Hong Kong's six data protection principles explained

Hong Kong's Six Data Protection Principles Explained

The Personal Data (Privacy) Ordinance (Cap. 486) establishes six data protection principles (DPPs) that form the core of Hong Kong's privacy law. These data protection principles Hong Kong govern the entire lifecycle of personal data, from collection through to access and correction. The Office of the Privacy Commissioner for Personal Data oversees compliance with these rules.

DPP 1: Collection and Purpose

Collect personal data only for a lawful purpose directly related to your function or activity. The collection must be necessary. Inform the data subject of the purpose and the classes of persons to whom the data may be transferred.

DPP 2: Accuracy and Retention

Take practicable steps to ensure personal data is accurate. Do not keep data longer than necessary for the purpose for which it was collected.

DPP 3: Use

Use personal data only for the purpose for which it was collected or a directly related purpose. Any new use requires the prescribed consent of the data subject.

DPP 4: Security

Take practicable steps to protect personal data from unauthorised or accidental access, processing, erasure, loss or use.

DPP 5: Openness

Make available your policies and practices in relation to personal data. This includes the kinds of personal data held and the main purposes for which it is used.

DPP 6: Data Access and Correction

A data subject has the right to request access to and correction of their personal data. You must comply with such requests unless grounds for refusal under the PDPO apply.