PDPO

Summary

The Personal Data Privacy Ordinance (PDPO) is the main legislation in Hong Kong which aims to protect the privacy of individuals in relation to personal data, and to regulate the collection, holding, processing or use of personal data based on a set of data protection principles. The version used in this section is the PDPO 2021 update.

Definitions

Definition	Requirements
5_18. Data access request	229. Request access credentials 264. Request authentication
5_19. Compliance with data access request	331. Guarantee legal compliance
5_22. Data correction request	316. Allow rectification requests
5_23. Compliance with data correction request	316. Allow rectification requests 318. Notify third parties of changes
5_26. Erasure of personal data no longer required	183. Delete sensitive data securely 317. Allow erasure requests 360. Remove unnecessary sensitive information
5_27. Log book to be kept by data user	085. Allow session history queries 377. Store logs based on valid regulation 378. Use of log management system
6_31. Matching procedure request	025. Manage concurrent sessions 088. Request client certificates 189. Specify the purpose of data collection
9A_66G. Powers exercisable in relation to premises and electronic devices	350. Enable memory protection mechanisms 351. Assign unique keys to each device 352. Enable trusted execution
S1_1. Purpose and manner of collection of personal data	189. Specify the purpose of data collection 310. Request user consent
S1_2. Accuracy and duration of retention of personal data	315. Provide processed data information 316. Allow rectification requests 318. Notify third parties of changes 360. Remove unnecessary sensitive information
S1_3. Use of personal data	310. Request user consent 315. Provide processed data information
S1_4. Security of personal data	062. Define standard configurations 096. Set user's required privileges 122. Validate credential ownership 176. Restrict system objects 181. Transmit data using secure protocols 183. Delete sensitive data securely 185. Encrypt sensitive information 229. Request access credentials 232. Require equipment identity 238. Establish safe recovery 264. Request authentication 300. Mask sensitive data 321. Avoid deserializing untrusted data 329. Keep client-side storage without sensitive data 375. Remove sensitive data from client-side applications
S1_5. Information to be generally available	225. Proper authentication responses 315. Provide processed data information 331. Guarantee legal compliance
S1_6. Access to personal data	229. Request access credentials 264. Request authentication 316. Allow rectification requests

free trial

Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.