Hong Kong SAR

The Personal Data (Privacy) Ordinance (Cap. 486) has applied since 20 December 1996. It covers private companies and the public sector alike. The duties fall on the 'data user', meaning the party that controls the data. They do not depend on having a Hong Kong office. Europe's General Data Protection Regulation makes foreign companies appoint a representative in Europe. Hong Kong has no equivalent rule. There is no data protection officer requirement either. There is no registration and nothing to notify. The clearest reach beyond Hong Kong is in the anti-doxxing rules added in 2021. The Privacy Commissioner can order a service provider to stop, whether or not that provider is in Hong Kong. It applies whether or not the material was published in Hong Kong. There is a mirror image of this in the unused transfer section. If that section were ever brought into force, it would reach wider than you expect. It would cover a transfer between two places outside Hong Kong, when a Hong Kong company controls it.

Here is the position industry by industry, checked on 18 August 2026. SECURITIES AND FUTURES: the strictest case. A licensed firm may keep its official records only outside Hong Kong if the markets regulator approves the storage site. It must also appoint two Managers-In-Charge who normally live in Hong Kong and can get at the records on demand. Rated conditional. GOVERNMENT AND PUBLIC SECTOR: departments are told not to store sensitive and personal information on public cloud platforms. Rated conditional. BANKING AND PAYMENTS: we found no rule that data must stay in Hong Kong. The bank regulator supervises outsourcing and cloud use. It expects to be able to reach the data and the records. We could not open its policy manual, so we rate this low confidence rather than treat it as settled. Rated conditional, low confidence. INSURANCE: we found no rule that data must stay in Hong Kong on the regulator's own site, which blocked our access. Low confidence. HEALTH: the electronic health record sharing system is built around patient consent. A 2025 bill would let a person authorise a healthcare provider outside Hong Kong to see or add records. We found no ban on records leaving. Rated open. TELECOM, EDUCATION, GAMING, MAPPING AND GEOSPATIAL, DEFENCE: we found no rule on government sources that data must stay in Hong Kong, checked 18 August 2026. Treat these as open with medium confidence, not as proven. CRITICAL INFRASTRUCTURE: a new law in force since 1 January 2026 gives named operators security and reporting duties. We found no requirement that their computer systems or data sit in Hong Kong, but we could not read the text of the law. The direction that really restricts data is inbound. Moving personal information from mainland China into Hong Kong is restricted by mainland law. The Greater Bay Area standard contract exists to make that legal.

If the unused transfer section were ever brought into force, sending data out of Hong Kong would need one of six routes. The destination is on a list of places the Commissioner has decided have a substantially similar law. Or you have reasonable grounds to believe such a law is in force there. Or the person has agreed in writing. Or the transfer will not harm the person and written consent is impractical. Or an exemption in Part VIII of the law applies. Or you took all reasonable precautions and did all due diligence. Two features make it stricter than it looks. First, it would cover transfers between two places outside Hong Kong that a Hong Kong data user controls. Second, the due diligence route is a standard of behaviour, not a document you file. You cannot satisfy it by signing a template. Going the other way, from mainland China into Hong Kong, there is the Greater Bay Area Standard Contract. It was announced on 13 December 2023 under a memorandum signed on 29 June 2023. From 1 November 2024 the easier route was extended to every industry in Hong Kong. It is a voluntary simpler route. Hong Kong law does not require it.

We rate enforcement active rather than aggressive, for a structural reason. Hong Kong has no European-style power to fine you. There is no percentage-of-turnover penalty and no nine-figure decisions. The route is to investigate, serve a notice to fix the problem, then prosecute if you ignore the notice. A first conviction carries up to HK$50,000 (about 6,400 US dollars) and two years in prison. The real teeth are elsewhere. Direct marketing breaches are crimes. They carry up to HK$500,000 (about 64,000 US dollars) and three years. That rises to HK$1,000,000 (about 128,000 US dollars) and five years where data was passed on for gain. Doxxing carries up to HK$1,000,000 and five years for the more serious cases. Industry regulators enforce separately and are fully up and running. The Securities and Futures Commission licenses and disciplines brokers. The Hong Kong Monetary Authority supervises banks. The Insurance Authority supervises insurers. A separate Commissioner's office covers computer-system security for critical infrastructure. It began work when that law took effect on 1 January 2026.

The maximum comes from the second data protection principle, on accuracy and keeping data, and from a separate duty to erase. The Privacy Commissioner says how long you keep data must follow the purpose, not a fixed calendar. Hong Kong has no general rule on how long to keep logs. India has a 180-day rule and the European Union has telecoms keeping rules. Hong Kong has nothing like them. The minimum periods that matter sit outside the privacy law. They are business records under tax law, accounting records under company law, and customer due diligence records under anti-money-laundering law. We could not open a government source for those specific periods. So they are listed in the unconfirmed list rather than stated here as fact. Licensed securities firms have their own record-keeping duties, enforced by the markets regulator. Those include daily backups and a map showing where records are held.

There are two deadlines and one of them does not exist. GENERAL BREACH: no deadline. The Commissioner's own page says plainly that telling the office about a data breach is not required by law. It recommends you tell them as soon as you can, and it publishes a form. It also recommends telling the people affected where there is a real risk of harm. CRITICAL INFRASTRUCTURE: the Protection of Critical Infrastructures (Computer Systems) Ordinance took effect on 1 January 2026. Named operators must report incidents to the new Commissioner's office. The reported deadlines are 12 hours for serious incidents and 48 hours for others. We could not open the text of the law on a government site. So those hour figures are flagged in the unconfirmed list and are not stated as verified. Separately, listed companies must disclose to the stock exchange. Licensed brokers are expected to report serious incidents to the markets regulator.

(1) Direct marketing sits in its own part of the law and has its own crimes. Penalties run to HK$500,000 (about 64,000 US dollars) and three years. They rise to HK$1,000,000 (about 128,000 US dollars) and five years where personal data was given to another person for gain. This is the most prosecuted business risk in Hong Kong. (2) People read the lack of fines as a lack of risk. The realistic risks are prosecution, a notice that forces you to change your systems, and damage from a published investigation report. (3) We found no minimum age for consent in the privacy law, checked 18 August 2026. The regulator runs children's privacy education instead. So there is no safe number and no clear line. A global under-13 or under-16 gate is a design choice, not compliance. (4) The markets regulator requires two Managers-In-Charge who normally live in Hong Kong. Each must hold, or be able to get, all the digital certificates, keys, passwords and tokens the regulator needs for access. It looks like a records rule but it is really a staffing rule. (5) The unused transfer section would reach a transfer between two places outside Hong Kong that a Hong Kong data user controls. Most multinationals are set up that way without thinking about it.

UNUSED POWERS, in order of how much damage they would do. (1) The cross-border transfer section. It is in the law, fully written, and needs only a commencement notice from the Secretary. The day it starts, Hong Kong goes from having no transfer rules to letting you send data only to approved countries. The list of approved countries has never been published, so it would be empty. Every routine flow abroad would have to fall back on written consent or a due diligence defence. (2) The wider privacy law review. The government has been reviewing the ordinance since 2020. Ideas discussed include compulsory breach reporting and a set keeping period. The last completed step we could verify on a government site is the 2021 anti-doxxing change. We found no bill in progress as at 18 August 2026. (3) The Greater Bay Area standard contract arrangement is administrative. Its scope can be widened or narrowed by announcement. It was already extended to every Hong Kong industry from 1 November 2024. (4) National security legislation gives the authorities powers to demand help from service providers. We could not open the operative text on a government site. So it is recorded here as an uncertainty, not as a described rule. LEGISLATION IN PROGRESS: the Electronic Health Record Sharing System (Amendment) Bill 2025 was published in the gazette on 21 March 2025. Its first reading was on 26 March 2025. We could not confirm whether it has since passed.