Data Retention Policy (Hong Kong)

A Data Retention Policy in Hong Kong establishes the rules and responsibilities that govern the conduct it addresses.

Hong Kong's data retention obligations arise from multiple regulatory sources that must be reconciled in a single coherent policy. The Personal Data (Privacy) Ordinance (Cap. 486), administered by the Office of the Privacy Commissioner for Personal Data (PCPD), mandates data minimisation through DPP2 — personal data must be deleted or anonymised once the retention purpose is exhausted. Simultaneously, the Inland Revenue Ordinance (Cap. 112) requires businesses to retain accounting records, payroll data, and tax-relevant documents for at least seven years under Section 51C. The Limitation Ordinance (Cap. 347) requires retention of records supporting potential legal claims for at least six years from the date of accrual of the cause of action. The Employment Ordinance (Cap. 57) requires wage records to be kept for at least two years. A Data Retention Policy reconciles these potentially conflicting requirements by mapping each data category to its longest applicable mandatory retention period and scheduling secure disposal at the end of that period.

Data Protection Principle 5 (DPP5) of Cap. 486 requires data users to make their personal data policies and practices available to data subjects. A Data Retention Policy addressing how long personal data is held and when it will be deleted is a key component of the DPP5 disclosure obligation, and a summary of retention periods should be included in the organisation's public-facing Privacy Policy.

Section 50 of Cap. 486 empowers the PCPD to issue enforcement notices against organisations that contravene DPP2 by retaining personal data beyond the necessary period. Contravention of an enforcement notice is a criminal offence under Cap. 486 carrying a fine of HK$50,000 and imprisonment for two years. PCPD enforcement decisions have consistently required subject organisations to implement written retention policies with defined schedules and secure disposal procedures as part of mandatory remediation.

The HKMA Supervisory Policy Manual and HKEX Listing Rules impose additional retention requirements on regulated financial institutions and listed companies respectively — the Data Retention Policy should address these sector-specific obligations alongside the PDPO minimum standards. For Hong Kong subsidiaries of multinational groups, the policy should align with group-level retention schedules while meeting local statutory minimums.

The relationship between data retention and breach risk is direct: organisations that retain personal data beyond its useful life hold unnecessarily large data sets. When a breach occurs, those excess records are compromised along with current data, amplifying harm and regulatory exposure under Section 50 of Cap. 486. A written Data Retention Policy with defined schedules and automated deletion mechanisms directly reduces breach impact. The PCPD's published enforcement notices following data breaches consistently identify excessive retention as a contributing factor. Section 51C of the Inland Revenue Ordinance (Cap. 112) sets the floor for tax records at seven years. forms-legal.com provides this Data Retention Policy template for Hong Kong organisations covering personal data, employment records, financial records, and corporate documents.

A Data Retention Policy in Hong Kong is needed by every organisation that holds personal data or business records, which in practice means every business, non-profit, educational institution, and government body operating in the territory.

A newly incorporated company should adopt a Data Retention Policy before collecting any personal data from employees, customers, or other data subjects. Without a defined retention schedule, the organisation cannot demonstrate DPP2 compliance from the outset and risks retaining personal data indefinitely through organisational inertia.

An established organisation that has accumulated years of personal data without systematic deletion procedures should adopt a policy as a matter of priority. The PCPD's enforcement activity has increasingly focused on organisations that retain excessive volumes of personal data, particularly following data breaches where the volume of compromised data reflects years of unnecessary accumulation.

Any organisation that receives a PCPD complaint related to excessive data retention or a DPP2 enforcement notice must adopt a written Data Retention Policy as part of the mandated remediation. PCPD enforcement notices routinely require subject organisations to implement documented retention schedules and secure disposal procedures within a specified period.

Organisations operating in regulated sectors — banking under HKMA supervision, securities under SFC regulation, healthcare under Hospital Authority governance — need a Data Retention Policy that addresses both PDPO DPP2 requirements and the sector-specific retention obligations imposed by their regulator. The HKMA expects authorised institutions to maintain documented records management policies consistent with both regulatory requirements and prudent risk management.

E-commerce businesses, digital platforms, and businesses that collect large volumes of customer personal data through websites, apps, or loyalty programmes particularly need a retention policy to manage the ongoing accumulation of customer data. Without defined retention periods and automated deletion mechanisms, these organisations risk holding years of personal data belonging to inactive customers — personal data that serves no current business purpose and creates disproportionate breach risk.

Organisations that engage data processors — cloud providers, payroll bureaus, marketing agencies — need a Data Retention Policy to define the instructions they give processors regarding data deletion at contract end, consistent with the data return and deletion clauses in their Data Processing Agreements.

A Data Retention Policy for Hong Kong organisations must address the following core elements to achieve DPP2 compliance under the Personal Data (Privacy) Ordinance (Cap. 486) and satisfy applicable statutory record-keeping requirements.

Scope and Data Categories defines all categories of personal and business data held by the organisation — customer personal data, employee personal data, financial and accounting records, legal correspondence, contracts and transaction records, CCTV footage, website analytics data, and any other identifiable data sets — and assigns each category to a defined retention period.

Retention Schedule is the operational heart of the policy, setting out the mandatory and recommended retention period for each data category. Standard Hong Kong retention periods include: accounting and tax records — seven years from the end of the relevant tax year under Section 51C of the Inland Revenue Ordinance (Cap. 112); employment records including payroll, HKID copies, and MPF records — seven years from termination of employment; contracts and transaction records — seven years from expiry or completion, consistent with the six-year limitation period under the Limitation Ordinance (Cap. 347) plus one year buffer; CCTV footage — no more than 31 days unless required for an ongoing investigation, per PCPD guidance; direct marketing consent records — three years after the individual opts out; and job applicant records — no more than two years from the date of the application unless the candidate is hired.

Legal Hold Procedures address the suspension of normal retention and deletion schedules when data is subject to an active or anticipated legal proceeding, regulatory investigation, or PCPD inquiry. The policy should specify the authority to issue legal holds, the process for identifying and preserving affected data, and the process for lifting holds when proceedings are concluded.

Secure Disposal Methods specifies the approved method for each storage format: cross-cut or micro-cut shredding for paper records; secure erasure software, degaussing, or physical destruction for electronic storage media; cloud provider-confirmed deletion for cloud-hosted data. The policy should prohibit inadequate disposal methods — strip-cut shredding, recycle bin deletion, or abandonment of storage media.

Disposal Register requires the organisation to maintain a written record of all data disposal activities, including the date, the categories and volume of data disposed of, the disposal method, and the identity of the person who performed or supervised the disposal. The Disposal Register should be retained for at least seven years as evidence of DPP2 compliance during any PCPD investigation.

Roles and Responsibilities assigns ownership of the Data Retention Policy to a named role — typically the Data Protection Officer, IT Manager, or Company Secretary — and specifies the responsibilities of each department for managing retention schedules within their data domains.

Policy Review Schedule requires annual review of the policy and retention schedule to account for changes in applicable law, new data categories, PCPD guidance updates, and changes in business operations.

Third-Party Processor Instructions: Where personal data is processed by third-party processors — cloud providers, payroll bureaus, marketing agencies — the Data Retention Policy must specify the deletion instructions issued to those processors at contract end. Under Section 26 of the Personal Data (Privacy) Ordinance (Cap. 486), the data user remains responsible for the personal data held by its processors. Data Processing Agreements with processors should incorporate the retention schedule and require written confirmation of deletion within a specified timeframe.

Employee and Training Obligations: All staff who handle personal data must receive training on the Data Retention Policy, including the retention schedule for data categories relevant to their role, the secure disposal procedures, and the legal hold procedures. The PCPD expects data users to demonstrate that staff understand retention obligations — untrained staff who delete data prematurely or retain it excessively can both trigger compliance failures. Training records should themselves be retained for at least three years as evidence of compliance.

forms-legal.com also provides a Data Protection Policy and Data Consent Form as companion documents for a complete PDPO compliance framework for Hong Kong organisations.