Hong Kong SAR

The Personal Data (Privacy) Ordinance (Cap. 486) has applied since 20 December 1996 to both the private and the public sector. The obligations attach to a 'data user' - the party that controls the data - rather than to an establishment in Hong Kong. Unlike the European Union's General Data Protection Regulation, there is no Article 27-style duty to appoint a representative, no data protection officer requirement, and no registration or notification scheme. The clearest statutory reach beyond Hong Kong is in the doxxing provisions added in 2021: the Privacy Commissioner may serve a cessation notice on a service provider whether or not the person is in Hong Kong and whether or not the disclosure was made in Hong Kong. Note the mirror-image trap in the dormant section 33: were it ever commenced, it would also catch a transfer between two places outside Hong Kong where a Hong Kong data user controls it.

Sector by sector, checked on 18 August 2026. SECURITIES AND FUTURES - a hard conditional wall. A licensed corporation may keep its regulatory records only outside Hong Kong if the markets regulator approves the premises, and it must appoint two Managers-In-Charge ordinarily resident in Hong Kong who can get at the records on demand. Rating: conditional. GOVERNMENT AND PUBLIC SECTOR - departments are instructed to refrain from storing sensitive and personal information on public cloud platforms. Rating: conditional. BANKING AND PAYMENTS - no localisation rule found. The bank regulator supervises outsourcing and cloud use and expects to be able to reach the data and records, but we could not open its policy manual in this run, so this is rated low confidence rather than asserted as clear. Rating: conditional, low confidence. INSURANCE - no localisation rule found on the regulator's own site, which blocked automated access; low confidence. HEALTH - the electronic health record sharing system is built around patient consent, and a 2025 bill would let a person authorise a healthcare provider outside Hong Kong to see or deposit records. No prohibition on records leaving found. Rating: open. TELECOM, EDUCATION, GAMING, MAPPING AND GEOSPATIAL, DEFENCE - no data localisation rule found on government sources, checked 18 August 2026; treat as open with medium confidence rather than as proven. CRITICAL INFRASTRUCTURE - a new law in force since 1 January 2026 imposes security and reporting duties on designated operators; we found no requirement that their computer systems or data sit in Hong Kong, but we could not read the statute text. THE DIRECTION THAT ACTUALLY BITES is inbound: moving personal information from mainland China into Hong Kong is restricted by mainland law, and the Greater Bay Area standard contract exists precisely to make that legal.

If section 33 were ever commenced, a transfer out of Hong Kong would need one of six gateways: the destination is on a white list of places the Commissioner has decided have substantially similar law; the data user has reasonable grounds to believe such a law is in force there; the person has consented in writing; the transfer avoids adverse action against the person and written consent is impracticable; a Part VIII exemption applies; or the data user has taken all reasonable precautions and exercised all due diligence. Two features make it stricter than it looks. First, it would catch transfers between two places outside Hong Kong controlled by a Hong Kong data user. Second, the due-diligence gateway is a standard of conduct, not a document you file, so it cannot be discharged by signing a template. Going the other way, from mainland China into Hong Kong, the Greater Bay Area Standard Contract was announced on 13 December 2023 under a memorandum signed on 29 June 2023, and from 1 November 2024 the facilitation measures were extended to cover all sectors in Hong Kong. It is a voluntary simplified route, not a Hong Kong legal requirement.

Rated active rather than aggressive for a structural reason. Hong Kong has no administrative fining power of the European kind - no percentage-of-turnover penalty, no headline nine-figure decisions. The enforcement route is: investigate, serve an enforcement notice, and prosecute if the notice is ignored (up to HK$50,000, about $6,400, and two years in prison for a first conviction). The teeth are elsewhere. Direct marketing breaches are criminal offences carrying up to HK$500,000 (about $64,000) and three years, rising to HK$1,000,000 (about $128,000) and five years where data was passed on for gain. Doxxing carries up to HK$1,000,000 and five years on indictment. Sector regulators enforce separately and are fully operational: the Securities and Futures Commission licenses and disciplines intermediaries, the Hong Kong Monetary Authority supervises banks, and the Insurance Authority supervises insurers. A separate Commissioner's office for critical infrastructure computer-system security began work when that law took effect on 1 January 2026.

The ceiling sits in the second Data Protection Principle (accuracy and retention) and in the standalone erasure duty. The Privacy Commissioner's position is that retention must be tied to purpose, not to a fixed calendar. Hong Kong publishes no general log-retention mandate equivalent to India's 180-day rule or the European Union's telecoms retention regimes. The floors that matter in practice sit outside the privacy law - business records under tax law, accounting records under company law, and customer due diligence records under the anti-money-laundering regime - and we were not able to open a government source for those specific periods during this run, so they are listed in the unconfirmed array rather than stated here as fact. Licensed securities firms have their own record-keeping obligations enforced by the markets regulator, including daily backups and an access map showing where records are held.

Two clocks, one of which is empty. CLOCK ONE, general breach: none. The Commissioner's own page states plainly that it is not a statutory requirement to inform the office about a data breach. Voluntary notification is recommended as soon as practicable, and the Commissioner publishes a notification form. Individuals should be told where there is a real risk of harm, again as a recommendation. CLOCK TWO, critical infrastructure: the Protection of Critical Infrastructures (Computer Systems) Ordinance took effect on 1 January 2026 and requires designated operators to report incidents to the new Commissioner's office. The reported deadlines are 12 hours for serious incidents and 48 hours for others; we could not open the statute text on a government site during this run, so those specific hour figures are flagged in the unconfirmed array and are deliberately not asserted in the rule as verified. Separately, listed companies have disclosure duties to the stock exchange, and licensed intermediaries are expected to report material incidents to the markets regulator.

(1) Direct marketing sits in a separate part of the law with its own criminal offences: up to HK$500,000 (about $64,000) and three years, and up to HK$1,000,000 (about $128,000) and five years where personal data was provided to another person for gain. This is the single most prosecuted commercial exposure. (2) The absence of an administrative fine is widely misread as an absence of risk. The realistic exposures are prosecution, an enforcement notice that forces a system change, and reputational damage from a published investigation report. (3) No statutory age of digital consent was found in the privacy law, checked 18 August 2026 - the regulator runs children's privacy education instead. That means no safe harbour and no bright line, so a global under-13 or under-16 gate is a design choice, not compliance. (4) The markets regulator requires two Managers-In-Charge ordinarily resident in Hong Kong who hold, or can procure, all digital certificates, keys, passwords and tokens needed to give the regulator access - an in-country personnel requirement dressed as a records rule. (5) Section 33 would reach a transfer between two places outside Hong Kong where a Hong Kong data user controls it, which is a structure most multinationals use without thinking about it.

DORMANT SWITCHES, in order of how much damage they would do. (1) Section 33. It is on the statute book, fully drafted, and needs only a commencement notice from the Secretary. The day it commences, Hong Kong flips overnight from having no transfer rules to having an allowlist regime with an empty allowlist - because the white list of approved destinations has never been published. Every routine offshore flow would need to fall back on written consent or a due-diligence defence. (2) The wider privacy law review. The government has been reviewing the ordinance since 2020, with mandatory breach notification and a statutory retention period among the ideas discussed; the last completed step we could verify on a government site is the 2021 anti-doxxing amendment, and we found no bill in progress as at 18 August 2026. (3) The Greater Bay Area standard contract arrangement is administrative, so its scope can be widened or narrowed by announcement - it was already extended to all Hong Kong sectors from 1 November 2024. (4) National security legislation gives the authorities powers to require assistance from service providers; we could not open the operative text on a government site in this run, so it is recorded here as a flagged uncertainty rather than a described rule. LEGISLATION IN PROGRESS: the Electronic Health Record Sharing System (Amendment) Bill 2025 was gazetted on 21 March 2025 with first reading on 26 March 2025; we could not confirm whether it has since passed.