Any organisation processing Hong Kong personal data must plan
ahead to anticipate significant new compliance obligations
requirements. These are proposed in a recent consultation paper to
amend Hong Kong’s Personal Data (Privacy) Ordinance (PDPO),
and would – if passed – constitute the first changes to
the PDPO since 2012.
Key proposed amendments include:
1. Direct administrative fines linked to annual turnover.
This will significantly increase the penalty from a relevant low
level of fines (i.e., maximum HKD1 million at present) to a much
higher amount calculated by reference to annual turnover.
2. Mandatory data breach notification – to the
privacy authority (PCPD) and affected data subjects within a
prescribed timeframe (as soon as practicable and not more than five
business days).
