PDPO Privacy Content Compliance in Hong Kong

Hong Kong's Personal Data (Privacy) Ordinance (PDPO) is one of Asia's longest-standing data protection laws, first enacted in 1995. Enforced by the Office of the Privacy Commissioner for Personal Data (PCPD), the PDPO governs how businesses collect, use, store, and disclose personal data — with direct implications for marketing content, data collection forms, privacy policies, and customer communications.

The 2021 amendments to the PDPO introduced new offences for doxxing, and the PCPD has increasingly focused enforcement on direct marketing practices, cross-border data transfers, and the use of personal data in digital advertising. For businesses operating in Hong Kong, PDPO compliance shapes not just privacy policies but every piece of content that touches personal data.

The PDPO Framework for Content

Six Data Protection Principles

The PDPO establishes six Data Protection Principles (DPPs) that affect content compliance:

Direct Marketing Requirements (Section 35A-35M)

The PDPO's direct marketing provisions are among the most prescriptive in Asia:

Before using personal data for direct marketing, businesses must:

1. Inform the individual of the intention to use their data for direct marketing
2. Specify the types of personal data to be used (name, contact details, demographic data, transaction history, etc.)
3. Specify the classes of marketing subjects (products, services, subjects to be marketed)
4. Specify the methods of marketing (email, phone, SMS, postal mail)
5. Indicate whether data will be provided to third parties for their direct marketing use
6. Obtain the individual's consent — which must be a specific, voluntary, and informed indication of agreement
7. Provide an opt-out mechanism in every direct marketing communication

Key rule: The individual must be given an opt-out opportunity before consent is obtained and in every subsequent marketing communication. No response does not constitute consent.

Common PDPO Content Compliance Failures

1. Inadequate Privacy Policy Statements

• Privacy policies that use vague language about data use ("we may use your data for various purposes")
• Missing description of the types of personal data collected
• No mention of the individual's right to access and correct their data
• Privacy policies not available in both English and Chinese
• No contact information for privacy-related enquiries

2. Direct Marketing Consent Failures

• Using personal data for direct marketing without obtaining prior consent
• Not specifying the classes of marketing subjects before obtaining consent
• Bundling direct marketing consent with general terms and conditions
• Not providing an opt-out mechanism in direct marketing communications
• Treating the absence of objection as consent (silence is not consent under PDPO)

3. Data Collection Form Issues

• Collecting personal data beyond what is necessary for the stated purpose
• Not providing a Personal Information Collection Statement (PICS) at the point of collection
• Missing purpose of collection statement on data collection forms
• Not disclosing the classes of persons to whom data may be transferred
• Mandatory fields for information that is not necessary for the stated purpose

4. Cross-Border Data Transfer Content

• Transferring personal data outside Hong Kong without adequate protection
• Not disclosing cross-border transfers in privacy policies
• Using cloud-based marketing platforms that process data outside Hong Kong without assessment
• Sharing customer data with overseas affiliates for marketing without consent and disclosure

Building PDPO-Compliant Content

Personal Information Collection Statement (PICS)

Every data collection point must include a PICS with:

• Purpose of data collection clearly stated
• Whether data provision is obligatory or voluntary, and consequences of not providing
• Classes of persons to whom data may be transferred
• Individual's right to access and correct their data
• Contact details for data access and correction requests
• Direct marketing intention disclosure (if applicable)
• Cross-border transfer disclosure (if applicable)

Direct Marketing Content Checklist

Pre-marketing consent:

• Individual informed of intention to use data for direct marketing
• Types of personal data to be used specified
• Classes of marketing subjects specified
• Methods of marketing specified (email, phone, SMS, postal)
• Third-party data provision disclosed if applicable
• Consent obtained (explicit opt-in, not silence)
• Consent records maintained

Every marketing communication:

• Sender identity clearly stated (company name)
• Opt-out mechanism included and functional
• Opt-out requests processed without charge
• Content relates to the classes of marketing subjects consented to
• Marketing method matches what was consented to

Privacy Policy Content Requirements

• Types of personal data collected listed
• Purposes of collection and use explained
• Retention policy described
• Security measures summarised
• Third-party sharing disclosed with categories of recipients
• Cross-border transfers disclosed if applicable
• Access and correction rights explained with contact details
• Direct marketing practices described with opt-out instructions
• Policy available in English and Chinese

Review Schedule

Doxxing Provisions (2021 Amendment)

The 2021 amendments to the PDPO introduced criminal offences for doxxing:

• Section 64(3A) — disclosing personal data without consent with intent to cause harm
• Section 64(3C) — disclosing personal data without consent being reckless as to whether harm is caused
• Penalties: fines up to HKD 1,000,000 and imprisonment up to five years

For content teams, this means:

• Customer data must never be published or disclosed without consent
• Employee data in public-facing content requires consent
• User-generated content platforms must moderate for doxxing
• Complaint responses must not disclose personal data of individuals

Using AI for PDPO Content Review

What AI Can Assess

• PICS completeness — verify that Personal Information Collection Statements include all required elements
• Consent language compliance — check that consent mechanisms are explicit opt-in and properly specified
• Privacy policy completeness — verify all required sections are present
• Opt-out mechanism presence — confirm that every marketing communication includes opt-out instructions
• Direct marketing disclosure — check that pre-marketing notices specify data types, marketing subjects, and methods
• Doxxing risk indicators — flag content that may disclose personal data without consent

What Requires Human Review

• Verification that consent records exist for specific marketing recipients
• Assessment of whether a specific data transfer meets cross-border requirements
• Legal determination of whether specific data use constitutes a new purpose requiring fresh consent
• Evaluation of whether data collection is excessive for the stated purpose
• Cultural assessment of bilingual privacy notices (English and Chinese)

TeamBench Configuration Example

Reviewer name: PDPO Privacy Content Compliance Reviewer

System prompt:

You are a privacy content compliance reviewer for Hong Kong. Review data collection forms, privacy policies, direct marketing content, and Personal Information Collection Statements against the Personal Data (Privacy) Ordinance. Check for: PICS completeness (purpose, voluntariness, transferees, access rights, contact details), direct marketing consent compliance (specific data types, marketing subjects, methods, third-party disclosure, explicit opt-in), privacy policy completeness, opt-out mechanisms in marketing communications, cross-border transfer disclosures, and doxxing risk indicators. Flag bundled consent, missing opt-out mechanisms, vague purpose statements, and absence of PICS at data collection points. Use Hong Kong English.

Evaluation criteria:

• PICS Completeness (weight: 3)
• Direct Marketing Consent Compliance (weight: 3)
• Privacy Policy Adequacy (weight: 2)
• Opt-out Mechanism Presence (weight: 2)

Quality gate: Minimum score: 85.

Key Takeaways

• The PDPO's direct marketing provisions are among Asia's most prescriptive — requiring specific pre-marketing notices, explicit consent, and opt-out in every communication.
• Personal Information Collection Statements are mandatory at every data collection point and must include specific elements.
• Silence does not constitute consent under the PDPO — explicit, informed opt-in is required for direct marketing.
• Privacy policies must be transparent and comprehensive, covering data types, purposes, retention, security, third-party sharing, and access rights.
• The 2021 doxxing provisions create criminal liability for disclosing personal data without consent with intent or recklessness as to harm.
• AI-assisted review can check PICS completeness, consent language, and opt-out mechanisms, but consent record verification and cross-border assessments require human review.

---

This article provides general information about PDPO privacy content compliance in Hong Kong and is not legal advice. Always consult the PCPD for current requirements and seek qualified legal advice for your specific situation.