appConfigEntityId

bodyType

customContents

entityId

entityUuid

isVideo

articlePageQuery

article

articleSchemaContent

content

hooksArticlePageAdvertisementConfigArticle

hooksArticlePageFloatingButtonConfigArticle

appConfig

filter

json

liveArticle

Harvey Kong

Hong Kong’s privacy watchdog plans to consult lawmakers this year about introducing mandatory data breach reporting and related penalties, the body’s chief has said.
Privacy Commissioner for Personal Data Ada Chung Lai-ling on Saturday revealed details about the proposed legislative amendments to the city’s privacy ordinance, after authorities stalled the plan in 2024 over concerns the measures could hurt the local business environment.
“We really hope that we have some specific recommendations this year, so we can consult the Legislative Council,” Chung said in a televised interview, adding the measures could be carried out in phases.
The government in 2024 put on hold a legislative reform to empower authorities to penalise companies for data breaches due to concerns that it might dampen the local business environment.
Erick Tsang Kwok-wai, the then secretary for constitutional and mainland affairs, said authorities could consider a “piecemeal approach” by first introducing minor improvements to minimise the impact on small businesses.
Chung said on Saturday the Office of the Privacy Commissioner for Personal Data was considering measures such as the mandatory reporting of data breaches and the introduction of administrative fines for such incidents.
She said one option that authorities were considering was to roll out some measures first and implement fines at a later stage.
“We have a basket of factors to consider for fines, for instance, the company’s financial situation or the severity of their violations. If everyone adheres to the law, there is no need to be afraid of fines,” she said.
Asked if authorities would consider having different tiers of fines based on the size and finances of the companies, Chung said small and medium-sized enterprises differed from multinational companies and that her office would consider this when determining punishments.

The watchdog received 246 data breach notices in 2025, a 21 per cent increase from 203 cases in the year before.
Hacking was the main cause of data leaks, accounting for 81 cases, about one-third of the total. The number of hacking cases rose by 33 per cent year on year from 61 in 2024.
The office also received 4,228 complaints about personal data privacy breaches from members of the public, a 23 per cent increase, year on year.
Chung said the watchdog received 43 reports of job scams in January targeting construction workers’ personal data, with another 83 reports made in recent days.
She said scammers asked construction job seekers to provide their Hong Kong identity card numbers, worker registration cards and Construction Industry Safety Training certificates. But the victims found the agents became uncontactable once details were submitted.
“You really need to be careful. Always verify the identity of the agent or the recruiter,” she said. “Do not just give out your personal information. We’ve seen cases where people even hand over their bank account numbers, which is quite dangerous.”
Lawmaker Jonathan Stuart Lamport, who represents the business sector, said he supported the need to protect personal data but he hoped any proposal to amend the privacy ordinance would not raise compliance costs for the sector as the economy was still recovering.
Lamport added that the watchdog and the government should gather opinions from the sector when looking into changes to the ordinance.
Legislator Peter Shiu Ka-fai, who represents the retail sector, conceded it was difficult for regulations to be enforced if there were no penalties, but noted that any fines must be proportional to the severity of the violations.
Shiu said he hoped authorities could issue a code of practice or guidelines that could exempt companies from responsibility if they had followed them accordingly, with those not complying being issued penalties based on the severity of their infractions.
The lawmaker also said that it was impossible to expect businesses to avoid cost increases when taking measures to protect personal data, but he hoped authorities could find solutions for companies to comply with requirements more affordably or introduce tiered requirements depending on the size of firms.


Opening hours cut short as large crowds at lantern display spark safety fears

HK Electric to cut fuel charge for first time in 4 months as CLP raises rate

Hong Kong teacher jailed for 3 years for molesting pupil during free tutoring

Hong Kong astronaut Lai Ka-ying sends Mid-Autumn Festival wishes to residents from space

Hong Kong society

Hong Kong plans to revive privacy law requiring firms to report data breaches

Privacy Commissioner Ada Chung says the mandatory breach reporting measures may be carried out in phases. Photo: Jelly Tse

The watchdog received 246 data breach notices in 2025, with hacking as the main cause of leaks. Photo: Getty Images

Data leaks jump 21% in Hong Kong, doxxing cases hit record low

Privacy Commissioner for Personal Data Ada Chung. Photo: Jelly Tse

Ada Chung has said that the number of doxxing cases has dropped significantly since legislation criminalising the act was passed in 2021. Photo: Jelly Tse

Hong Kong urged to fast-track privacy law reforms amid surge in data breaches

The local branch of the charity Oxfam, which organises an annual hiking fundraiser, suffered a data breach that might have affected more than 470,000 people. Photo: Dickson Lee

Privacy Commissioner Ada Chung has said amendments to the privacy law are under discussion. Photo: Jelly Tse

The privacy watchdog has launched an investigation into a data breach at Oxfam Hong Kong. Photo: Jelly Tse

News

Hong Kong

Society

Privacy Commissioner Ada Chung says watchdog intends to consult lawmakers this year after legislative reform was put on hold in 2024


Privacy Commissioner Ada Chung says watchdog intends to consult lawmakers this year after legislative reform was put on hold in 2024.


The Office of the Privacy Commissioner for Personal Data

Cybersecurity

Ada Chung Lai-ling

Legislative Council of Hong Kong (Legco)

Hong Kong plans to revive privacy law requiring firms to report data breaches

.css-1c6uqr6{color:inherit;font-weight:inherit;font-size:inherit;font-family:inherit;line-height:inherit;overflow-wrap:break-word;}Privacy Commissioner Ada Chung says watchdog intends to consult lawmakers this year after legislative reform was put on hold in 2024

Privacy Commissioner Ada Chung says watchdog intends to consult lawmakers this year after legislative reform was put on hold in 2024