Hong Kong PDPO

Personal Data (Privacy) Ordinance - 6 Data Protection Principles, doxxing prohibition (2021 amendment).


Short name	HK PDPO
Region	Asia-Pacific
Country or scope	Hong Kong
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers HK PDPO

Scan requirements: 5, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for HK PDPO.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for HK PDPO and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`HK-PDPO-DPP4` Security of Personal Data	Data users must take all reasonably practicable steps to protect personal data against unauthorised or accidental access, processing, erasure, loss or use, including integrity assurance for the software systems holding it (PDPO Schedule 1, DPP4(1))	Scan
`HK-PDPO-DPP4-INV` Knowing the Systems Holding Data	Reasonably practicable security steps presuppose knowing which software components store or process personal data, so those components must be inventoried (PDPO Schedule 1, DPP4)	Scan
`HK-PDPO-DPP4-2` Data Processor Safeguards	When a data processor is engaged, the data user must adopt contractual or other means to prevent unauthorised access to the data, which requires knowing the suppliers behind processing software (PDPO Schedule 1, DPP4(2))	Scan
`HK-PDPO-DPP2` Accuracy of Records	Data users must take reasonably practicable steps to ensure data held is accurate, and the same discipline applied to system records requires components documented with both name and version (PDPO Schedule 1, DPP2(1))	Scan
`HK-PDPO-DPP5` Openness of Policies and Practices	Data users must make their personal data policies and practices generally available, and supporting technical documentation should be identifiable and timestamped (PDPO Schedule 1, DPP5)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`DPP1`	Data Collection Purpose & Adequacy
`DPP2`	Accuracy & Retention
`DPP3`	Use Limitation
`DPP4`	Data Security
`DPP5`	Transparency & Privacy Policy Notice
`DPP6`	Access & Correction Rights
`PDPO-DOXX`	Doxxing Prevention & Response (Part 6A)
`PDPO-DPO`	Data Protection Officer Designation

Policy templates

Written for HK PDPO:

Hong Kong PDPO Data Protection Policy & Doxxing Response Plan

And 22 from the standard set, adapted to HK PDPO.