Data Privacy Consent Form Template for Hong Kong
Generate a bespoke document
What is a Data Privacy Consent Form?
The Data Privacy Consent Form is a crucial document required under Hong Kong's Personal Data (Privacy) Ordinance (PDPO) for organizations collecting and processing personal data. It serves as a formal mechanism to obtain explicit consent from individuals (data subjects) and fulfill the notification requirements under Data Protection Principle 1. The form should be used whenever collecting personal data from individuals, whether they are customers, employees, or other stakeholders. It must clearly state the purposes of data collection, intended uses, potential data transfers, and the rights of data subjects. The document needs regular review and updates to reflect any changes in data processing activities or regulatory requirements in Hong Kong.
Trusted by high-performance teams
Frequently Asked Questions
What is a Data Privacy Consent Form under Hong Kong's PDPO?
A Data Privacy Consent Form is a written document that records an individual's agreement to your organisation collecting, using, processing or transferring their personal data. In Hong Kong it's designed to comply with the Personal Data (Privacy) Ordinance (Cap. 486) and guidance from the Privacy Commissioner for Personal Data (PCPD). It sets out the purposes of collection, data subject rights, retention periods and any cross-border transfers, giving you a documented basis for your data handling.
When does an organisation need a Data Privacy Consent Form in Hong Kong?
You generally need written consent before collecting personal data across common business scenarios. Typical examples include: Onboarding new employees for payroll, benefits and HR management; Running marketing campaigns through surveys, newsletters or loyalty programmes; Collecting patient medical information or student and parent academic records; Gathering customer payment and shipping details in e-commerce; Recruiting participants for research involving personal data. Sensitive data, such as health or financial information, usually calls for explicit opt-in consent rather than implied consent.
What must a valid consent form include under Hong Kong law?
To be valid under the PDPO, the form should identify the data controller (including business registration details and a contact for your Data Protection Officer), explain the specific purposes of collection, and state whether data is shared with third parties. It should also set out retention periods, storage security measures, and individual rights to access, correct or delete data. For sensitive data you need explicit opt-in consent, and cross-border transfers require disclosure of recipient jurisdictions and protection standards.
Is there an official PCPD consent form template for Hong Kong?
The Privacy Commissioner for Personal Data (PCPD) publishes guidelines on the collection and use of personal data rather than a single mandatory form. A consent form is compliant when it follows the PDPO's six Data Protection Principles and PCPD guidance, using clear language and full disclosure of your data practices. GenieAI offers an editable Data Privacy Consent Form template built around these Hong Kong requirements, which you can tailor to your organisation.
Can consent be withdrawn, and what happens if it is?
Yes. Under the PDPO an individual can withdraw consent at any time. Your form should explain how someone withdraws consent and the consequences of doing so, for example that you may no longer be able to provide a service that depends on that data. Giving people this information up front, alongside reasonable time to review the form before agreeing, supports valid consent and transparency with data subjects.
What language should the consent form be in, and does it cover cross-border transfers?
The form should be provided in Chinese or English depending on your target audience, and individuals must have reasonable time to review it before consenting. If you transfer personal data outside Hong Kong, the form needs additional detail per PCPD guidance, including the recipient countries and the protection measures in place to keep that data adequately protected. Requirements can vary by situation, so complex or high-volume transfers may warrant professional advice.
About the Data Privacy Consent Form
When your organization collects personal data in Hong Kong, you need more than just verbal agreement from individuals. You need a comprehensive Data Privacy Consent Form that complies with the Personal Data (Privacy) Ordinance (PDPO) and demonstrates your commitment to protecting individual privacy rights. This document serves as your legal foundation for data collection and processing activities.
When do you need this document?
You must obtain written consent before collecting personal data in various business scenarios. When onboarding new employees, you need consent to collect and process their personal information for payroll, benefits, and HR management. If you're running marketing campaigns that collect customer data through surveys, newsletters, or loyalty programs, explicit consent is mandatory. Healthcare providers require patient consent before collecting medical information, while educational institutions need student and parent consent for academic records. E-commerce businesses must obtain consent before collecting customer payment and shipping details, and any organization conducting research involving personal data needs participant consent.
Key legal considerations
Your consent form must include specific elements to be legally valid under Hong Kong law. The data controller information section must clearly identify your organization, including business registration details and contact information for your Data Protection Officer. You must provide a detailed explanation of collection purposes, specifying exactly how you'll use the personal data and whether it will be shared with third parties. The form should outline data retention periods and storage security measures you've implemented. Include clear information about individual rights, such as the right to access, correct, or delete personal data. For sensitive personal data like health records or financial information, you need explicit opt-in consent rather than implied consent. If you're transferring data outside Hong Kong, you must specify recipient countries and ensure adequate protection measures are in place.
Legal requirements in Hong Kong
The Personal Data (Privacy) Ordinance establishes six Data Protection Principles that your consent form must address. Data Protection Principle 1 requires that personal data collection is lawful, fair, and for specified purposes that are directly related to your organization's functions. You must comply with PCPD Guidelines on Collection and Use of Personal Data, which mandate clear language and comprehensive disclosure of data practices. For employment-related data collection, follow the Code of Practice on Human Resource Management requirements. Cross-border data transfers require additional consent elements as outlined in PCPD guidance, including disclosure of recipient jurisdictions and protection standards. The form must be provided in Chinese or English, depending on your target audience, and individuals must have reasonable time to review before providing consent. Remember that consent can be withdrawn at any time, so your form should explain the withdrawal process and its consequences.
GOVERNING LAW
Applicable law
This Data Privacy Consent Form is drafted to comply with Hong Kong law. Key legislation includes:
PCPD Guidelines on the Collection and Use of Personal Data: Official guidelines issued by the Privacy Commissioner providing practical guidance on compliance with the PDPO, including requirements for obtaining valid consent
Code of Practice on Human Resource Management: Specific guidelines for handling employee personal data in the context of human resources management
Guidance on Cross-border Data Transfer: Guidelines relating to the transfer of personal data outside of Hong Kong, including requirements for consent and ensuring adequate data protection in receiving jurisdictions
Direct Marketing Guidelines: Specific requirements under the PDPO for obtaining consent for direct marketing purposes, including prescribed information and consent requirements
Explore 208,390+ legal templates
Explore 208,390+ legal templates
Genie's Security Promise
Genie is the safest place to draft. Here's how we prioritise your privacy and security.
Your data is private:
We do not train on your data; Genie's AI improves independently
All data stored on Genie is private to your organisation
Your documents are protected:
Your documents are protected by ultra-secure 256-bit encryption
We are ISO27001 certified, so your data is secure
Organizational security:
You retain IP ownership of your documents and their information
You have full control over your data and who gets to see it