Personal Data Privacy Ordinance Hong Kong PDPO

Personal Data Privacy Ordinance Hong Kong

The personal data privacy ordinance hong kong is the Personal Data (Privacy) Ordinance (Cap. 486), commonly referred to as the PDPO. This is Hong Kong's primary data protection law, governing the collection, use, handling, and security of personal data. The Ordinance applies to any person or organisation controlling the collection, holding, processing or use of personal data in Hong Kong.

PDPO Hong Kong

The PDPO establishes a statutory framework for protecting individual privacy in relation to personal data. It sets out the rights of data subjects and the obligations of data users. Enforcement is provided through the Office of the Privacy Commissioner for Personal Data.

Hong Kong Data Protection Law

Enforcement falls to the Office of the Privacy Commissioner for Personal Data, an independent statutory body. The Commissioner investigates complaints and conducts inspections. The Commissioner may issue enforcement notices requiring a data user to remedy a contravention of the Ordinance.

Office of the Privacy Commissioner

The Office of the Privacy Commissioner for Personal Data is the regulatory authority under the PDPO. It issues codes of practice and promotes awareness of data protection obligations. The office also handles complaints from individuals whose personal data privacy has been breached.

Data Protection Principles Hong Kong

Six data protection principles (DPPs) form the core of the PDPO. These govern:

• Collection - personal data must be collected lawfully and fairly, and the data subject must be informed of the purpose.
• Accuracy and retention - data must be accurate and not kept longer than necessary.
• Use - personal data may only be used for the purpose for which it was collected, or a directly related purpose.
• Security - a data user must take practicable steps to safeguard personal data from unauthorised access, processing, erasure or loss.
• Openness - a data user must make its personal data policies and practices known.
• Access and correction - a data subject has the right to request access to and correction of their personal data.

A data user must provide a Personal Information Collection Statement (PICS) at or before the time of collection. Consent is required for using personal data in direct marketing, and the data subject may opt out at any time without charge.