Hong Kong's Personal Data Privacy Ordinance governs data users' collection, processing and use of personal information. Fair collection, purpose limits, accuracy, security and access rights join direct-marketing controls; regulatory guidance strongly encourages breach notification.
TL;DR:
- Six principles govern fair collection, retention, purpose, security, transparency and data access.
- Payment customer, account and transaction information can engage these duties.
- PCPD breach-notification guidance is not a universal statutory notification deadline.
Summary
Data users and six principles
The Personal Data (Privacy) Ordinance applies to the handling of personal data by data users in Hong Kong. Its six data-protection principles organise duties across the information lifecycle: collection, accuracy and retention, use, security, openness, and access and correction. For payments, these questions can arise in onboarding, transaction processing, fraud review, support and marketing, rather than only when a customer first opens an account.
Purpose, retention and security
Personal data should be collected fairly for a lawful purpose and should not be excessive for that purpose. The principles also address accuracy, keeping data no longer than necessary and appropriate protection against unauthorised or accidental access, processing, erasure, loss or use. A new use unrelated to the original collection purpose generally requires the data subject’s prescribed consent. Payment processing and unrelated promotional use must therefore be assessed separately.
Rights and direct marketing
Data subjects have access and correction rights under the Ordinance. Part 6A imposes additional information and consent requirements for direct marketing and the provision of personal data for another person’s marketing. PCPD explains that silence does not amount to the required indication of consent. A privacy notice describing account administration is therefore not automatically permission for every marketing activity or onward disclosure.
Enforcement and breach guidance
PCPD investigates complaints and can issue enforcement notices; specified offences and civil remedies have their own legal requirements. A breach of a data-protection principle should not automatically be described as a criminal offence. The Commissioner’s guidance also encourages notification when a breach creates harm risks. Organisations should distinguish that guidance from a statutory mandatory deadline and check other contractual or sector obligations that may apply to their incident.
Keywords
- PDPO
- Hong Kong
- personal data
- fair collection
- purpose limitation
- retention controls
- access correction
- security safeguards
- direct marketing
- breach guidance