Employee Privacy Notice (Hong Kong)

An Employee Privacy Notice in Hong Kong gives formal notice of the matter it concerns to the recipient.

Data Protection Principle 1 (DPP 1) under Cap. 486 imposes two key requirements on every data user — including all employers in Hong Kong. First, personal data must be collected for a lawful purpose that is directly related to a function or activity of the employer. Second, the data subject (the employee) must be explicitly notified of the purposes of collection at or before the time the personal data is collected. An Employee Privacy Notice satisfies this notification obligation in writing and constitutes the employer's documented compliance record for DPP 1 across all employee data collection activities — from onboarding to termination.

The Office of the Privacy Commissioner for Personal Data (PCPD) — established under Part VI of Cap. 486 and responsible for enforcing the Ordinance across Hong Kong — has issued specific guidance on employment data, including recommended model data collection statements and privacy notice clauses tailored to the employment context. The PCPD strongly recommends that employers issue a written privacy notice to every employee at the commencement of employment, and update the notice whenever data collection practices, purposes, or third-party disclosures change. Employers who fail to provide adequate notification face potential enforcement action under Section 37 of Cap. 486, which empowers the PCPD to investigate complaints, issue enforcement notices, and refer serious breaches for criminal prosecution.

Employee personal data collected by Hong Kong employers typically spans multiple categories that must all be addressed in the privacy notice: basic identification data (full name, HKID number, date of birth, residential address, emergency contact); payroll and banking data (bank account details for salary payment, salary history for IRD Form IR56B reporting under the Inland Revenue Ordinance Cap. 112); Mandatory Provident Fund (MPF) contribution records and trustee notifications under Cap. 485; health and medical data (sick leave certificates, pre-employment medical examinations, occupational health assessments, medical insurance claims); performance management and disciplinary records; employment history, qualifications, and reference checks; building access control records; and CCTV footage from workplace cameras. Each category must be identified in the notice, together with its specific purpose.

The Personal Data (Privacy) (Amendment) Ordinance 2021 significantly strengthened the PCPD's enforcement powers, introducing new doxxing offences under Section 26A, higher penalties, and broader investigation powers. These changes have materially increased the legal and reputational risk for employers who fail to comply with their data obligations — including the obligation to maintain an up-to-date Employee Privacy Notice. A current, well-maintained notice demonstrates the employer's commitment to data governance and reduces exposure in the event of a data breach, PCPD audit, or employee complaint. Download this Employee Privacy Notice template free on forms-legal.com in PDF or Word format.

An Employee Privacy Notice (Hong Kong) is needed in several situations throughout the employment lifecycle.

At the start of employment: The notice should be issued to every new employee before or at the commencement of employment — ideally as part of the onboarding documentation alongside the employment contract. DPP 1 of Cap. 486 requires notification at or before the time of data collection. Issuing the notice at onboarding satisfies this requirement for all standard categories of employment data.

When collecting sensitive data: Where the employer collects sensitive categories of data — health records, biometric data (fingerprints, facial recognition for access control), financial information beyond payroll, or criminal records checks — the privacy notice must specifically address the purpose and legal basis for collecting that data. The PCPD's guidance on sensitive data requires particular care, and employee consent may be required in some cases.

When data practices change: The privacy notice must be updated whenever the employer introduces new data collection activities, new third-party recipients, new monitoring technologies, or new retention policies. Changes that reduce employee privacy rights — such as introducing keylogger software on company devices — must be notified in advance. Employers should maintain a version-controlled archive of all privacy notices issued.

For employees in roles involving access to third-party personal data: Employees who handle client, customer, or patient personal data in their role should receive both the employee privacy notice (covering their own HR data) and the employer's general data protection policy (covering how they must handle third-party data in their role). The two documents serve different purposes and should not be confused.

When responding to a PCPD investigation: If the PCPD investigates a complaint about the employer's data practices, the employer should be able to produce a current employee privacy notice and evidence of its distribution. A documented notice is a primary defence in PCPD enforcement proceedings.

For employees in roles with access to sensitive third-party data: Employees who process client personal data, patient health information, student records, or other sensitive third-party data in their professional role need a clear distinction between the employee privacy notice (covering their own HR data) and the employer's data protection policy governing how they must handle third-party personal data. Both documents should be issued at onboarding and reviewed together. The employee must understand the PDPO obligations applicable to both categories of data.

For PCPD compliance documentation: Employers who are subject to a PCPD investigation, data breach inquiry, or audit should produce the current employee privacy notice — together with a distribution log confirming each employee received the notice — as primary evidence of compliance with Data Protection Principle 1 of Cap. 486. A well-maintained distribution record, including dates of issue and employee acknowledgements, significantly strengthens the employer's defence in enforcement proceedings before the PCPD and reduces the risk of an enforcement notice under Section 37 of Cap. 486. Download this Employee Privacy Notice template on forms-legal.com in PDF or Word format.

A Hong Kong Employee Privacy Notice should include the following elements to comply with the Personal Data (Privacy) Ordinance (Cap. 486) and PCPD guidance on employment data.

Data user identity: The employer's full legal name, Companies Registry number, registered address, and the contact details of the person or department responsible for handling employee data enquiries, access requests, and corrections. Employees must know who to contact with data concerns.

Categories of personal data collected: A complete list of the categories of personal data the employer collects from employees — identification data, payroll and bank data, MPF data, health and medical data, performance records, disciplinary records, CCTV and access control data, IT usage data, and any other category relevant to the employer's operations. This satisfies the DPP 1 requirement to specify what is collected.

Purposes of collection: For each category of data, a clear statement of the specific purposes for which the data is used — payroll processing, salaries tax reporting to IRD, MPF contributions to the trustee, employees' compensation insurance under Cap. 282, performance management, recruitment, health and safety compliance under Cap. 509, and security monitoring. DPP 3 limits use to stated purposes.

Data retention periods: How long each category of data is retained — for example, payroll records for seven years (IRD requirement under Cap. 112), MPF records for seven years (Cap. 485 requirement), employment contracts for seven years after termination, and CCTV footage for 31 days as a standard period. Reference to the PCPD's recommended model retention periods.

Third-party disclosures: All categories of third parties to whom employee data may be disclosed — MPF trustees, IRD, Labour Department, group insurance providers, payroll processors, occupational health providers, background check agencies, and group company members. DPP 3 requires advance disclosure of all planned recipients.

Employee rights: The employee's right of access to their personal data under Section 18 of Cap. 486, the right of correction under Section 22, the right to object to direct marketing under Section 35C, and the right to complain to the PCPD under Section 37. The notice should state the procedure for making access and correction requests and the 40-day response period. Download this Employee Privacy Notice template on forms-legal.com in PDF or Word format, compliant with Hong Kong PDPO Cap. 486.

Biometric data and special category data: Where the employer collects biometric data — fingerprints, facial recognition data for access control, or retina scans — the notice must specifically address this collection. The Office of the Privacy Commissioner for Personal Data (PCPD) treats biometric data as particularly sensitive personal data requiring express consent and strict security measures. The notice should identify the specific biometric system in use, the purpose (access control, time and attendance), who has access to the biometric data, and the retention and deletion policy. CCTV footage from workplace cameras is also personal data under Cap. 486 and must be addressed in the notice, including the locations of cameras, retention period (typically 31 days as a standard period), and access controls.

Data breach notification: The notice should inform employees of the employer's data breach response procedures — how the employer detects, investigates, and responds to data incidents involving employee personal data, and how employees will be notified if their data is compromised. While Cap. 486 does not currently mandate breach notification to data subjects in all cases, the PCPD's guidance strongly recommends notification where there is real risk of harm. The Personal Data (Privacy) (Amendment) Ordinance 2021 significantly strengthened the PCPD's enforcement powers and introduced new doxxing offences under Section 26A. Download this Employee Privacy Notice template on forms-legal.com in PDF or Word format, compliant with Hong Kong PDPO Cap. 486.