Definition of a data user in Hong Kong's PDPO

What Is a Data User Under Hong Kong Privacy Law

Under the Personal Data (Privacy) Ordinance (Cap. 486), a data user controls the collection, holding, processing or use of personal data. The term is central to the PDPO and determines who bears the legal duties for protecting personal data.

A data user hong kong may be an individual, a company, a government department or any other body that alone or jointly with others decides the purpose and manner of handling personal data. The data user determines what data is collected, how it is used and for how long it is retained.

PDPO Data User Definition

The PDPO defines a data user as a person who controls the collection, holding, processing or use of personal data. This definition appears in section 2 of Cap. 486. The term covers both the entity that originally collects the data and any entity to which the data is transferred for processing, provided that entity exercises control over the data.

Hong Kong Data Protection Responsibilities

A data user must comply with the six data protection principles set out in the PDPO. These principles govern the collection, accuracy, retention, security, use and openness of personal data. The data user must also respond to data access requests from data subjects and must not use personal data for direct marketing without the data subject's consent.

Personal Data Collection Statement Hong Kong

When collecting personal data, a data user must provide a Personal Information Collection Statement to the data subject. The statement must explain the purpose of collection, the classes of persons to whom the data may be transferred, and the data subject's right to request access to and correction of the data. This requirement is set out in data protection principle 1(3) of the PDPO.

Data User Obligations Hong Kong

The Office of the Privacy Commissioner for Personal Data enforces the PDPO. A data user must take all practicable steps to ensure that personal data is protected against unauthorised or accidental access, processing, erasure, loss or use. The data user must also retain personal data no longer than necessary for the purpose for which it was collected.