Guide

Hong Kong's privacy law and your software project, in plain language.

If your app, website or system collects names, phone numbers, email addresses or anything else about identifiable people, Hong Kong's Personal Data (Privacy) Ordinance (PDPO) is likely to apply. This guide explains what that means for planning software. It is general information, not legal advice.

Key takeaways

Collect only what you need, tell people why, and use it for that purpose.
Keep data secure, and keep it no longer than necessary.
Marketing messages have their own rules about notice, consent and opting out.
If a supplier handles data for you, you remain responsible and should have it in writing.
Rules and guidance change. Check the current position with the regulator or a lawyer for your case.

What the law covers

The PDPO governs the collection, holding, processing and use of personal data — information about a living individual from which that person can be identified. Customer lists, booking records, sign-ups, enquiry forms, staff records and even photos can qualify. The law is overseen by the Office of the Privacy Commissioner for Personal Data (PCPD), which publishes guidance in English and Chinese.

This guide describes the general shape of the law. It does not cover every situation or exception, and details may have changed since it was written.

The six data protection principles, as design questions

The PDPO is built on six principles. Here is how each one turns into a question for your project:

1. Purpose and manner of collection. Why do you need each field? Do users know what it is for before they hand it over? Is anything collected "just in case"?
2. Accuracy and retention. How do people correct their details? When will you delete data you no longer need?
3. Use. Will data be used only for the purpose you gave, or for something people would not expect, such as marketing or sharing?
4. Security. Who can see the data? Is it protected in storage and in transit? What happens if a device is lost or an account is compromised?
5. Openness. Do you have a clear privacy notice and policy that people can find and understand?
6. Access and correction. If someone asks what you hold about them, can you find it and respond in time?

What this means when you plan the product

Trim the forms. Every field is a responsibility. Ask only for what the service needs.
Write the notice early. A short statement at the point of collection says what is collected, why, who sees it and how to contact you. Do it in English and Chinese if your users read both.
Design deletion in. Decide retention periods and build the means to delete or anonymise, rather than keeping everything forever.
Control access. Give staff the access their role needs, and keep a record of who did what for sensitive data.
Plan for requests. A way to find, export and correct one person's data saves pain later.

Four areas that catch people out

Direct marketing. Using personal data to send promotions, including by email, phone or messaging, comes with specific requirements: telling people what you intend, obtaining their consent and honouring a request to stop. Do not add customers to a marketing list simply because they bought something. See also our guide to WhatsApp for business.
Hong Kong ID card numbers. The PCPD has a code of practice limiting when ID numbers and copies may be collected. If you do not clearly need one, do not ask for it, and never use it as a username or password.
Suppliers and tools that process data for you. If an outside party — a developer, a hosting company, an email or AI service — handles personal data on your behalf, you are expected to use contract terms or other means to make sure they protect and limit its use. Ask what they do and where data is stored.
Sending data abroad. Cloud services often store data outside Hong Kong. The PCPD has published guidance on cross-border transfers and recommended contract clauses. Know where your data goes and what the provider's terms say.

Sensitive and special cases

Health, financial and children's data deserve extra care even where the law is not more specific. See our industry notes for clinics, education and finance.
Data breaches. Plan what you would do if data were exposed: who investigates, whom you tell and how. The PCPD has published guidance on handling breaches; check what is currently required or recommended.
Cookies and analytics. Tracking visitors may involve personal data. Be clear about what you use and why.

Questions to ask your developer

What personal data will the product collect, and can we remove any of it?
Where is it stored, and who can access it, including your own staff?
How is it protected, and how are backups handled?
Which third-party services will receive data, and where are they based?
How will we delete or export one person's data on request?
What is the plan if something goes wrong?

Where this guide stops

Whether a particular design complies depends on facts we do not know, and the law and the PCPD's guidance can change. We build software with these principles in mind, but we do not give legal advice. For anything beyond the basics — or where the data is sensitive — please speak to a Hong Kong lawyer or consult the PCPD's own materials.

Keep reading

Frequently asked questions

Does the PDPO apply to a small business?

Generally yes. The law is not limited by company size. If you collect personal data in Hong Kong, you should be considering it.

Do I need a privacy policy on my website?

If you collect personal data, you should tell people what you collect, why and how it is used. A clear privacy notice is the usual way to do so. Have it checked for your situation.

Is customer consent always needed?

Not for every use of data, but it is specifically required for direct marketing and for using data for a new purpose. When unsure, ask for advice.

Planning something that handles customer data?

Tell us what you intend to collect. We will help you design it to collect less and protect more.

Request a project quote