Join our webinar on democratizing data in the cloud with Forrester, Snowflake and TIAA - Sign up here

Start Now
Free Trial Schedule a Demo

PDPO

Know your Privacy Rights with the Hong Kong’s PDPO

Download the book today!

PrivacyOps - Automation & Orchestration for Privacy Compliance
Download Book
Available in PDF
PrivacyOps Book small

The Personal Data (Privacy) Ordinance (Cap. 486) as amended in 2012 (the “PDPO)  is the primary legislation in Hong Kong which was enacted to protect the privacy of individuals’ personal data, and regulate the collection, holding, processing, disclosure, or use of personal data by the organizations. The Data Protection Principles ( the “DPPs or DPP ''), which are contained in Schedule 1 to the PDPO, outline how entities should collect, handle, disclose, and use personal data.

The solution

Securiti enables organizations to comply with Hong Kong’s PDPO through AI-driven PI data discovery, DSR automation, documented accountability, enhanced visibility into data processing activities, and AI-driven process automation.

securiti dashboard

Securiti supports enterprises in their journey toward compliance with Hong Kong’s PDPO through automation, enhanced data visibility, and identity linking.

See how our comprehensive PrivacyOps platform helps you comply with various sections of  Hong Kong’s PDPO.

Automate data subject access request handling

PDPO Sections: 18, 19, 28(1); DPP 6

The automation of the delivery and generation of secure data access reports will greatly reduce the risk of compliance violations and reduce the workforce required to comply with all the access requests.

dsr handling
data access request

Secure fulfillment of data access

PDPO Sections: 18-21, 28(1); DPP 6

The information is disclosed through a secured and centralized point to data subjects within a limited timeframe. It allows organizations to timely respond to an access request and provide information in a manner that it is readily retrieved.

Automate the processing of rectification requests

PDPO Sections: 22-25; DPPs: 2(1)(b), 6

Fulfill data rectification requests, seamlessly, using automated data subject verification workflows across all appearances of a data subject’s personal data.

data rectify request
data erasure request

Automate erasure requests

PDPO Section: 26; DPP 2(2)

Fulfill data subjects’ erasure requests, swiftly, through automated and flexible workflows.

Automate object and restriction of processing requests

PDPO Sections: 35(G)(L); DPP 6

With the help of collaborative workflows, build a framework for objection and restriction of processing handling based on business requirements.

personal data monitoring tracking

Continuous monitoring and tracking

PDPO Sections: 27; DPPs: 1,2,3,5

Keep track of risks against non-compliance to data subjects’ rights by continuously monitoring and scanning data.

Automate People Data Graph

Discover personal data stored across all your internal and external systems within the organization and link them back to a unique data subject. Also, visualize personal data sprawl and identify compliance risks.

personal information data linking
cookie consent

Meet cookie compliance

PDPO Sections: 27; DPPs: 1,2,3,5

Keep track of risks against non-compliance to data subjects’ rights by continuously monitoring and scanning data.

Monitor and track consent

PDPO Sections: 35(A)(E)(H); DPPs: 1 & 3

Track and honor consent and consent revocation as well as any changes to data subject’s preferences concerning the use of their personal data to prevent the transfer or processing of data without their consent.

consent preference management
Assess GDPR readiness

Assess PDPO readiness

PDPO Sections: 12; DPPs: 1-6

Measure your organization’s posture against the  PDPO’s requirements with the help of our multi-regulation, collaborative, readiness, and data protection impact assessment system. It allows you to identify gaps in compliance and address the risks. Seamlessly expand assessment capabilities across your vendor ecosystem to maintain compliance against the PDPO’s requirements.

Map Data Flows

PDPO Sections: 27; DPPs: 1, 2, 3, 5

Track data flows in your organizations by having a centralized catalogue of internal data process flows as well as flows for data transfer to service providers and other third parties. Maintaining updated records of data processing activities enables you to demonstrate compliance with the applicable legal requirements.

manage vendor risk

Manage vendor risk

PDPO Sections: 65(2); DPPs: 2(3) & 4

Track, manage and monitor privacy and security readiness for all your service providers from a single interface. Collaborate instantly with vendors, automate data requests, and manage all vendor contracts and compliance documents.

Breach Response Notification

Guidance on Data Breach Handling and the Giving of Breach Notifications

Automates compliance actions and breach notifications to concerned stakeholders in relation to security incidents by leveraging a knowledge database on security incident diagnosis and response.

breach response notification

5 key data subject rights encoded within New Zealand Privacy Act

Access

Data subjects have the right to access their personal data held by an organization.

Correction

Data subjects have the right to request the rectification of their incomplete and/or inaccurate personal data held by an organization.

Erasure

There is no explicit right to erasure available under the PDPO, however, data subjects can request the data user to delete his/her personal data that is no longer necessary for the processing.

Object

Data subjects have the right to object to their personal data being processed for direct marketing purposes.

Consent

A data subject can withdraw his/her consent previously given by the written notice.

Quick facts about Hong Kong PDPO

1

Hong Kong’s PDPO came into force on the 20th December 1996, and major amendments it took place in 2012.

2
Data subjects may seek compensation by civil action from data users for damage caused by a contravention of the PDPO’s provisions.
3
Under the PDPO, there is no mandatory breach notification requirement, but notification to the Office of Privacy Commissioner for the Personal Data (and data subjects, where appropriate) is recommended.
4
The PDPO is applicable to both the private and the public sectors.
5
Contravention of an enforcement notice issued by the Commissioner is an offense that may result in a maximum fine of HK $50,000 and imprisonment for two years.

Products

Solutions

Systems

Company

Resources

Terms

Get in touch

info@securiti.ai
PO Box 13039,
Coyote CA 95013

Copyright © 2021 SECURITI.ai

Sitemap - XML Sitemap