The framework
Hong Kong regulates personal data through the Personal Data (Privacy) Ordinance (PDPO), dating from 1996 and supervised by the Privacy Commissioner for Personal Data.
The posture is hybrid. Notice and purpose limitation govern collection and consent is reserved for sensitive cases, which makes first-party marketing more workable here than in strict opt-in markets.
Key instruments
Personal Data (Privacy) Ordinance (PDPO)
Asia's oldest privacy law (1996) runs on notice, with one sharp exception in direct marketing. Part 6A, added after the 2010 Octopus scandal, makes using personal data for marketing without the individual's agreement a criminal offense, and the PCPD prosecutes. The 2021 amendment added anti-doxxing offenses with extraterritorial reach.
Marketing and advertising
Notice-and-purpose model in which collection needs only notice, while Part 6A requires explicit consent-style agreement before using personal data in direct marketing, with criminal penalties for violations. Most channel decisions here follow from that consent rule.
Cross-border transfers
Section 33 transfer restrictions were enacted in 1995 but never brought into force; the PCPD publishes recommended model clauses instead.
Enforcement and penalties
Enforcement notices, then criminal prosecution; direct marketing offenses carry fines to HKD 1M and imprisonment.