Hong Kong SAR

Tier 3 Comprehensive law Asia-Pacific

Principal framework: PDPO (amended 2021) (1995). Regulator: PCPD. The PDPO dates to 1995; the 2021 amendment targeted doxxing and gave the PCPD criminal-investigation powers. Section 33 on cross-border transfers has never been commenced.

At a glance

Principal law: Personal Data (Privacy) Ordinance (Cap. 486)
Regulator: Office of the Privacy Commissioner for Personal Data (PCPD)
Breach notification: No mandatory breach notification (voluntary to the PCPD); reform proposed
Maximum penalty: Doxxing offences to HK$1m and 5 years (2021 amendment); DPP breaches enforced via enforcement notices
DPO required: No mandatory DPO
Digital consent age: No statutory age
Extraterritorial reach: Doxxing provisions reach conduct outside Hong Kong

Structure

Structural pattern: Not assessed
Sub-jurisdictions: None — no sub-national axis
ISO code: HK

A Pattern 4 jurisdiction has no sub-national layer to model. Devolution elsewhere in the legal system does not imply it here — check each Act rather than reasoning from the country.

Transfers and adequacy

EU member: No
EEA member: No

Instruments

No instrument profiled yet.

Sources

Regulator Office of the Privacy Commissioner for Personal Data (PCPD)
Primary Personal Data (Privacy) Ordinance (Cap. 486)

Never independently verified — seeded from the prototype.