About the Office of the Privacy Commissioner for Personal Data, Hong Kong

Who we are

The Office of the Privacy Commissioner for Personal Data (the "Commissioner's Office") is an independent statutory body established to oversee the enforcement of the Personal Data (Privacy) Ordinance (the "Ordinance") to protect the privacy of individual with respect to their personal data.

The Ordinance was enacted on 3 August 1995. The Commissioner's Office was established on 1 August 1996 and the Ordinance came into effect on 20 December 1996.

PDF (28.9MB)

Mission of the Commissioner's Office

To secure the protection of privacy of the individuals with respect to personal data through promotion, monitoring and supervision of compliance with the Ordinance in a cost-effective and efficient manner.

Functions and Duties of the Privacy Commissioner for Personal Data

The Privacy Commissioner for Personal Data is responsible for monitoring and supervising compliance with the provisions of the Ordinance. This can be done through a variety of means including the investigation of complaints, the inspection of personal data systems, the issuing of codes of practice, the review of legislation, the approval of matching procedures, the conducting of personal data privacy surveys, publicity campaigns, and international liaison.

The Deputy Privacy Commissioner for Personal Data assists the Privacy Commissioner in the overall administration and strategic planning of the Commissioner's Office. The Deputy Privacy Commissioner for Personal Data also has the responsibility for policy issues related to personal data privacy.

The Commissioner's Office is organized into Administration Division, Legal Division, Operations Division, Compliance Division, Policy Division and Corporate Communications Division.

About the Ordinance

Scope of Coverage

The Ordinance covers any personal data i.e. recorded information relating directly or indirectly to a living individual (data subject); from which it is practical to ascertain the identity of the individual; and in a form in which access to or processing of the data is practicable. It applies to any person (data user, including private sector, public sector and government department) who controls the collection, retention, processing or use of personal data.

Schedule 1 to the Ordinance sets out six data protection principles (DDPs) in line with international practice. They are:

DPP 1 - Purpose and manner of collection
DPP 2 - Accuracy and duration of retention
DPP 3 - Use of personal data
DPP 4 - Security of personal data
DPP 5 - Information to be generally available
DPP 6 - Access to personal data