Website privacy policy requirements under Hong Kong law
Under the PDPO, a Hong Kong website that collects personal data must have a privacy policy or Personal Information Collection Statement to inform users.
Do I Need a Privacy Policy on My Website?
Yes. If your website collects personal data from individuals in Hong Kong, the Personal Data (Privacy) Ordinance (Cap. 486) requires a Personal Information Collection Statement (PICS). A privacy policy on a website Hong Kong operators publish is the standard way to provide this. The policy must be given at or before the time of collection.
The PDPO's six data protection principles demand transparency. A privacy policy or PICS on a website informs users what data is collected, why it is collected, and how it is used, fulfilling the legal obligation to provide notice upon collection.
PDPO Privacy Policy Requirement
The Personal Data (Privacy) Ordinance (PDPO) applies to any person or organisation controlling the collection of personal data in Hong Kong. A website collecting names, email addresses, phone numbers, IP addresses, or any information that can identify an individual is collecting personal data. The data user - the person who controls the collection - must give the data subject a PICS at or before the time of collection.
The PICS must state: - Whether it is obligatory or voluntary to supply the data - The purpose for which the data will be used - The classes of persons to whom the data may be transferred - The data subject's right to access and correct the data - The name and address of the person handling data access requests
A privacy policy on a website is the practical way to meet this requirement for online collection.
Do I Need a Privacy Policy
You need a privacy policy if your website collects any personal data from individuals in Hong Kong. Common examples include: - Contact forms that capture names and email addresses - Newsletter sign-up forms - Account registration pages - E-commerce checkout pages that collect delivery addresses and payment information - Analytics tools that record IP addresses and browsing behaviour
If your website does not collect any personal data at all - for example, a simple brochure site with no forms, no cookies, and no analytics - you may not need a privacy policy. Most commercial websites collect some data, even if only through analytics or server logs.
Drafting a Privacy Policy on Website Hong Kong Businesses Publish
A website privacy statement Hong Kong businesses publish should follow the PDPO's requirements. The statement is the PICS made available on the website. It should be: - Easily accessible, typically from a link in the website footer - Written in clear, plain language - Updated when data practices change
The privacy statement should cover all collection points on the website. If you use cookies, the statement should explain what cookies are used and for what purpose. The Office of the Privacy Commissioner for Personal Data (PCPD) publishes guidance on the content and presentation of privacy statements.
What to Include in Your Privacy Policy
A compliant privacy policy for a Hong Kong website should address:
| Element | What to state |
|---|---|
| Identity of the data user | Your company name and contact details |
| Purpose of collection | Why you collect each type of data |
| Data transfers | Whether data is shared with third parties or transferred outside Hong Kong |
| Retention period | How long you keep the data |
| Data subject rights | How users can access, correct, or request deletion of their data |
| Direct marketing | If you use data for marketing, the opt-out mechanism |
| Cookies | What cookies are used and how users can manage them |
Direct Marketing and Consent
Using personal data from your website for direct marketing triggers PDPO requirements. You must inform the data subject and obtain consent. The data subject must be told: - That you intend to use their data for direct marketing - The classes of goods, services or facilities marketed - That they may opt out at any time
A data subject may require you to cease using their data for direct marketing at any time. You must comply without charge.
What to Do Next
Review your website to identify all points where personal data is collected. Draft a privacy policy that covers each collection point and publish it on your website. If you use third-party services such as analytics or payment processors, ensure your policy discloses those transfers. Keep the policy under review and update it when your data practices change.
Sources
More on answers.