The legal framework
The PDPO gives rights of access and correction and imposes six data protection principles. Amendments in 2021 created a specific doxxing offence and gave the Privacy Commissioner powers to demand the removal of doxxing content, including from overseas platforms.
Key points
| Access request | Answered within 40 days; a fee may be charged |
|---|---|
| Correction | Available where data is inaccurate |
| Direct marketing | Consent required; breach is a criminal offence |
| Doxxing | A specific offence since 2021, with cessation notices and extraterritorial reach |
| Breach notification | Voluntary rather than mandatory, unusually for the region |
| Regulator | Privacy Commissioner for Personal Data |
| Cross-border transfers | The transfer provision has still not been brought into force |
| Data access request | A statutory right; a reasonable fee may be charged |
| Doxxing powers | The Commissioner can issue cessation notices and prosecute |
| Compensation | Available through the courts for damage, including injury to feelings |
In practice
- Write to the organisation first, citing the relevant statutory right; keep proof of the date.
- Set out clearly what you want: a copy of your data, deletion, or an end to marketing.
- If there is no adequate reply within the statutory period, complain to the regulator — it is free.
- For dating, health and fertility apps, ask specifically about third-party sharing and overseas transfers.
- Use the prescribed data access request form: non-compliance with it can justify refusal.
- For doxxing, ask the Commissioner for a cessation notice rather than going to court.
Cost and coverage
Access requests may carry a fee; complaints to the Commissioner are free.
Recent changes
The doxxing provisions have been used actively, including against overseas platforms, making Hong Kong one of the few places with a dedicated doxxing removal power.
Where to go
- Privacy Commissioner for Personal Data — complaints and doxxing hotline.
- Consumer Council for marketing-related complaints.
- Police Cyber Security and Technology Crime Bureau.
Worth knowing
If personal information is published to harass you, the doxxing route is faster than an ordinary privacy complaint: the Commissioner can issue a cessation notice directly to the platform. Unlike most regimes, a fee may be charged for a data access request. It must be directly related to the cost of compliance.
Official sources and links
- GovHK — official government portal