A "data user" (which is akin to a "data controller" under GDPR) may collect personal data from a data subject if:

• the personal data is collected for a lawful purpose directly related to a function or activity of the data user;
• the collection is necessary for or directly related to that purpose;
• the data to be collected is adequate but not excessive; and
• all practical steps have been taken to ensure that the data subject has been informed, on or before collection of the data, of the following:
  • whether the supply of personal data by the data subject is obligatory or voluntary and, if obligatory, the consequences of not supplying the data;
  • the purposes for which the data will be used;
  • the persons to whom the data may be transferred;
  • the data subject's rights to request for access to and correction of their personal data; and
  • the name or job title, and address, of the individual to whom requests for access or correction should be sent.

Separately, additional notice requirements apply to direct marketing (see below).

Data users may only collect, use and transfer personal data for purposes notified to the data subject on collection (see above), unless a limited exemption set out in the Ordinance applies. Any usage or transfer of personal data for new purposes requires the prescribed consent of the data subject.

Data users are also required to take all practicable steps to ensure the accuracy and security of the personal data; to ensure it is not kept longer than necessary for the fulfilment of the purposes for which it is to be used (including any directly related purposes); and to keep and make generally available their policies and practices in relation to personal data.

While the Ordinance currently does not regulate data processors, this was proposed in the January 2020 Consultation Paper, and also referred to as an amendment direction in the PCPD’s Report issued in February 2023 and Panel Meeting Summary published in February 2024.

In October 2018, the PCPD published a “New Ethical Accountability framework” Under the framework, the PCPD is effectively urging businesses operating in Hong Kong to undertake privacy impact assessments – referred to as “Ethical Data Impact Assessments”, which are already required to some extent under a number of other laws, such as China, the Philippines as well as GDPR.

The "Artificial Intelligence: Model Personal Data Protection Framework" (AI Model Framework) was published in June 2024 to provide AI-related organizations with recommendations and best practices to help AI-related organizations comply with the PDPO and values & principles under the AI Guide when dealing with personal data.