Staff Privacy Notice Template for Hong Kong

A Staff Privacy Notice is a fundamental legal document required under Hong Kong's Personal Data (Privacy) Ordinance that transparently communicates how your organization collects, processes, and protects employee personal data. This document ensures compliance with PDPO's data protection principles while establishing trust and transparency with your workforce regarding their privacy rights.

When do you need this document?

You must implement a Staff Privacy Notice before collecting any personal data from employees, job applicants, contractors, or temporary workers in Hong Kong. This requirement applies when hiring new staff, onboarding existing employees to new data processing activities, implementing new HR systems, or conducting background checks. The notice is particularly crucial during recruitment processes where sensitive information like medical records or criminal history checks are collected. Organizations expanding into Hong Kong or updating their data processing practices must also ensure their privacy notices reflect current operations and comply with local requirements.

Key legal considerations

Your Staff Privacy Notice must address the six data protection principles under the PDPO, including purpose limitation, data minimization, accuracy, retention limits, security safeguards, and access rights. The document should clearly specify legal bases for processing different categories of personal data, from basic employment information to sensitive data like health records or biometric information. Special attention must be paid to cross-border data transfers, particularly given Hong Kong's position as an international business hub where employee data often flows to overseas parent companies or service providers. The notice should also outline employee rights including access, correction, and data portability, while establishing clear procedures for handling privacy complaints and data subject requests.

Legal requirements in Hong Kong

Under the Personal Data (Privacy) Ordinance (Cap. 486), you must provide this notice at or before the point of data collection, ensuring employees understand how their information will be used. The Employment Ordinance (Cap. 57) mandates specific record-keeping requirements that must be reflected in your privacy notice, including retention periods for employment records and payroll information. When handling disability-related information, compliance with the Disability Discrimination Ordinance (Cap. 487) requires additional safeguards and explicit consent mechanisms. The Privacy Commissioner for Personal Data has issued specific guidance for employment contexts, emphasizing the need for clear, accessible language and regular updates to reflect changing business practices. Your notice must also address Hong Kong's unique legal framework regarding data transfers to mainland China and other jurisdictions, ensuring appropriate safeguards are in place.