Hong Kong’s Personal Data (Privacy) Ordinance is principles-based and has no mandatory breach notification yet, but its direct marketing rules carry criminal penalties. The Privacy Commissioner has published practical frameworks for AI use.
Since 1 January 2026, operators of designated critical infrastructure must meet new cybersecurity obligations.
- Core data law
- Personal Data (Privacy) Ordinance (Cap. 486)
- Regulator
- Privacy Commissioner for Personal Data (PCPD)
- Breach notice
- Voluntary (recommended)
- Direct marketing
- Consent required; criminal offences
- AI
- PCPD Model Personal Data Protection Framework for AI (2024)
- Cyber
- Critical Infrastructures Ordinance, 1 Jan 2026
Who needs to comply
Businesses controlling personal data in or from Hong Kong
The PDPO applies to data users who control personal data in or from Hong Kong.
Businesses doing direct marketing
Consent and opt-out rules are strict, with criminal penalties.
Critical infrastructure operators
Designated operators must meet cybersecurity duties under the 2026 ordinance.
The laws, in detail
01Personal Data (Privacy) Ordinance
Six data protection principles on collection, accuracy, use, security, openness and access.
When it applies
Data users controlling personal data in or from Hong Kong.
What you must do
- Purpose and notice at collection
- Use only for the original or directly related purpose without consent
- Security of personal data
- Access and correction requests within 40 days
- Consent before direct marketing
Regulator
PCPD
Penalties
Enforcement notices; criminal penalties for direct marketing offences and doxxing.
02Protection of Critical Infrastructures (Computer Systems) Ordinance
Cybersecurity duties for designated critical infrastructure operators.
When it applies
Designated operators in eight sectors, including IT, banking, telecoms and healthcare.
What you must do
- Security management unit and plans
- Risk assessments and audits
- Incident reporting
Regulator
Commissioner of Critical Infrastructure (Computer-system Security)
Penalties
Fines from HK$300,000 up to HK$5 million, plus daily penalties.
03Virtual asset trading platform licensing (AMLO/SFO)
Licensing of centralised virtual asset trading platforms by the SFC.
When it applies
Operating a virtual asset exchange in Hong Kong or actively marketing to Hong Kong investors.
What you must do
- SFC licence before operating
- Custody, conduct and investor protection rules
- AML/CFT and Travel Rule
Regulator
Securities and Futures Commission
Penalties
Criminal offence to operate without a licence.
04Stablecoins Ordinance (Cap. 656)
Licensing of issuers of fiat-referenced stablecoins.
When it applies
Issuing fiat-referenced stablecoins in Hong Kong, or HKD-pegged stablecoins anywhere.
What you must do
- HKMA licence
- Reserve, redemption and disclosure rules
- Only licensed stablecoins may be offered to retail
Regulator
Hong Kong Monetary Authority
Penalties
Criminal penalties for unlicensed issuance.
05Unsolicited Electronic Messages Ordinance
Commercial emails, texts and fax marketing.
When it applies
Sending commercial electronic messages with a Hong Kong link.
What you must do
- Accurate sender information
- Functional unsubscribe and honour requests within 10 working days
- Respect do-not-call registers
Regulator
Communications Authority
Penalties
Fines and imprisonment for some offences.
Compliance checklist
01 · Before you launch
- Personal information collection statement
- Direct marketing consent flows
02 · At launch
- Voluntary breach notification plan
- Access request process (40 days)
03 · As you scale
- Align AI use with the PCPD AI framework
- Check designation as critical infrastructure
Key dates
- 1996PDPO in force
- 2021Anti-doxxing amendments
- Jun 2024PCPD AI framework
- 1 Jan 2026Critical Infrastructures Ordinance
Common mistakes
- Marketing without prior consent
- Assuming no breach response is needed because notification is voluntary
FAQs
Is breach notification mandatory in Hong Kong?
Not yet; the PCPD recommends notifying it and affected individuals.
Sources
Reviewed 12 October 2026. General information, simplified for planning; not legal advice. Check current law before relying on any requirement, and get advice for your facts. For markets outside India, advice is coordinated with locally qualified counsel.