The Hong Kong PDPO compliance checker

Yes. The Ordinance applies to every "data user" — anyone who controls the collection, holding or use of personal data in Hong Kong. There is no small-business exemption and no registration threshold: one employee's HR file, one customer database or one CCTV camera is enough. What scales with size is the risk, not the duty.

Generally no — and this surprises people who know GDPR or China's PIPL. The PDPO is notification-based: you must collect data fairly, for a stated purpose, and tell people that purpose on or before collection. Consent enters in two places: using data for a genuinely new purpose (DPP3) and direct marketing (Part 6A), where you need a response indicating no objection before the first message.

Not yet, as a general rule — notifying the PCPD is voluntary, done through its e-Data Breach Notification form, and recommended as soon as practicable. But the reform package revived in early 2026 proposes making notification mandatory within around five business days for breaches carrying a real risk of significant harm. Regulated firms often already have reporting duties from the HKMA, SFC or Insurance Authority, and contracts or overseas laws (GDPR, PIPL) can require notification regardless.

Yes. The PDPO's cross-border restriction (Section 33) has never been brought into force, so there is no blanket ban on offshore storage. The six principles still apply wherever the data sits: tell people in your PICS, keep it secure (DPP4), and bind the provider by contract (DPP4(2)). For flows into mainland China the direction matters — China's own rules apply, which is a different and stricter story.

Layered. Breaching a principle brings an enforcement notice; ignoring that notice is an offence (HK$50,000 and 2 years, plus daily fines, doubling on repeat). Direct marketing breaches are immediate offences at HK$500,000 and 3 years — HK$1,000,000 and 5 years if data was passed to others for gain. Failing to erase unneeded data or to answer an access request are offences too, and doxxing reaches HK$1,000,000 and 5 years. The reform package proposes adding administrative fines up to HK$10 million or 10% of turnover for serious cases — proposed, not yet law.

Only if the Part 6A steps happened: they were told, before first use, what data of theirs would be used and for what kinds of offers, they responded indicating no objection, the first message offered a free opt-out, and opt-outs are honoured immediately. "They're already a customer" is not an exemption, and prosecutions have followed single ignored opt-outs. If your list can't show who consented to what, fix that before the next campaign.

Only where the PCPD's Code of Practice on the Identity Card Number allows it — typically where a statute requires identification or the code specifically permits it (employment is one, once someone is actually being engaged). Offer less intrusive alternatives where practicable, mark any copy as a copy, restrict who can open it, and never use HKID numbers as customer reference numbers.

Almost certainly yes, within 40 calendar days. You may charge only costs directly related to and necessary for compliance — not a deterrent fee — and you may redact other people's data and genuinely exempt material rather than refuse wholesale. Non-compliance without lawful excuse is an offence, so treat any clear written request as live from the day it arrives and take advice before refusing on formalities.

The PDPO doesn't require one — but it does require things that fail without an owner: 40-day access-request clocks, erasure duties, breach decisions. The PCPD recommends a Privacy Management Programme with someone responsible. For most SMEs the honest answer is one named owner inside the business, with the technical controls run by whoever runs your IT.

Possibly both. GDPR reaches Hong Kong businesses offering goods or services to people in the EU or monitoring them; PIPL reaches you if you sell into the mainland or analyse people there — and data flowing between your Hong Kong and mainland operations has its own transfer mechanics, eased within the Greater Bay Area by a standard contract. If China touches your business, our China IT Navigator maps that side properly.

Contain first: isolate the affected system, disable compromised accounts, preserve logs — don't wipe and reinstall the evidence. Then assess: what data, whose, how many, how sensitive. Then decide notifications with the facts in hand: the PCPD (voluntary today, favourably regarded), affected people where there's real risk, your regulator if you have one, insurers, and the Police if it's criminal. Write everything down as you go — the record you keep is the difference between an incident and an investigation finding.