PDPO Policy for Hong Kong Non-Profit Compliance

A Hong Kong data protection policy records how an organisation collects, holds, uses, discloses, protects and disposes of personal data. Under the Personal Data (Privacy) Ordinance (Cap. 486), or PDPO, the organisation will generally be a data user when it controls those activities. The policy therefore speaks to the board, employees, volunteers, contractors and service providers who handle data on its behalf.

This template is not a website notice alone. It allocates responsibility to the board, a privacy contact and programme owners. It also sets operational rules for data inventories, access controls, retention reviews, processor appointments, overseas access, incident handling, training and audits. Separate clauses address photographs, testimonials, member directories and other publication decisions, including the risk created by disclosing personal data without the relevant consent where the doxxing provisions may apply.

The document covers paper files, email, messaging services, cloud platforms, recordings and archived material. The organisation must still match the text to practice. A policy cannot repair a donation form that collects unnecessary identity data or a shared drive open to people who have no reason to see beneficiary files.

The policy is organised around the PCPD's six Data Protection Principles. DPP1 concerns the purpose and manner of collection. DPP2 addresses accuracy and keeping data no longer than necessary. DPP3 limits use to the original or a directly related purpose unless prescribed consent or another legal basis permits a change. DPP4 requires practical security safeguards. DPP5 requires openness about policies and practices. DPP6 supports access to and correction of personal data.

Those principles shape day-to-day decisions. A programme manager must explain why each field is collected, a fundraiser must respect the purpose stated to a donor, and an administrator must correct material errors. Service provider terms must address security and erasure. The organisation must also be ready to handle a valid data access request within the statutory 40-day period.

Part VI A of the PDPO needs separate attention because addressed fundraising appeals can amount to direct marketing. Where the organisation selects that activity, the generated wording identifies the kinds of data and marketing subjects, provides a response channel and requires consent or an indication of no objection before use. The policy also requires a clear way to stop future messages. These controls sit alongside Captain.Legal's published commitments on legal compliance and data protection.

The practical trigger is control of information about identifiable living people, not the organisation's tax status or size. A small society with a spreadsheet of member names and telephone numbers is already handling personal data. A charity running casework, safeguarding or health-related programmes holds records whose unauthorised disclosure could cause much greater harm. A company limited by guarantee may also have employees, directors, contractors, donors and event participants in different systems.

The policy is useful when an organisation replaces informal practices, opens online forms, appoints a cloud provider, starts named fundraising or recruits volunteers. It also creates a common standard where teams have developed their own forms and storage habits. Employers should align it with their Hong Kong employment and HR documents, because the PCPD's Human Resource Management Code sets more specific expectations for employment records.

Adoption should follow a factual review. The organisation needs to identify the data it holds, why it holds it, where it is stored, who can access it, which processors receive it and when it should be deleted. That exercise often exposes the real issues: optional fields presented as mandatory, old volunteer applications kept indefinitely, copies of identity cards retained without a sound reason, or photos reused for publicity without checking the original notice.

The generated document contains 22 policy sections and five appendices. Its main components are:

• document control, scope, definitions and board-level accountability;
• rules for collection, data minimisation, accuracy, retention, use and security under all six DPPs;
• treatment of donor, member, volunteer, beneficiary, employee, governance, supplier, event and website data;
• direct marketing controls for named fundraising and promotional communications;
• processor due diligence, contract terms, overseas access and cross-border safeguards;
• procedures for disclosures, publications, incidents, access requests, correction requests and complaints;
• specific treatment of children, vulnerable persons, cookies, photographs, recordings and identity documents;
• a retention schedule, three separate PICS and a form deployment checklist.

The identity document clause expressly refers to the PCPD's Code of Practice on the Identity Card Number and Other Personal Identifiers. It tells the organisation to collect an identity number or copy only where collection is permitted and necessary, and to prefer a less intrusive verification method where one will do. Employment records are tied to the Code of Practice on Human Resource Management. These references make the policy more precise than a generic promise to handle sensitive information carefully.

The retention schedule lets the user set periods for donation records, former member records, unsuccessful volunteer applications and former volunteer files. It also explains that applicable income and expenditure records must be retained for at least seven years under section 51C of the Inland Revenue Ordinance. That statutory reference is a floor where the section applies, not a reason to keep every category of personal data for seven years. Governance, safeguarding, disputes and legal holds may justify different periods.

For a non-profit incorporated as a company, the privacy policy should sit beside the entity's constitutional and governance records in its Hong Kong business and incorporation document set. The documents have different jobs: constitutional records regulate the organisation, while this policy regulates the personal data moving through its activities.

A Personal Information Collection Statement is not the same thing as the full policy. DPP1(3) requires specified information to reach an individual on or before collection when the organisation collects personal data directly. A PICS should explain whether supply is obligatory or voluntary, the consequence of withholding obligatory information, the purposes of use, the classes of possible transferees, access and correction rights, and the person or job title and address handling those requests.

The template supplies distinct notices for donation, membership and volunteer forms because those transactions do not have the same purpose or recipients. The donation notice covers processing and acknowledging the gift, receipts, financial controls and fraud prevention. The membership notice addresses eligibility, registers, meetings, voting and governance. The volunteer notice deals with suitability, references, training, placement, safety, adjustments, safeguarding and expenses. Each version marks the boundary between required information and genuinely optional fields.

If direct marketing is selected, each PICS gains a separate consent statement and response channel. If it is not selected, the notice says the collected data will not be used for direct marketing while preserving necessary service or relationship messages. That distinction prevents an operational email about a donation receipt or volunteer shift from being confused with a named fundraising appeal.

Before deployment, compare each notice with the finished form. Broad transferee language, hidden optionality and stale contact details are common faults. The PICS should be conspicuous, readable and specific, with the privacy contact and postal address filled in correctly.

The guided questionnaire asks for the organisation's legal name, form, registration reference, address, public contact details, policy version, approval information and privacy contact. It then records documented operational choices about retention, direct marketing, overseas hosting or access, and volunteers under 18.

Those answers change the legal text. Choosing direct marketing inserts the consent, subject-matter and opt-out controls; choosing no direct marketing inserts a prohibition and an approval process for any later change. Where overseas hosting, support or remote access is used, the questionnaire asks for locations, service arrangements and safeguards. The resulting clauses acknowledge that section 33 of the PDPO has not been brought into operation while still requiring due diligence, transparency, contractual protection and transfer assessment. A separate branch gives age-appropriate rules where volunteers under 18 are accepted.

The questions about retention do not impose one period across every record. They populate a schedule that distinguishes financial files, member administration and volunteer records. The privacy contact details then flow into the policy and all three PICS, reducing the chance that a form points data subjects to a person or address different from the one named in the internal procedure.

Completion is the drafting stage, not the end of the compliance work. The board or governing body should approve the final policy, record the approval date and give the privacy contact enough authority to maintain it. Programme owners should then update live forms, publish the appropriate privacy information, remove unnecessary fields and set deletion tasks against the agreed retention schedule.

Processor contracts deserve a separate check. The policy expects written terms covering instructions, confidentiality, access, security, sub-processing, retention, return or deletion, overseas access, incident reporting and audit information. A familiar software provider should not escape review merely because several teams already use it. The same applies to external mailing services, payment processors, event platforms and volunteer management systems.

Training should use examples drawn from the organisation's work. A fundraiser needs to recognise an opt-out. A volunteer coordinator needs to restrict access to health and safeguarding information. A communications officer needs approval before publishing an identifiable beneficiary story. Anyone receiving an access request or discovering a lost device needs to know whom to contact immediately.

Review the policy at least annually and after a material legal, programme, technology or provider change. Keep a record of incidents and decisions, including why an exception or a longer retention period was necessary. The most persuasive evidence of compliance is the connection between the approved wording, the forms people see and the controls operating behind them.