[Home](/)/[Resources](/resources)/Hong Kong Data Privacy (PDPO) Hong KongData Privacy # Hong Kong Personal Data (Privacy) Ordinance: Connected Product Obligations for Hardware Makers Every connected device that collects data from Hong Kong users is subject to PDPO — regardless of where the device maker is incorporated. The six Data Protection Principles govern everything from onboarding consent flows to cloud infrastructure decisions. Understanding where PDPO aligns with GDPR and where it diverges is the fastest path to a defensible compliance position for IoT products entering the Hong Kong market. Copy Link[Share on WhatsApp](https://wa.me/?text=https%3A%2F%2Fkrono-labs.com%2Fguides%2Fhong-kong-data-privacy-pdpo) At a glance Law Personal Data (Privacy) Ordinance (Cap. 486) Regulator Privacy Commissioner for Personal Data (PCPD) Data Protection Principles 6 DPPs Cross-border Prescribed restrictions ## PDPO obligations for connected hardware makers ### The six Data Protection Principles (DPPs) and how they apply to IoT products PDPO establishes six DPPs that govern the entire lifecycle of personal data. DPP1 requires data to be collected for a lawful purpose and only to the extent necessary. DPP2 requires accuracy and limited retention. DPP3 restricts use to the original collection purpose without consent. DPP4 mandates security safeguards. DPP5 requires transparency about data policies. DPP6 grants data subjects the right to access and correct their data. For IoT devices, every sensor, telemetry stream, and cloud sync is a potential collection point that must be mapped to these principles. ### Consent obligations for data collection by connected devices Under DPP1 and DPP3, data subjects must be informed of the purpose of collection and their data may not be used for other purposes without voluntary and explicit consent. For connected hardware, this means the onboarding flow, app registration, and device setup must clearly disclose what data is collected, why, and by whom. Implied consent through continued use of a device is not sufficient for sensitive data categories. Consent must be separately obtained for each distinct use purpose. ### Direct marketing restrictions and the opt-out register PDPO Part 6A prohibits using personal data for direct marketing without the data subject's explicit consent. This applies to connected hardware makers who collect user contact details or behavioral data and use them for product marketing, upgrade offers, or third-party promotions. An opt-out request must be complied with within a reasonable time. The PCPD maintains a register of data users who have been directed to cease direct marketing activities. ### Cross-border personal data transfer restrictions under PDPO PDPO Section 33 restricts transfer of personal data to places outside Hong Kong unless prescribed conditions are met — including that the destination place has laws substantially similar to PDPO, the data subject consents, or appropriate contractual safeguards are in place. Section 33 has been in force but has not yet been fully activated by the Secretary for Constitutional and Mainland Affairs; however, the PCPD recommends treating it as best practice and may activate it. Cloud infrastructure decisions — particularly routing Hong Kong user data through servers in jurisdictions without comparable protection — carry ongoing compliance risk. ## PDPO compliance workflow for IoT products 01 Map all personal data collected by the connected device and associated cloud services — device identifiers, location data, usage telemetry, health metrics, user account information — and document the legal basis for each collection under DPP1. 02 Prepare a Privacy Policy Statement (PICS) aligned with DPP1 and DPP3: it must identify the data user, state the purposes of collection, describe the classes of persons to whom data may be transferred, and inform the subject of their right to access and correct their data. 03 Implement technical and organizational safeguards meeting DPP4: encryption in transit and at rest, access controls, regular security review, and an incident response process — document these in an internal security policy. 04 Establish a data subject access and correction request process that can respond within 40 days as required by DPP6 — this includes a mechanism for users to request their data, have errors corrected, and understand the source of their data. 05 Assess any cross-border transfer of personal data from Hong Kong users and apply contractual safeguards (data transfer agreements, standard clauses, or equivalent) as recommended by PCPD guidelines, particularly for cloud infrastructure in jurisdictions without equivalent data protection law. ## Frequently asked questions ### Does PDPO apply to companies outside Hong Kong that collect Hong Kong users' data? PDPO applies to 'data users' who control the collection, holding, processing, or use of personal data in Hong Kong. A company incorporated outside Hong Kong that operates a connected device or cloud service used by Hong Kong residents is likely a data user under PDPO if it controls how data collected from Hong Kong users is processed. The extra-territorial reach is less explicit than under GDPR, but the PCPD has consistently taken the position that the Ordinance applies based on where data subjects are located, not only where the data user is incorporated. ### What counts as 'personal data' under PDPO for IoT devices? Personal data under PDPO means any data relating to a living individual who can be identified from the data or from the data together with other information in the data user's possession. For IoT devices, this captures device identifiers (where linkable to an individual), location history, usage patterns, health or biometric data, voice recordings, and user account information. Aggregate or truly anonymised data that cannot re-identify individuals falls outside the Ordinance, but the threshold for genuine anonymisation is high and de-identified data that can be re-linked is still personal data. ### How does PDPO compare to GDPR for connected devices? PDPO and GDPR share a principles-based approach — both require purpose limitation, data minimisation, security, and data subject rights. The key practical differences for hardware makers are: PDPO has no mandatory data breach notification requirement (though PCPD guidance recommends voluntary notification), PDPO does not require a Data Protection Officer appointment, and the penalty regime under PDPO has historically been lower than GDPR's maximum fines. PDPO's cross-border transfer restrictions in Section 33 are analogous to GDPR Chapter V adequacy decisions, though they have not been fully activated. Companies compliant with GDPR will generally cover most PDPO obligations with some Hong Kong-specific adjustments. ### What are the penalties for PDPO breaches? The PCPD can issue Enforcement Notices requiring a data user to remedy a contravention. Non-compliance with an Enforcement Notice is a criminal offence carrying fines and imprisonment. Recent 2021 amendments introduced direct criminal liability for doxxing offences and expanded the PCPD's investigatory and enforcement powers, including the power to conduct compliance inspections and refer cases for prosecution. The maximum fine for contravening an Enforcement Notice is HKD 50,000 on first conviction, with continuing offences attracting daily fines. Intentional or reckless breaches under the 2021 amendments carry higher penalties. **Disclaimer:** Educational resource only. Regulatory requirements change and vary by product category. Consult an accredited test laboratory or qualified compliance engineer before making certification decisions. 🇭🇰 Hong Kong roadmap for your product Every standard, document, and test that applies — free, no account required. See your free roadmap[ Want an expert to take your product through 🇭🇰 Hong Kong compliance for you? One consultant from Krono's compliance team takes your product from requirements to legal sale, with a fixed quote before any work starts. See compliance services](/services) Learn this properly In-depth course that teaches the full process, not just this one answer. [Start the course — $149](/courses/62-hong-kong-ofca-radio-equipment-certification)[Prefer to read? Get the book — $34.99](/books/62-hong-kong-ofca-radio-equipment-certification) Related guides * [Hong Kong Compliance OverviewComplete guide to Hong Kong product compliance: OFCA radio licensing, EMSD electrical safety, medical device listing, and Cust…](/guides/hong-kong-compliance-overview) * [Canada Privacy Law for Connected DevicesPIPEDA and incoming Bill C-27/CPPA privacy obligations for connected devices sold in Canada: consent, breach notification, and IoT data mapping.](/guides/canada-privacy-law-connected-devices) * [UAE Personal Data Protection Law (PDPL)UAE Federal Decree-Law No. 45 of 2021 (PDPL) for connected product makers: data collection obligations, cross-border transfers, and Arabic privacy notices.](/guides/uae-data-protection-pdpl) * [Australia Privacy Act for Connected DevicesAustralia Privacy Act 1988 for connected devices: the 13 APPs, NDB 30-day breach notification, and 2024 reform obligations for IoT product makers.](/guides/australia-privacy-act-connected-devices)