Página traduzida e verificada automaticamente. Prevalece a versão em inglês. Algumas partes ainda estão em inglês enquanto a tradução é verificada. Ver em inglês · Informar um erro de tradução

Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →

Alcance e base legal

Alcance extraterritorial
1
Applies to data users controlling data in or from Hong Kong; no express reach over foreign businesses targeting Hong Kong residents.s.2(1) 'data user'; s.33 not in force · source ↗
Base legal
1
No lawful-basis list; collection must be lawful, fair and for a purpose directly related to the data user's functions.Sch. 1 DPP1 · source ↗ Consolidated text read was truncated after s.35B; this provision cited from the Ordinance without re-reading.
Dados sensíveis
0
No special category of sensitive data.None · source ↗
Crianças
0
No age threshold or children-specific consent rule.None · source ↗ Parents may make access requests for minors (s.18).

Direitos das pessoas

Direitos
1
Access and correction only.ss.18, 22 · source ↗
Prazo para solicitações
1
Comply with a data access request within 40 days.s.19(1) · source ↗
Marketing
3
Consent (incl. 'no objection') required before using or providing personal data for any direct marketing; oral consent confirmed in writing within 14 days.ss.35C, 35E · secondary source · source ↗ Penalty up to HKD 500,000 and 3 years.

Governança

DPO obrigatório
0
No DPO requirement.None · source ↗
Qualificações do DPO
–
Not addressedNone · source ↗
Registro
0
Data user return scheme exists but has not been activated for any class of data user.s.14 · source ↗
DPIA
1
Not required; PCPD recommends PIAs.None (PCPD guidance) · source ↗
Registros
1
Log book required only for refused access or correction requests, kept 4 years.s.27 · source ↗
Retenção
2
Do not keep data longer than necessary and take practicable steps to erase it.s.26; Sch. 1 DPP2(2) · source ↗

Violações

Avisar o regulador
0
No mandatory notification; voluntary notice to PCPD encouraged.None · secondary source · source ↗ Government proposed mandatory breach notification (Jan 2025); no bill enacted as of 18 Oct 2026 found.
Informar as pessoas
0
No mandatory notification to individuals.None · secondary source · source ↗

Transferências

Transferências para o exterior
0
No transfer restriction in force; s.33 never commenced. PCPD recommends model contract clauses.s.33 (not in operation) · source ↗
Localização de dados
0
No data localization requirement.None · source ↗

Fiscalização

Multa máxima
2
Criminal fines up to HKD 1,000,000 (about USD 128k) for doxxing causing harm or selling data for marketing.ss.35J, 64(3D) · secondary source · source ↗ No administrative fines.
Responsabilidade criminal
2
Imprisonment up to 5 years for doxxing causing harm or providing data for direct marketing for gain; contravening enforcement notices also an offense.ss.35J, 50A, 64 · secondary source · source ↗ s.35J and s.50A amounts from recall.
Ação privada
2
Individuals suffering damage, including injury to feelings, may claim compensation; PCPD may give legal assistance.ss.66, 66B · source ↗ Consolidated text read was truncated after s.35B; this provision cited from the Ordinance without re-reading.

Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.

Biblioteca de regulamentações

Todas as leis estaduais de privacidade dos EUA em um só mapa

24 estados têm uma lei abrangente de privacidade na biblioteca, ao lado das leis da UE, do Reino Unido, federais dos EUA e globais: 102 no total, cada uma explicada em linguagem simples com suas fontes. Selecione um estado para ver o que se aplica lá.

  • Em vigor
  • Entrando em vigor
  • Leis setoriais
AK ME VT NH WA ID MT ND MN IL WI MI NY RI MA OR NV WY SD IA IN OH PA NJ CT CA UT CO NE MO KY WV VA MD DE AZ NM KS AR TN NC SC DC OK LA MS AL GA HI TX FL