Seeking guidance on how to collect and use fully anonymised, non‑identifiable specimens for a retrospective study
The Enquiry
A diagnostic laboratory seeks guidance on how to collect and use fully anonymised, non‑identifiable specimens for a retrospective study.
Our Response
According to section 2(1) of the Ordinance, “personal data” means any data-
(a) relating directly or indirectly to a living individual;
(b) from which it is practicable for the identity of the individual to be directly or indirectly ascertained; and
(c) in a form in which access to or processing of the data is practicable.
If the data has been anonymised such that neither the data user nor any other party can directly or indirectly identify the individuals concerned, it is not regarded as personal data under the Ordinance. However, if the data user is able to re-identify any individual using existing or future information in combination with the anonymised data, the data may still constitute personal data, and the data user must comply with the requirements under the Ordinance, including the six Data Protection Principles (DPPs) of Schedule 1 to the Ordinance.
In addition, under section 62 of the Ordinance, personal data is exempt from the provisions of DPP 3 (the use of personal data), where the data is to be used for preparing statistics or carrying out research; the data is not to be used for any other purpose; and the resulting statistics or results of the research are not made available in a form which identifies the data subjects or any of them.
(Uploaded in February 2026)