Personal Data (Privacy) (Amendment) Ordinance 2012

Amendments to the Personal Data (Privacy) Ordinance include:

Outsourcing Personal Data Processing (effective 1 October 2012)

• If a data user engages a data processor, whether within or outside Hong Kong, to process personal data on the data user’s behalf, the data user must adopt contractual or other means to (i) prevent any personal data transferred to the data processor from being kept longer than is necessary for processing of the data; (ii) prevent unauthorized or accidental access, processing, erasure, loss or use of the data transferred to the data processor for processing.