Personal data rules for a small Hong Kong business: customers and marketing
Every Hong Kong business that keeps a customer list is a data user under the Personal Data (Privacy) Ordinance. The basics fit on one page, but the direct marketing rules are criminal offences with six-figure fines, and the email rules reach a Hong Kong company wherever its founder sends from. Here's the short version.
Updated 2 November 2026 · by LAULEGA LIMITED, licensed TCSP (TC000573)
The Personal Data (Privacy) Ordinance (Cap. 486) is enforced by the Office of the Privacy Commissioner for Personal Data (PCPD). It applies to anyone who controls the collection, holding, processing or use of personal data: a one-person consultancy with a client spreadsheet as much as a bank.
The six principles, in practice
Schedule 1 of the Ordinance sets out six data protection principles:
| Principle | In practice for a small business |
|---|---|
| 1. Collection | Collect only what you need for a lawful purpose. When you collect, tell people what it's for, who it may go to, and how to ask for access or correction |
| 2. Accuracy and retention | Keep it accurate, and don't keep it longer than you need it. If an outside provider processes it, the contract should stop them keeping it too long |
| 3. Use | Don't use it for a new purpose without the person's consent |
| 4. Security | Protect it against unauthorized or accidental access, loss or use, including at your service providers |
| 5. Openness | Make your policies and practices available: a privacy policy on the website |
| 6. Access and correction | People can ask what you hold and ask you to correct it. A data access request must be answered within 40 days (s.19) |
The usual way to meet principle 1 is a short personal information collection statement on every form that collects data: the purpose, who the data may be passed to, whether giving it is optional, and who to contact for access or correction.
Direct marketing: consent first, opt-out always
Part 6A of the Ordinance covers using personal data to market to people by name: post, fax, email or other messages addressed to specific people, and phone calls (s.35A). Before you use someone's data this way, you must (s.35C):
- tell them you intend to, and that you won't without their consent;
- tell them the kinds of personal data you'll use and the classes of goods or services you'll market;
- give them a free channel to say yes.
Then:
- Get consent before you market (s.35E). An indication of no objection counts as consent (s.35A), but it has to cover the data and the kind of marketing you actually send. Consent given by phone must be confirmed in writing within 14 days.
- The first time you market, tell the person they can opt out free of charge (s.35F).
- Honour opt-outs, at any time and free of charge, even if the person consented before (s.35G).
- Giving or selling data to others for their marketing needs separate, written consent (ss.35J, 35K).
Each of these is a criminal offence: up to HK$500,000 and three years' imprisonment, or HK$1,000,000 and five years where data is provided to others for gain. The PCPD's guidance note on direct marketing has worked examples and sample wording.
Marketing emails and texts: the electronic messages law
Commercial emails, texts and faxes are also covered by the Unsolicited Electronic Messages Ordinance (Cap. 593). It applies to messages with a "Hong Kong link", and a Hong Kong company's messages always have one, wherever they're sent from (s.3(1)(b)(iii), (3)). A founder sending a newsletter from Lisbon through their Hong Kong company is covered. The main rules:
- Every message needs an unsubscribe option that's clear, free, and keeps working for at least 30 days after sending (s.9(1)).
- Stop within 10 working days of an unsubscribe request (s.10), and keep a record of the request for at least three years (s.9(3)).
- Don't send to numbers on a do-not-call register unless the person has consented (s.11).
Most email platforms handle the unsubscribe link and suppression list. Your job is to make sure the PDPO consent came first, and that unsubscribes reach every list you send from.
A one-page checklist
- A collection statement on every form, and a privacy policy on the website.
- Only the fields you need. Delete what you no longer use.
- Contracts with your CRM, email and cloud providers that cover security and retention.
- A marketing consent box that names the kinds of data and the kinds of products you'll market.
- An opt-out line in the first marketing message, and every message, and a process that honours it everywhere.
- Someone named to answer access requests within 40 days.
An example (invented)
Juniper Lane Florists Limited takes orders online. Its checkout form says why it collects each field and who delivers the flowers. A separate, optional box asks whether the customer agrees to receive emails about seasonal flowers and workshops, using their name and email address.
The first newsletter tells subscribers they can opt out free of charge, and every email carries an unsubscribe link. When a customer replies “please stop” to a delivery email, the shop removes them from the newsletter list too, well within 10 working days.
Running a Hong Kong company from anywhere
LAULEGA keeps your company's registered office, filings and statutory registers in order, so the paperwork side of compliance is handled while you build the business. Our free tools draft the board resolutions you'll need along the way.
Business support Free document toolsFrequently asked questions
Does the PDPO apply to small businesses in Hong Kong?
Yes. The Personal Data (Privacy) Ordinance (Cap. 486) applies to any data user, meaning anyone who controls the collection, holding, processing or use of personal data, whatever their size.
Do I need consent to send marketing emails in Hong Kong?
To use someone's personal data in direct marketing, you must first tell them what data and which kinds of goods or services are involved, give them a free way to consent, and get their consent (Cap. 486 ss.35C, 35E). Commercial emails must also carry an unsubscribe option (Cap. 593 s.9).
How quickly must I stop marketing after an opt-out?
Under the PDPO, you must comply with an opt-out request (Cap. 486 s.35G). For commercial electronic messages, the Unsolicited Electronic Messages Ordinance requires sending to stop within 10 working days of an unsubscribe request (Cap. 593 s.10).
Does Hong Kong's spam law apply if I send from overseas?
If the sender is a Hong Kong company, yes. Its commercial electronic messages have a Hong Kong link wherever they are sent from (Cap. 593 s.3(1)(b)(iii) and (3)).
How long do I have to answer a data access request?
40 days after receiving it (Cap. 486 s.19(1)). If you can't, tell the requestor in writing why before the 40 days run out, and comply as soon as practicable.
What are the penalties for direct marketing breaches?
Fines of up to HK$500,000 and imprisonment for three years for most Part 6A offences, and up to HK$1,000,000 and five years for providing personal data to others for gain without consent.
This guide summarises the Personal Data (Privacy) Ordinance (Cap. 486) and the Unsolicited Electronic Messages Ordinance (Cap. 593) as published on e-Legislation on 30 October 2026. It doesn't cover exemptions, cross-border transfer or sector-specific rules. It is general information, not legal advice; for your own business, see the PCPD's guidance and ask your adviser. The example business is invented. Written by LAULEGA LIMITED, a licensed trust or company service provider (TCSP licence TC000573).