February 9, 2025

How to Assess the Compliance of a Data Transfer With the PDPO

hk data is a free and open source website that provides users with access to over one million open data from international, European Union, national, regional and local data portals. The site also offers data visualization and analysis capabilities. Users can browse by country, topic or industry to find the most relevant data to meet their research needs.

Data hk is the premier resource for information about Hong Kong’s economic, demographic and cultural profile. Its comprehensive information is regularly updated, and its graphical and textual presentation formats are user-friendly. Its content consists of statistics, maps, diagrams, charts and tables, as well as textual data from official sources. It also contains a wealth of news, opinion and commentary from journalists in Hong Kong.

While GDPR is now in force, it does not impose a statutory restriction on the transfer of personal data outside the European Union (EEA). However, this does not mean that there are no protections for data transfers, and a data transfer must still comply with the provisions of the PDPO.

The first step in assessing whether the PDPO requirements on data transfer can be met is to assess whether the personal data being transferred will be subject to laws, practices or standards that are inconsistent with those in the PDPO. This can be done by reference to published laws, as well as by reviewing data processing contracts and other documentation. The next step is to identify any supplementary measures that may be necessary to bring the level of protection up to the PDPO standard. This can be achieved through technical measures, such as encryption or anonymisation and pseudonymisation, or contractual provisions, such as audit, inspection and reporting, beach notification, compliance support and co-operation.

Another key consideration is that a data transfer must only be made in relation to purposes for which the consent of the data subjects has been obtained. This could be a matter of interpretation, but it would likely require the data exporter to review its Personal Information Collection Statement and to verify whether the new purpose for which the data is being transferred is one that was specifically contemplated in that PICS.

Finally, it is important for a data exporter to record that its obligations under the PDPO in respect of data transfers have been met. This can be done by keeping records of all personal data that is transferred, together with details of the underlying grounds. It should also keep proper records of all efforts to fulfil its obligations in respect of cross-border data transfers. This will help it demonstrate its compliance with the PDPO when required to do so by the PCPD.