designated operators of critical infrastructures to protect relevant computer systems. Its scope includes designated operators in sectors such as energy, information technology, banking and financial services, transportation, healthcare, telecommunications, and other critical infrastructure areas.

Depending on designation and the applicable requirements, obligations may include organizational security arrangements, computer-system security management plans, risk assessments, security audits, incident reporting, and other preventive and response measures.

Organizations should determine whether they have been designated as covered operators or are otherwise affected by relevant requirements. They should not assume that every business in Hong Kong is directly subject to the Ordinance.

Depending on the communication and its circumstances, requirements may concern consent, sender identification, unsubscribe mechanisms, and the handling of opt-out requests.

Businesses using email marketing, SMS campaigns, promotional communications, and automated customer engagement should assess the Ordinance alongside the PDPO's direct marketing requirements.

The Digital Policy Office published the Hong Kong Generative Artificial Intelligence Technical and Application Guideline in April 2025, with subsequent revisions announced in December 2025. The Office of the Privacy Commissioner for Personal Data also publishes guidance on responsible AI use and personal data protection.

These materials provide guidance but should not automatically be treated as generally binding legislation. Existing privacy, confidentiality, consumer protection, intellectual property, and sector-specific laws may nevertheless apply to AI-related activities.

Organizations developing, procuring, or using AI should consider:

• Maintaining an inventory of AI systems and use cases.
• Assessing risks associated with personal data and sensitive information.
• Defining accountability and human oversight.
• Reviewing data quality, accuracy, transparency, and security.
• Establishing policies for employee use of generative AI.
• Documenting governance decisions and risk controls.
• Monitoring relevant Hong Kong and international developments.

Depending on the organization and its regulatory status, relevant expectations may arise from the Hong Kong Monetary Authority (HKMA), Securities and Futures Commission (SFC), Insurance Authority (IA), or other competent authorities.

Financial institutions should assess their applicable requirements for:

• Information security and technology risk management.
• Third-party and outsourcing arrangements.
• Operational resilience and business continuity.
• Incident escalation and reporting.
• Personal data protection.
• AI governance and model risk management.

Examples include:

• GDPR: May apply to Hong Kong organizations offering goods or services to individuals in the EU or monitoring their behavior where the GDPR's territorial-scope conditions are met.
• EU AI Act: May apply to relevant AI systems and organizations where its territorial and other scope requirements are satisfied.
• Other international privacy laws: May apply where organizations process personal data in other jurisdictions or serve customers in those markets.