Hong Kong PDO
Personal Data (Privacy) Ordinance (Cap. 486), Hong Kong — PCPD (Office of the Privacy Commissioner for Personal Data, Hong Kong)
Also known as: PDPO, Cap. 486, Personal Data (Privacy) Ordinance, Hong Kong PDPO
Official site Official change log Subscribe to Hong Kong PDO (RSS)
At a glance
- Current version
- Personal Data (Privacy) Ordinance, Cap. 486 (version of 1 October 2022)
- Published 1 October 2022. source
- Status
- In force
- Next deadline
- None announced
- Who must comply
- Data users: any person who, alone or with others, controls the collection, holding, processing or use of personal data; the Ordinance also binds the Government. source
- How it is assessed
- Data users comply with the data protection principles themselves; the Commissioner checks compliance through investigations rather than certification. source
- Authority
- An ordinance of Hong Kong enforced by the Privacy Commissioner for Personal Data, who investigates, serves enforcement notices and, for doxxing, cessation notices. source
- Enforced by
- Contravening an enforcement notice is an offence, and disclosing personal data for gain or to cause harm can lead to fines of HK$1,000,000 and five years' imprisonment. source
- Last change
Hong Kong's data protection statute, one of the oldest in Asia, built on six data protection principles covering collection, accuracy, retention, use, security and access. It makes doxxing a criminal offence and gives the Privacy Commissioner powers to investigate, prosecute and order removal of content, which is what most enforcement turns on.
Recent changes
-
Info
Privacy Commissioner's Office publishes investigation findings on United Christian Hospital data breach
The Privacy Commissioner's Office has published its investigation findings regarding a data breach at United Christian Hospital. The findings detail how the breach occurred, the impact …
-
Low
PCPD publishes guidance on protecting personal data privacy with smart glasses
The Privacy Commissioner's Office (PCPD) has published guidance titled "Smart Glasses: Tips on Protecting Personal Data Privacy" to address privacy concerns related to smart glasses devices. …
-
Info
PCPD commences compliance check on 24/7 FITNESS for member personal data protection
The Office of the Privacy Commissioner for Personal Data (PCPD) has proactively commenced a compliance check on 24/7 FITNESS to ensure the protection of members' personal …
-
Info
PCPD arrests 29-year-old male for suspected doxxing of competitor
The Office of the Privacy Commissioner for Personal Data (PCPD) in Hong Kong has arrested a 29-year-old male on suspicion of doxxing a competitor. This action …
-
Low
Privacy Commissioner's Office follows up on data misuse cases and publishes agentic AI guidance
Hong Kong's Privacy Commissioner's Office has followed up on three cases where foreign domestic helpers misused their employers' personal data for unauthorized loan applications, and simultaneously …
-
Info
Privacy Commissioner's Office publishes investigation findings on Canvas data breach incident
The Privacy Commissioner's Office has published its investigation findings regarding a data breach affecting the Canvas online learning management platform. The report documents the scope and …
That is the last 90 days. Sign in to read further back.
Key dates
No upcoming datesAmendments
-
Personal Data (Privacy) Ordinance, Cap. 486 (version of 1 October 2022) AmendmentCurrent text
Current version on e-Legislation; the only 2022 change noted in the text is to the Accounting and Financial Reporting Council entry in the definition of financial regulator (section 2(1), amended L.N. 66 of 2022). source
-
Personal Data (Privacy) Ordinance, Cap. 486 (version of 8 October 2021) Amendment
The Personal Data (Privacy) (Amendment) Ordinance 2021 (32 of 2021) created doxxing offences and gave the Commissioner criminal investigation and cessation notice powers. source
More
- Disclosing personal data without consent with intent, or being reckless, as to causing specified harm became an offence (section 64(3A) to (3D)).
- New Part 9A lets the Commissioner investigate these offences and serve cessation notices requiring removal of doxxing messages (sections 66D to 66O).
-
Personal Data (Privacy) Ordinance (Cap. 486) Major version
The Ordinance's long title bears the commencement date 1 August 1996 (L.N. 343 of 1996). source
-
—
2012 amendments (direct marketing) Amendment
The Personal Data (Privacy) (Amendment) Ordinance 2012 (18 of 2012) added Part 6A on using and providing personal data for direct marketing and created the enforcement notice offences in section 50A. source
Who it applies to
The PDPO binds data users that control personal data, including the Government, through six data protection principles in Schedule 1.
- Data users
- A data user is a person who, alone or jointly or in common with others, controls the collection, holding, processing or use of personal data (section 2(1)). source
- Government
- The Ordinance binds the Government (section 3(1)). source
- Principles
- A data user must not act or engage in a practice that contravenes a data protection principle unless the Ordinance requires or permits it (section 4); the principles are in Schedule 1. source
- Agents and processors
- A person is not a data user for personal data it holds, processes or uses solely on behalf of another person and not for its own purposes (section 2(12)). source
How compliance is assessed
Data users comply with the data protection principles themselves; the Commissioner checks compliance through investigations rather than certification.
- Investigation
- After an investigation, if the Commissioner finds a data user is contravening or has contravened a requirement, the Commissioner may serve an enforcement notice (section 50). source
Enforcement and penalties
Contravening an enforcement notice is an offence, and disclosing personal data for gain or to cause harm can lead to fines of HK$1,000,000 and five years' imprisonment.
HK$1,000,000 and 5 years
Section 64(1) and (3), for disclosing personal data obtained from a data user without consent to obtain gain or cause loss; section 64(3C) and (3D), on indictment, for doxxing that causes specified harm. source
Level 6 fine and 2 years
Section 64(3A) and (3B), for doxxing with intent or recklessness as to specified harm; also section 50A on a second or subsequent conviction for contravening an enforcement notice. source
Level 5 fine and 2 years
Section 50A(1)(a), on a first conviction for contravening an enforcement notice, plus a daily penalty of HK$1,000 if the offence continues. source
- Cessation notices
- The Commissioner can serve cessation notices on doxxing messages; contravening one is an offence (sections 66M and 66O). source
Documents
Frequently asked questions
What is the penalty for doxxing in Hong Kong?
Up to a level 6 fine and two years' imprisonment, or on indictment a fine of HK$1,000,000 and five years' imprisonment where the disclosure causes specified harm (section 64). source
Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to Hong Kong PDO (RSS)