Data hk is used by businesses, governments and academic institutions alike to generate reports, statistics, forecasts, analyses and insights that inform decisions, identify areas for improvement and shape policy. It can be an invaluable asset.

Hong Kong Personal Data Protection Policy (“PDPO”) sets forth specific obligations on data users while outlining data subject rights in accordance with six Data Protection Principles. PDPO applies both locally within Hong Kong as well as transfers outside its boundaries.

At the center of any PDPO transaction is whether or not its subject information identifies an identifiable individual. This definition is broadly applied across legislation such as China’s Personal Information Protection Law (“PIPL”) and EU General Data Protection Regulation (“GDPR”). Among others, factors which could identify an individual include their name; identity card number; passport or visa data; location data; online identifiers and anything that links directly back to an identifiable person are taken into consideration in their definition.

One key point under PDPO is that anyone responsible for collecting, holding, processing and using data constitutes a “data user”. Therefore, any person collecting personal information must notify individuals specifically of its purpose of collection as well as which classes of individuals their information could be shared with – failing which penalties could apply.

One important distinction when considering whether or not a transfer of personal data falls under PDPO is that, unlike in some other jurisdictions, Hong Kong only applies when someone controls its collection, holding, processing or use within or from Hong Kong. Therefore, it’s crucial that any data transferred falls within this scope before moving it along its journey.

IF YOU are uncertain as to whether a particular transfer of personal data falls under PDPO, please reach out to your local Tanner De Witt office for help in understanding its requirements and, where necessary, creating agreements to comply. Furthermore, our experts are on hand to explain and interpret GDPR provisions which may apply; please see our GDPR page for more details.