Consent Personal Information Form Template for Hong Kong

A Consent Personal Information Form is your essential legal safeguard when collecting personal data in Hong Kong. Under the Personal Data (Privacy) Ordinance (PDPO), you must obtain clear, informed consent before processing any individual's personal information. This document protects both your organization and the data subjects by establishing transparent data handling practices and ensuring regulatory compliance.

When do you need this document?

You need this form whenever your organization collects personal data from individuals in Hong Kong. This includes customer registration processes, employee onboarding, marketing campaigns, online services, and membership applications. The form becomes particularly critical when collecting sensitive personal data such as health information, financial details, or identity documents. If you're engaging in direct marketing activities or plan to share data with third parties, explicit consent through this form is mandatory under the PDPO. Organizations conducting business across borders also require this document to establish lawful basis for international data transfers, even though section 33 of the PDPO on cross-border transfers is not yet in force.

Key legal considerations

Your consent form must clearly identify your organization as the data controller and specify the exact purposes for data collection. The PDPO requires that consent be freely given, specific, informed, and unambiguous. You cannot bundle consent with other terms and conditions, and individuals must be able to withdraw consent easily. The form should detail what types of personal data you're collecting, how long you'll retain it, and your security measures. If you're using the data for direct marketing, you must comply with the PDPO's specific direct marketing provisions, including providing opt-out mechanisms. Remember that consent for one purpose doesn't automatically cover other uses - you need separate consent for each distinct purpose.

Legal requirements in Hong Kong

Under Hong Kong's PDPO, your consent form must comply with the six Data Protection Principles. You must inform data subjects of their rights, including access to their personal data, correction rights, and the right to object to data processing. The Privacy Commissioner for Personal Data (PCPD) requires that consent forms be written in plain language that ordinary individuals can understand. Your form must include your organization's contact details and information about how individuals can exercise their rights or file complaints. While the cross-border transfer provisions aren't yet active, you should still inform subjects if their data will be transferred outside Hong Kong. The PCPD's guidance emphasizes that consent must be an active choice - pre-ticked boxes or implied consent through continued service use are not acceptable for most data processing activities.