Do Not Call Compliance Policy (Hong Kong)

A Do Not Call Compliance Policy in Hong Kong is an internal governance document that sets out an organisation's procedures for complying with the Unsolicited Electronic Messages Ordinance (Cap. 593) and the direct marketing provisions of the Personal Data (Privacy) Ordinance (Cap. 486) Part VIA. Any organisation that conducts telemarketing, sends commercial emails or SMS, or uses personal data for direct marketing in Hong Kong must maintain a Do Not Call Compliance Policy to manage legal risk under both regulatory regimes.

The Unsolicited Electronic Messages Ordinance (Cap. 593), commonly known as the UEMO, came into force on 22 December 2007 and is administered by the Office of the Communications Authority (OFCA). The UEMO establishes Do Not Call registers for person-to-person telemarketing calls and pre-recorded messages, and a Do Not Fax Register for fax communications under Cap. 593. Senders must check telephone numbers against the Do Not Call Register before making commercial calls. Numbers registered on the DNC register may not be called without the specific consent of the number holder. OFCA investigates complaints from registered number holders who receive unsolicited commercial calls and may issue infringement notices or prosecute for repeated violations.

The Personal Data (Privacy) Ordinance (Cap. 486) Part VIA, administered by the Privacy Commissioner for Personal Data (PCPD), separately requires organisations to obtain consent before using a person's personal data for direct marketing purposes. Part VIA of Cap. 486 applies regardless of the communication channel — telephone, email, SMS, post, or any other medium. Organisations must inform the data subject of the intended use of their data for direct marketing and obtain their consent before any marketing communication is sent. Opt-out requests under Cap. 486 must be honoured without delay.

Both the Unsolicited Electronic Messages Ordinance (Cap. 593) and the Personal Data (Privacy) Ordinance (Cap. 486) must be complied with simultaneously. Non-compliance with the UEMO carries criminal penalties of up to HK$100,000 per first offence for calling registered numbers without consent under Cap. 593. Non-compliance with PDPO Part VIA carries penalties of up to HK$500,000 and 3 years imprisonment for a first offence under Cap. 486, and up to HK$1,000,000 and 5 years for providing personal data to third parties for marketing without consent — enforced by the PCPD.

OFCA maintains the Do Not Call Register under Cap. 593 and provides a checking service that allows organisations to verify telephone numbers before making commercial calls. The register must be checked at least every 30 days. Failure to check the register before calling, or calling a registered number without consent, is an offence under the Unsolicited Electronic Messages Ordinance (Cap. 593).

Regulated entities in Hong Kong — including licensed banks supervised by the Hong Kong Monetary Authority (HKMA) and licensed insurers supervised by the Insurance Authority (IA) — must also comply with HKMA and IA guidelines on customer communication in addition to Cap. 593 and Cap. 486. The 2021 amendments to the Personal Data (Privacy) Ordinance (Cap. 486) introduced new criminal offences for doxxing — non-consensual disclosure of personal data with intent to harm — reinforcing the importance of strict data handling practices in all direct marketing activities. A well-maintained Do Not Call Compliance Policy is the primary documented safeguard against regulatory action by OFCA and the PCPD.

A Do Not Call Compliance Policy in Hong Kong is needed before any organisation commences telemarketing activities, direct email campaigns, SMS marketing, or any other form of direct marketing using personal data under the Personal Data (Privacy) Ordinance (Cap. 486).

Financial institutions, insurance companies, real estate agencies, and telecommunications companies — all significant users of telemarketing in Hong Kong — must maintain a current Do Not Call Compliance Policy and demonstrate compliance with the Unsolicited Electronic Messages Ordinance (Cap. 593) to OFCA and compliance with the Personal Data (Privacy) Ordinance (Cap. 486) to the Privacy Commissioner for Personal Data. Licensed banks regulated by the HKMA under the Banking Ordinance (Cap. 155) and licensed insurers regulated by the Insurance Authority (IA) under the Insurance Ordinance (Cap. 41) are subject to additional sector-specific guidelines on customer communication that layer on top of the UEMO and PDPO requirements.

Retailers, e-commerce operators, and service businesses that maintain customer databases and use those databases for marketing communications need a Policy to manage the consent lifecycle under Cap. 486 — recording when consent was obtained, through what channel, for what purpose, and when it was withdrawn. Email marketing without a functioning unsubscribe mechanism, or with misleading sender information, is an offence under the Unsolicited Electronic Messages Ordinance (Cap. 593).

Organisations that outsource marketing activities to third-party call centres or marketing agencies remain responsible for compliance with both Cap. 593 and Cap. 486. A Do Not Call Compliance Policy should address how the organisation controls third-party marketing activities, including contractual requirements for the third party to check the DNC register, obtain consent, and honour opt-out requests. Data processing agreements with third-party marketers should address the requirements of Data Protection Principle 4 of Cap. 486, requiring appropriate security measures for personal data.

After any data breach or following a complaint by a customer to OFCA or the Privacy Commissioner for Personal Data under Cap. 486, reviewing and updating the Do Not Call Compliance Policy is essential. OFCA and the PCPD both have enforcement and investigation powers and expect organisations to maintain documented compliance procedures.

Annual review of the Policy is recommended to reflect changes in the Unsolicited Electronic Messages Ordinance (Cap. 593) regulations, PDPO guidelines under Cap. 486, OFCA guidance notes, and Privacy Commissioner directions. Organisations should update their procedures accordingly and document each review cycle as evidence of ongoing compliance.

A Do Not Call Compliance Policy for a Hong Kong organisation under the Unsolicited Electronic Messages Ordinance (Cap. 593) and Personal Data (Privacy) Ordinance (Cap. 486) Part VIA must include the following key elements.

Legal framework: A clear statement of the regulatory framework — the UEMO (Cap. 593) administered by the Office of the Communications Authority (OFCA) and the PDPO (Cap. 486) Part VIA administered by the Privacy Commissioner for Personal Data (PCPD) — and the specific obligations each imposes on the organisation's marketing activities. The Policy should acknowledge that both regimes apply simultaneously and that non-compliance with either carries separate criminal penalties.

Do Not Call Register checking procedures under Cap. 593: Documented procedures for checking the OFCA Do Not Call Register before making commercial person-to-person telephone calls. The Policy should specify how frequently the register is checked (at minimum every 30 days under Cap. 593), how the OFCA checking service is accessed, and how results are applied to calling lists. Records of each register check — including the date of the check and the lists screened — should be retained as evidence of compliance.

Consent management under Cap. 486: Procedures for obtaining, recording, and maintaining evidence of consent from data subjects for the use of their personal data for direct marketing under Personal Data (Privacy) Ordinance (Cap. 486) Part VIA. Consent must be specific, informed, and freely given. Records of consent, including the date, channel, and scope of consent, must be retrievable for evidence in the event of a PCPD investigation.

Internal Do Not Contact list: An internal list of individuals who have opted out of marketing communications under Cap. 593 and Cap. 486, updated without delay upon receipt of any opt-out request and cross-checked against all calling and mailing lists before every campaign. The list should capture the date of the opt-out request and the channel through which it was received.

Email and SMS compliance under Cap. 593: Procedures covering all commercial email messages — confirming they include a functioning unsubscribe facility, accurate sender information, and non-deceptive subject lines as required by the Unsolicited Electronic Messages Ordinance (Cap. 593). Unsubscribe requests must be processed within 10 business days. Address harvesting using automated software is prohibited under Cap. 593 and carries a fine of up to HK$1,000,000.

Opt-out handling: Documented procedures for receiving, recording, and acting on opt-out requests through all channels — telephone, email, SMS, written request, or through the OFCA DNC register. The organisation must cease marketing communications without delay after receipt of a valid opt-out request under both Cap. 593 and Cap. 486. Failure to honour an opt-out is a criminal offence under Section 35G of Cap. 486.

Third-party marketing controls: Where marketing activities are outsourced to third-party call centres or agencies, the Policy must address how compliance obligations are passed down contractually, including requirements for the third party to check the DNC register, maintain consent records, and honour opt-out requests. Data processing agreements with third parties must address Data Protection Principle 4 under Cap. 486.

Staff training: Regular training for all marketing, sales, and customer service staff on UEMO and PDPO direct marketing obligations, including how to process opt-out requests, how to check the DNC register under Cap. 593, and the procedure if a complaint is received from OFCA or the PCPD.

Compliance monitoring and audit: Annual review of the Policy, periodic audits of consent records and DNC checking procedures, and a documented process for reporting and remedying compliance failures. Related documents include the Privacy Policy, Data Protection Policy, Terms of Service, and Acceptable Use Policy. Forms-legal.com provides a Do Not Call Compliance Policy template for Hong Kong organisations covering all UEMO and PDPO obligations, downloadable as PDF or Word.